1.2.1

DATE	CVE	VULNERABILITY TITLE	RISK
2012-10-07	CVE-2012-1414	Cross-Site Request Forgery (CSRF) vulnerability in Plume-Cms Plume CMS Cross-site request forgery (CSRF) vulnerability in manager/news.php in Plume CMS 1.2.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that create News pages via a publish action. network plume-cms CWE-352	6.8
2012-04-11	CVE-2012-2156	Cross-Site Scripting vulnerability in Plume-Cms Plume CMS Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the u_email parameter (aka Authors Email field) to manager/users.php, (2) the u_realname parameter (aka Authors Name field) to manager/users.php, or (3) the c_author parameter (aka Author field) in an ADD A COMMENT section. network plume-cms CWE-79	4.3
2011-11-09	CVE-2011-3985	Cross-Site Scripting vulnerability in Plume-Cms Plume CMS Cross-site scripting (XSS) vulnerability in Plume before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. network high complexity plume-cms CWE-79	2.6