# WARNING: Security vulnerabilities in the pling platform

**URL:** https://forum.opendesktop.org/t/warning-security-vulnerabilities-in-the-pling-platform/19844
**Category:** Pling.com - Libre Publishing
**Created:** [June 23, 2021, 10:39am UTC](https://forum.opendesktop.org/t/warning-security-vulnerabilities-in-the-pling-platform/19844 "2021-06-23T10:39:26Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sectestuser](https://forum.opendesktop.org/user_avatar/forum.opendesktop.org/sectestuser/32/57040_2.png) [@sectestuser](https://forum.opendesktop.org/u/sectestuser)
#### Post date: [June 23, 2021, 10:39am UTC](https://forum.opendesktop.org/t/warning-security-vulnerabilities-in-the-pling-platform/19844/1 "2021-06-23T10:39:26Z")

</div>

Hello,

after unsucessfully having tried contacting the pling team in various ways (incl. [this forum](https://forum.opendesktop.org/t/where-to-report-vulnerabilities-in-the-pling-opendesktop-platform/19555)), I have now published information about yet unpatched vulnerabilities in all pling-based marketplace websites as well as the PlingStore native application in order to warn you users:

- [appimagehub.com](http://appimagehub.com), [store.kde.org](http://store.kde.org), [gnome-look.org](http://gnome-look.org), [xfce-look.org](http://xfce-look.org), [pling.com](http://pling.com) are affected by a stored, wormable Cross-Site Scripting vulnerability that allows taking over accounts
- The PlingStore Electron app is affected by a Remote Code Execution vulnerability that can be exploited by any website while PlingStore is running in the background

The full details can be found here: [Linux marketplaces vulnerable to RCE and supply chain attacks | Positive Security](https://positive.security/blog/hacking-linux-marketplaces)

Cheers,  
Fabian

---

<div class="post-metadata">

### Author: ![fleshwounded](https://forum.opendesktop.org/user_avatar/forum.opendesktop.org/fleshwounded/32/66080_2.png) [@fleshwounded](https://forum.opendesktop.org/u/fleshwounded)
#### Post date: [June 23, 2021, 9:34pm UTC](https://forum.opendesktop.org/t/warning-security-vulnerabilities-in-the-pling-platform/19844/2 "2021-06-23T21:34:32Z")

</div>

Lmao Im a little shocked at the length you needed to goto to disclose this… Seriously WTF. 12 hours later and not even a comment.

---

<div class="post-metadata">

### Author: ![justinz](https://forum.opendesktop.org/user_avatar/forum.opendesktop.org/justinz/32/118829_2.png) [@justinz](https://forum.opendesktop.org/u/justinz)
#### Post date: [June 25, 2021, 7:11am UTC](https://forum.opendesktop.org/t/warning-security-vulnerabilities-in-the-pling-platform/19844/3 "2021-06-25T07:11:39Z")

</div>

This is the report about the issue [Regarding security reportings | Opendesktop.org](https://blog.opendesktop.org/regarding-security-reportings/)