PT-2026-30495 · Wisdom · Pegasus Cms

R3Zk0N · Publicado 2026-04-05 · Atualizado 2026-04-05 · CVE-2019-25687

NVD

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra fields.php plugin that allows unauthenticated attackers to execute arbitrary commands by exploiting unsafe eval functionality. Attackers can send POST requests to the submit.php endpoint with malicious PHP code in the action parameter to achieve code execution and obtain an interactive shell.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-25687

Produtos afetados

Pegasus Cms

Referências · 4

• 🔥 https://exploit-db.com/exploits/46542 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25687 · Nota de Segurança
• https://vulncheck.com/advisories/pegasus-cms-remote-code-execution-via-extra-fields-php · Nota
• https://wisdom.com.au/web/pegasus-cms · Nota