PT-2026-67455 · Websitebaker Org E.V. · Website Baker Cms

CVE-2026-61523 · Publicado 2026-08-03 · Atualizado 2026-08-03

NVD

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-61523

Produtos afetados

Website Baker Cms

Referências · 4

• 🔥 https://medium.com/@benjaminasareagyapong2006/two-rce-vulnerabilities-i-found-on-my-birthday-evening-4563006a615a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-61523 · Nota de Segurança
• https://vulncheck.com/advisories/websitebaker-cms-code-injection-via-droplets-editor · Nota
• https://addon.websitebaker.org/en/browse-add-ons/?type=5&cid=997 · Correção