PT-2026-2374 · Kalyan02 · Enano Cms

P1Ckzi · CVE-2022-50898 · Published 2026-01-13 · Updated 2026-01-13

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NanoCMS version 0.4

Description An authenticated file upload issue allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files containing arbitrary code to the server's pages directory by exploiting the page creation mechanism, which lacks proper input sanitization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

CVE-2022-50898

Affected Products

Enano Cms

References · 6

• 🔥 https://github.com/ishell/Exploits-Archives/blob/master/2009-exploits/0904-exploits/nanocms-multi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/50997 · Exploit
• https://osv.dev/vulnerability/CVE-2022-50898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50898 · Security Note
• https://github.com/kalyan02/NanoCMS · Note
• https://vulncheck.com/advisories/nanocms-remote-code-execution-rce-authenticated · Note