PT-2026-25808 · Undefined · Undefined

Published 2026-03-16 · Updated 2026-03-18 · CVE-2025-50881

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Use It Flow versions prior to 10.0.0

Description The flow/admin/moniteur.php script is susceptible to Remote Code Execution. The script processes GET requests and retrieves user-supplied input from the action URL parameter. Insufficient validation of this input, combined with its use in the eval() function, allows for arbitrary PHP code execution. The method exists() check only validates the portion of the input before the first parenthesis (. Successful exploitation enables an attacker to execute arbitrary PHP code on the server with the privileges of the web server process.

Recommendations Update Use It Flow to version 10.0.0 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-50881

Affected Products

Undefined

References · 6

• 🔥 https://github.com/0xdeadbit/CVE-2025-50881 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-50881 · Security Note
• http://advanced.com · Note
• https://twitter.com/CVEnew/status/2033755377632723072 · Twitter Post
• http://use.com · Note
• https://twitter.com/TheHackerWire/status/2034389375979753494 · Twitter Post