CVE-2019-25687CWE-22

Pegasus CMS 1.0 Remote Code Execution via extra_fields.php

Critical · published April 5, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
72.6
In the wild
Unconfirmed
What it is

Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra_fields.php plugin that allows unauthenticated attackers to execute arbitrary commands by exploiting unsafe eval functionality. Attackers can send POST requests to the submit.php endpoint with malicious PHP code in the action parameter to achieve code execution and obtain an interactive shell.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01416 · 72.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-05T20:45Z
EPSS history
Timeline
  • 05 APR 20:45Z
    Pegasus CMS 1.0 Remote Code Execution via extra_fields.php
    cvelistv5