CVE-2021-47939Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system commands by injecting PHP code into module parameters. Attackers can send POST requests to /manager/index.php with malicious PHP code in the 'post' parameter to create modules that execute arbitrary commands when invoked.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2021-47939

Full discourse1 post

CVE@CVEnew152d
Disclosure
CVE-2021-47939 Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system comman… https://www.cve.org/CVERecord?id=CVE-2021-47939
Post summary
The note identifies a remote code execution flaw in Evolution CMS 3.1.6 that permits authenticated users with module creation rights to run arbitrary system commands, but it offers no PoC, exploit details, or mitigation information.
0000057
57.5K followersView on X

Explore more

Back to dashboard