CVE-2019-25687 | Pegasus CMS 1.0 contains a remote code execution vulnerabili… | CVSS 9.8 CRITICAL

Description

Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra_fields.php plugin that allows unauthenticated attackers to execute arbitrary commands by exploiting unsafe eval functionality. Attackers can send POST requests to the submit.php endpoint with malicious PHP code in the action parameter to achieve code execution and obtain an interactive shell.

Metadata

CVE ID: CVE-2019-25687
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-04-05 15:27 UTC
Published: 2026-04-05 20:45 UTC
Last updated: 2026-04-06 18:21 UTC
Primary CWE: CWE-22
Improper Limitation of a Pathname to a Restricted Directory …
Vendor / Product: wisdom / Pegasus CMS
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
wisdom	Pegasus CMS	—	1.0

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

ExploitDB-46542 https://www.exploit-db.com/exploits/46542
Official Product Homepage https://www.wisdom.com.au/web/pegasus-cms
VulnCheck Advisory: Pegasus CMS 1.0 Remote Code Execution via extra_fields.php https://www.vulncheck.com/advisories/pegasus-cms-remote-code-execution-via-extra-fields-php