VULNERABILITY INTELLIGENCE

CVE-2024-58284

CVSS score7.2 HIGH
EPSS probability1.10%
CISA KEVNot currently listed
Published2025-12-10
Last modified2026-09-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

Weakness classification

  • disclosure@vulncheck.com: CWE-94

Primary references