CVE-2022-50806

8.6 highEPSS 1.3%

4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attackers can save malicious code in the template and execute arbitrary commands by accessing a specific categories.php endpoint with a crafted cat_id parameter.

Severity

CVSS 4.0

8.6 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2026-01-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

4homepages:4images

References

https://www.4homepages.de/
https://www.exploit-db.com/exploits/51147
https://www.vulncheck.com/advisories/images-remote-command-execution-rce

Check your stack JSON