CVE-2024-58284

8.6 highEPSS 1.1%

High (8.6) in popojicms popojicms. EPSS 1.1% chance of exploitation in the next 30 days.

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

Severity

CVSS 4.0

8.6 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2025-12-10
Modified: 2026-09-26
Record from: the NVD, synced 2026-10-19

Affected

popojicms:popojicms

References

https://github.com/PopojiCMS/PopojiCMS
https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip
https://www.exploit-db.com/exploits/52022
https://www.popojicms.org/
https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authenticated-metadata-settings

Check your stack JSON