CVE-2026-90709

2.0 lowEPSS 0.4%

Low (2.0). EPSS 0.4% chance of exploitation in the next 30 days.

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Severity

CVSS 4.0

2.0 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

4.7 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-94
Published: 2026-09-14
Modified: 2026-09-14
Record from: the NVD, synced 2026-10-19

References

https://github.com/dddwmr/CVE/blob/main/YOT%20III%20modsys%3Aconsole%20admin%20eval%20of%20POST%20text%20leads%20to%20remote%20code%20execution.md
https://vuldb.com/cve/CVE-2026-90709
https://vuldb.com/submit/918371
https://vuldb.com/vuln/403251
https://vuldb.com/vuln/403251/cti

Check your stack JSON