What is the CVSS score of CVE-2025-50881?

CVE-2025-50881 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-50881?

Organizations using Use It Flow administration website face significant risk from CVE-2025-50881, a code injection vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2025-50881?

Within 7 days: Identify all affected systems running Use It Flow administration website and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2025-50881

HIGH

Code Injection (CWE-94)

2026-03-16 mitre

PHP RCE Code Injection N A

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:22 vuln.today

cvss_changed

Analysis Generated

Mar 16, 2026 - 20:38 vuln.today

CVE Published

Mar 16, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

The flow/admin/moniteur.php script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the action URL parameter, performs insufficient validation, and incorporates this input into a string that is subsequently executed by the eval() function. Although a method_exists() check is performed, it only validates the part of the user input *before* the first parenthesis (, allowing an attacker to append arbitrary PHP code after a valid method call structure. Successful exploitation allows an unauthenticated or trivially authenticated attacker to execute arbitrary PHP code on the server with the privileges of the web server process.

AnalysisAI

The flow/admin/moniteur.php script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution.

Technical ContextAI

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication.

RemediationAI

Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.