EUVD-2026-22985Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible, no privileges, no user interaction, and full loss of confidentiality, integrity, and availability.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. This vulnerability is exploitable via a crafted input.
AnalysisAI
Remote code execution in Slah CMS v1.5.0 and below allows unauthenticated attackers to inject and execute arbitrary code via a crafted input to the session() function in config.php. Proof-of-concept exploit code is publicly available, though no active exploitation has been confirmed by CISA KEV. With a CVSS score of 9.8 and a full-impact compromise, this vulnerability poses a critical risk to any exposed instance.
Technical ContextAI
The underlying technology is PHP, and the root cause is an improper handling of code injection (CWE-94) in the session() function within config.php. The application likely passes unsanitized user-supplied input into a dynamic code evaluation construct such as eval(), enabling attacker-controlled PHP code execution. CPE data is incomplete, listing 'n/a' as vendor and product, but the affected software is identified as Slah CMS, a PHP-based content management system.
RemediationAI
No vendor-released patch is identified in the available data. As an immediate mitigation, restrict network access to the Slah CMS admin interface and, if feasible, disable the session() function or rename config.php until a fix is released. Deploy a web application firewall rule to block requests containing suspicious PHP code patterns aimed at the vulnerable endpoint. Monitor the reference URLs (e.g., VulDB advisory) for vendor updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today