Tallcms
Monthly
Code injection in TallCMS up to and including 4.8.0 lets an authenticated admin-panel user who is not a super admin upload and install a plugin ZIP containing arbitrary PHP that is then autoloaded and executed by the application. Exploitation requires valid credentials at a privilege level below super_admin plus the plugin-upload capability to be enabled (the uploadsAllowed() config flag), so it is not reachable anonymously, but publicly available exploit code exists per the referenced GitHub issue and no CISA KEV entry indicates confirmed active exploitation. Note that the vendor/CVSS 4.0 score (5.3, low confidentiality/integrity/availability impact) substantially understates the issue relative to the independent assessment (CVSS 3.1 8.8, C:H/I:H/A:H), which treats the arbitrary-PHP execution as full compromise of the installation; the signals across sources are mixed and partly contradictory.
Code injection in TallCMS up to and including 4.8.0 lets an authenticated admin-panel user who is not a super admin upload and install a plugin ZIP containing arbitrary PHP that is then autoloaded and executed by the application. Exploitation requires valid credentials at a privilege level below super_admin plus the plugin-upload capability to be enabled (the uploadsAllowed() config flag), so it is not reachable anonymously, but publicly available exploit code exists per the referenced GitHub issue and no CISA KEV entry indicates confirmed active exploitation. Note that the vendor/CVSS 4.0 score (5.3, low confidentiality/integrity/availability impact) substantially understates the issue relative to the independent assessment (CVSS 3.1 8.8, C:H/I:H/A:H), which treats the arbitrary-PHP execution as full compromise of the installation; the signals across sources are mixed and partly contradictory.