CVE-2019-25687 wisdom CVE debrief

Who should care

Organizations using Pegasus CMS 1.0 should prioritize patching this vulnerability to prevent potential exploitation. The vulnerability's critical CVSS score of 9.3 indicates a high risk of severe impact if exploited.

Technical summary

The vulnerability exists in the extra_fields.php plugin of Pegasus CMS 1.0. It allows unauthenticated attackers to execute arbitrary PHP code by sending a POST request to the submit.php endpoint with malicious code in the action parameter. This is possible due to the unsafe use of the eval function. Successful exploitation can lead to code execution and potentially an interactive shell. Organizations should review their deployments for affected versions and prioritize patching to prevent potential exploitation. The critical CVSS score of 9.3 indicates a high risk of severe impact if exploited, emphasizing the need for immediate attention.

Defensive priority

High

Recommended defensive actions

• Apply the vendor's official patch or upgrade to a non-vulnerable version of Pegasus CMS.
• Implement web application firewalls (WAFs) to detect and block suspicious traffic to the submit.php endpoint.
• Conduct regular security audits and vulnerability assessments to identify and address potential issues.
• Restrict access to the submit.php endpoint to only trusted IP addresses or networks.
• Monitor for and respond to potential exploitation attempts.

Evidence notes

The CVE record was published on 2026-04-05T21:16:47.490Z and was last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. The vulnerability has a CVSS score of 9.3, indicating critical severity.

Official resources