PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-25687 wisdom CVE debrief

CVE-2019-25687 is a remote code execution vulnerability in Pegasus CMS 1.0, specifically in the extra_fields.php plugin. This vulnerability allows unauthenticated attackers to execute arbitrary commands by exploiting unsafe eval functionality. Attackers can achieve code execution by sending POST requests to the submit.php endpoint with malicious PHP code in the action parameter, potentially obtaining an interactive shell.

Vendor
wisdom
Product
Pegasus CMS
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-05
Original CVE updated
2026-07-24
Advisory published
2026-04-05
Advisory updated
2026-07-24

Who should care

Organizations using Pegasus CMS 1.0 should prioritize patching this vulnerability to prevent potential exploitation. The vulnerability's critical CVSS score of 9.3 indicates a high risk of severe impact if exploited.

Technical summary

The vulnerability exists in the extra_fields.php plugin of Pegasus CMS 1.0. It allows unauthenticated attackers to execute arbitrary PHP code by sending a POST request to the submit.php endpoint with malicious code in the action parameter. This is possible due to the unsafe use of the eval function. Successful exploitation can lead to code execution and potentially an interactive shell. Organizations should review their deployments for affected versions and prioritize patching to prevent potential exploitation. The critical CVSS score of 9.3 indicates a high risk of severe impact if exploited, emphasizing the need for immediate attention.

Defensive priority

High

Recommended defensive actions

  • Apply the vendor's official patch or upgrade to a non-vulnerable version of Pegasus CMS.
  • Implement web application firewalls (WAFs) to detect and block suspicious traffic to the submit.php endpoint.
  • Conduct regular security audits and vulnerability assessments to identify and address potential issues.
  • Restrict access to the submit.php endpoint to only trusted IP addresses or networks.
  • Monitor for and respond to potential exploitation attempts.

Evidence notes

The CVE record was published on 2026-04-05T21:16:47.490Z and was last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. The vulnerability has a CVSS score of 9.3, indicating critical severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-25687 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-25687

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-25687 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-25687

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.