What’s Vulnerable › Vulnerabilities

CVE-2024-58284: PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-10 · updated 2026-09-26
• Weakness: CWE-94

Description

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

Affected products

• PopojiCMS: 2.0.1

References

• https://github.com/PopojiCMS/PopojiCMS
• https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip
• https://www.exploit-db.com/exploits/52022
• https://www.popojicms.org/
• https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authenticated-metadata-settings
• https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip

Get alerted when CVE-2024-58284 or the next vulnerability affects your stack