Vulnerability · Published May 10, 2026 · Assigned by VulnCheck
CVE-2022-50944Aero CMS 0.0.1 PHP Code Injection via posts.php
High 8.8
In plain English
A high-severity code injection in Aero CMS from MegaTKC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 71.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=add_post parameter, and the uploaded files are executed by the server.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51085 exploit
- Official Product Homepage product
- VulnCheck Advisory: Aero CMS 0.0.1 PHP Code Injection via posts.php third-party-advisory