Vulnerability · Published Dec 10, 2025 · Assigned by VulnCheck
CVE-2024-58284PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings
High 8.6
In plain English
A high-severity code injection in PopojiCMS from PopojiCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 4.0)8.6High
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- ExploitDB-52022 exploit
- Official Vendor Homepage vendor-advisory, product
- Product Archive product
- Project Repository product
- VulnCheck Advisory: PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings third-party-advisory