CVE-2022-50944
published 2026-05-10CVE-2022-50944: Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files…
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.35%
26.6th percentile
Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=add_post parameter, and the uploaded files are executed by the server.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| megatkc | aero_cms | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MegaTKC Aero CMS 0.0.1 posts.php image code injection (Exploit 51085 / EDB-51085)
vuldb·2026-05-10·CVSS 8.7
CVE-2022-50944 [HIGH] MegaTKC Aero CMS 0.0.1 posts.php image code injection (Exploit 51085 / EDB-51085)
A vulnerability has been found in MegaTKC Aero CMS 0.0.1 and classified as critical. This vulnerability affects unknown code of the file posts.php. The manipulation of the argument image leads to code injection.
This vulnerability is traded as CVE-2022-50944. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
GHSA
GHSA-377g-gwp8-j5fx: Aero CMS 0
ghsa_unreviewed·2026-05-10
CVE-2022-50944 [HIGH] CWE-94 GHSA-377g-gwp8-j5fx: Aero CMS 0
Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=add_post parameter, and the uploaded files are executed by the server.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-10
Published