CVE-2019-25687

CriticalPublic PoC

Published: 05 April 2026

Published

05 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0142 69.3th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2019-25687 is a critical-severity Path Traversal (CWE-22) vulnerability in Wisdom Pegasus Cms. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2019-25687 is a remote code execution vulnerability affecting Pegasus CMS version 1.0, specifically in the extra_fields.php plugin. The flaw stems from unsafe eval functionality, enabling unauthenticated attackers to execute arbitrary commands. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-22.

Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending POST requests to the submit.php endpoint with malicious PHP code in the action parameter, attackers achieve remote code execution and can obtain an interactive shell, granting high confidentiality, integrity, and availability impacts.

Advisories and references, including an Exploit-DB entry at https://www.exploit-db.com/exploits/46542, a VulnCheck advisory at https://www.vulncheck.com/advisories/pegasus-cms-remote-code-execution-via-extra-fields-php, and vendor information at https://www.wisdom.com.au/web/pegasus-cms, provide details on the issue, though specific patch or mitigation guidance is not detailed in the CVE description. Security practitioners should review these for remediation steps, such as upgrading the CMS or disabling the affected plugin.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-20107

Vulnerability details

Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra_fields.php plugin that allows unauthenticated attackers to execute arbitrary commands by exploiting unsafe eval functionality. Attackers can send POST requests to the submit.php endpoint with malicious PHP code in…

the action parameter to achieve code execution and obtain an interactive shell.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2019-25687 enables unauthenticated remote code execution via unsafe eval in a public-facing web application (Pegasus CMS), directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0