CVE-2026-5333
Published: 02 April 2026
Summary
CVE-2026-5333 is a medium-severity Injection (CWE-74) vulnerability in Defaultfuction Content Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A security flaw has been discovered in DefaultFuction Content-Management-System 1.0 affecting unknown processing of the file /admin/tools.php. Manipulation of the host argument permits command injection, classified under CWE-74 and CWE-77. The issue is remotely exploitable with a CVSS 4.0 score of 6.9 reflecting network attack vector, low complexity, and no required privileges or user interaction.
Unauthenticated remote attackers can supply crafted input to the affected parameter and execute operating system commands on the server. Successful exploitation yields limited impacts to confidentiality, integrity, and availability on the target system. Publicly released exploit code increases the feasibility of automated or manual attacks against exposed instances.
The associated EPSS score rose from a low baseline to a peak of 0.0105, indicating emerging exploitation interest after disclosure. Reference materials consist of the project repository and Vuldb entries but contain no details on official patches or mitigation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18226
Vulnerability details
A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been…
more
released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in a public-facing web application (/admin/tools.php) enables T1190 (Exploit Public-Facing Application) for initial access. Successful exploitation allows arbitrary OS command execution, directly facilitating T1059.004 (Unix Shell) on the server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the specific command injection flaw in /admin/tools.php of DefaultFuction CMS 1.0.
Directly validates and sanitizes the 'host' argument to prevent injection of arbitrary commands.
Enforces logical access controls to block unauthorized remote access to the vulnerable /admin/tools.php endpoint.