CVE-2021-47938

HighCVSS 8.8

Published: 10/05/2026(UTC)Updated: 25/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

44th percentile - higher than 44% of all known CVEs

Summary

ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitrary PHP code by injecting malicious code into the sat_code parameter. Attackers can authenticate, submit a POST request to /modules/system/admin.php?fct=autotasks&op=mod with crafted sat_code containing PHP commands, which creates an executable file that accepts arbitrary commands via GET parameters.

Risk Assessment

The organization is at risk of complete server takeover by an authenticated attacker who can execute arbitrary system commands, leading to loss of confidentiality, integrity, and availability of data.

Recommendation

Immediately upgrade ImpressCMS to the latest version and restrict access to the autotasks administrative interface to trusted administrators only.

Other vulnerabilities in ImpressCMS

CVE-2026-73679High
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.

Original NVD description (English source)