CVE-2022-28118

CriticalCVSS 9.8

Published: 03/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.63%

84th percentile - higher than 84% of all known CVEs

Summary

A vulnerability in SiteServer CMS version 7.x allows attackers to execute arbitrary code via a crafted plug-in. The flaw stems from insufficient security checks on plug-ins loaded into the system.

Risk Assessment

An attacker can take over the CMS server, steal data, or install malware, compromising the confidentiality, integrity, and availability of the system.

Recommendation

Immediately update SiteServer CMS to the latest available version that includes a security fix. Additionally, implement plug-in verification mechanisms before installation.

Original NVD description (English source)

SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.