CVE Catalog
CVE-2022-36262
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk1.45%
70th percentile - higher than 70% of all known CVEs
Summary
An issue was discovered in taocms 3.0.2 in the website settings that allows arbitrary PHP code to be injected by modifying config.php.
Risk Assessment
An attacker can take over the server by executing malicious PHP code, leading to full system and data compromise.
Recommendation
Immediately update taocms to the latest version and restrict permissions on config.php to prevent unauthorized modification.
Original NVD description (English source)
An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php.