CVE-2026-5333 MEDIUM

CVE-2026-5333: DefaultFuction Content-Management-System tools.php command injection

Vendor Defaultfuction

Product Content-Management-System

Weakness CWE-77

Published April 2, 2026

Last update April 2, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

Description

A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Key dates

Disclosure timeline

April 2, 2026 CVE published

April 2, 2026 Record updated