CVE-2026-90709
Deferred Deferred - Pending Action

Code Injection in Yot CMS Admin Console

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90709
EUVD
EUVD-2026-77428

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
yot_cms yot_cms to 3.3.1 (inc)
yot_cms yot_iii to 3.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a code injection flaw in Yot CMS versions up to 3.3.1. It exists in the admin.php file of the console module where the eval() function executes user-provided input from a POST parameter named text without proper validation. Attackers can remotely inject and execute arbitrary PHP code on the server by sending malicious input through this parameter.

Detection Guidance

Check for suspicious POST requests to index.php with parameters page=console and file=admin. Monitor for eval($_POST['text']) execution in modsys/console/admin.php. Look for unexpected admin console access or PHP code injection attempts.

Impact Analysis

This vulnerability allows remote attackers with administrative access (or those who can obtain it) to execute arbitrary code on the web server. This could lead to full system compromise, data theft, unauthorized access, or further network infiltration. The impact includes potential loss of sensitive data and control over the affected server.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA due to inadequate security controls. It enables unauthorized code execution which could lead to data breaches, unauthorized access to protected health information or personal data, and failure to implement proper access controls and input validation.

Mitigation Strategies

Immediately update Yot CMS to a patched version beyond 3.3.1. Disable the console module if not needed. Implement strict input validation for POST parameters. Add CSRF protection and strengthen admin session verification. Block access to modsys/console/admin.php via firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90709. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart