CVE-2021-47938

🗓️ 10 May 2026 12:43:56Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

Authenticated attackers can trigger remote code execution in ImpressCMS 1.4.2 by injecting PHP into sat_code via POST to autotasks, creating a file that accepts GET commands.

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2021-47938	10 May 202612:43	–	attackerkb
Circl	CVE-2021-47938	12 Sep 202610:00	–	circl
CNNVD	ImpressCMS 代码注入漏洞	10 May 202600:00	–	cnnvd
Cvelist	CVE-2021-47938 ImpressCMS 1.4.2 Remote Code Execution via Autotasks	10 May 202612:43	–	cvelist
EUVD	EUVD-2021-34799	10 May 202615:31	–	euvd
NVD	CVE-2021-47938	10 May 202613:16	–	nvd
Positive Technologies	PT-2026-39513	10 May 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2021-47938: Improper Control of Generation of Code	10 May 202600:00	–	rapid7
Vulnrichment	CVE-2021-47938 ImpressCMS 1.4.2 Remote Code Execution via Autotasks	10 May 202612:43	–	vulnrichment

Vulners

CNA

Node

impresscms impresscmsMatch1.4.2

[
  {
    "vendor": "Impresscms",
    "product": "ImpressCMS",
    "versions": [
      {
        "version": "1.4.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
impresscms	www.impresscms.org/modules/downloads/
vulncheck	www.vulncheck.com/advisories/impresscms-remote-code-execution-via-autotasks
impresscms	www.impresscms.org/
exploit-db	www.exploit-db.com/exploits/50298

Parameter	Position	Path	Description	CWE
sat_code	request body	/modules/system/admin.php?fct=autotasks&op=mod	Authenticated RCE via sat_code parameter in autotasks module; crafting sat_code in POST creates an executable PHP file that can execute commands via GET parameters.	CWE-94

25 Jul 2026 10:10Current

6.9Medium risk

Vulners AI Score6.9

CVSS 48.7

CVSS 3.18.8

EPSS0.00569

SSVC

CWE-94