CVE-2019-11376: Brassica Soy CMS

High severity, CVSS 7.2. EPSS: 2.2% chance of exploitation in the next 30 days.

SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box. NOTE: the vendor indicates that there was an assumption that the content is "made editable on its own.

Affected products

• Brassica Soy CMS: version 3.0.2 only

Published 2019-04-20. Last modified 2026-06-17.