CVE-2022-37190: Cuppacms

High severity, CVSS 8.8. EPSS: 45.8% chance of exploitation in the next 30 days.

CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php.

Affected products

• Cuppacms Cuppacms: version 1.0 only

Published 2022-09-13. Last modified 2026-06-17.