CVE-2025-50881
The script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution.
Published Mar 16, 2026 · updated Jul 5, 2026
The script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the URL parameter, performs insufficient validation, and incorporates this input into a string that is subsequently executed by the function. Although a check is performed, it only validates the part of the user input *before* the first parenthesis , allowing an attacker to append arbitrary PHP code after a valid method call structure. Successful exploitation allows an unauthenticated or trivially authenticated attacker to execute arbitrary PHP code on the server with the privileges of the web server process.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 16, 2026 · NIST NVD
Detected
The script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the URL parameter, performs insufficient validation, and incorporates this input into a string that is subsequently executed by the function. Although a check is performed, it only validates the part of the user input *before*
Jul 5, 2026 · NIST NVD
Updated
The script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the URL parameter, performs insufficient validation, and incorporates this input into a string that is subsequently executed by the function. Although a check is performed, it only validates the part of the user input *before*
Sources
- CVE.orgVulnerability recordCVE-2025-50881
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2025-50881
The script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the URL parameter, performs insufficient validation, and incorporates th
nvd.nist.gov