CVE-2022-28118
Critical · CVSS 9.8SiteServer CMS (SSCMS) — Arbitrary Code Execution via Malicious Plug-in
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- NVD-CWE-noinfo
Description
SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.
Search profile — drives PoC discovery
Symbols SSCMS-PluginShellcrafted plug-inplugin shellPluginShellDetail.mdsiteserver/cms
Keywords CVE-2022-28118SiteServer CMSSSCMSplugin shellarbitrary code executionSSCMS-PluginShellRichard-Tangsiteserver plugin exploitSSCMS v7 RCEcrafted plugin SSCMS
Versions: v7.x
Ranked PoCs (4) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 8
- ★ 0SYRTI/POC_to_review needs reviewtrickest
- ★ 0WhooAmii/POC_to_review needs reviewtrickest
- ★ 0trhacknon/Pocingit needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
- https://github.com/Richard-Tang/SSCMS-PluginShell/blob/main/Detail.md
- https://github.com/siteserver/cms
- https://github.com/siteserver/cms/issues/3386
- http://siteserver.com
- https://github.com/Richard-Tang/SSCMS-PluginShell/blob/main/Detail.md
- https://github.com/siteserver/cms
- https://github.com/siteserver/cms/issues/3386
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T12:30:39.000Z