---
id: CVE-2026-95501
title: >-
  A vulnerability was found in mtrano APENCMS up to
  6546096d354153309693efabb9a0d824628ed4f5
summary: >-
  A vulnerability was found in mtrano APENCMS up to
  6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function
  eval of the file cms/weasel.php of the component Template Engine. The
  manipulation of the argument $_CMS['si…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L'
cwe:
  - CWE-74
  - CWE-94
vendor: mtrano
product: APENCMS
affected:
  - APENCMS 6546096d354153309693efabb9a0d824628ed4f5
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:16:59.807'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95501'
references:
  - url: 'https://vuldb.com/cve/CVE-2026-95501'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/896603'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/408349'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/408349/cti'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/896603'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T18:09:39.042492Z'
ingestedAt: '2026-09-22T15:05:01.086Z'
epss: 0.00314
epssPercentile: 0.24576
---

## Overview

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $_CMS['site'] results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.