CVE-2026-5333 is an OS command injection (CWE-77) in DefaultFuction Content-Management-System 1.0, in /admin/tools.php, through the host argument. NVD scores it 7.3 high and says a public exploit exists. No fixed version is named, so restrict the admin area and fix the code.
What's affected
DefaultFuction Content-Management-System version 1.0, a small PHP and MySQL CMS published on GitHub. The affected file is /admin/tools.php and the argument is host.
The record names no fixed version and the repository shows no release.
How to check if you're exposed
You will not find this in a package manager. Search your copy of the code for the file and for functions that run system commands:
grep -rn "host" admin/tools.php
grep -rnE "exec|shell_exec|system|passthru|popen" admin/
If a request value reaches one of those functions without being validated, the code is exposed.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find every installation of this CMS, including test copies.
- Block public access to the
/admin/path with network rules or authentication at the web server. - Remove or disable the tools page if it is not needed.
- If you must keep a feature that runs a command, validate the host value against a strict pattern and avoid passing it through a shell.
- Review web server logs for unexpected requests to
tools.php.
Why it matters
Command injection (CWE-77, within CWE-74) occurs when user input becomes part of a command line. A host name field is a common cause because the feature is often a lookup or a connectivity check that calls an operating system tool.
The account that runs the web server then runs the attacker's commands. The record does not mark the CVE as exploited in the wild and it is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the admin path protect me?
Only if authentication is enforced. The record scores the flaw as needing no privileges, so check your copy.
What is the safest fix?
Avoid shelling out. If you must, validate input against a strict allowlist pattern.
Sources
Last reviewed: 19 October 2026.
