CVE-2021-47964
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
May 15, 2026
Vendor
unknown
Description
Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and trigger execution by accessing the About tab of the installed extension.