Skip to content
OpenAdvisories

Vendor

pheditor

4 known vulnerabilities.

Products

pheditor 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-55579 Public exploit

    Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on …

    pheditor pheditor pheditor/pheditor Packagist
  • Critical 9.9
    CVE-2026-48030 Public exploit

    Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shel…

    pheditor pheditor pheditor/pheditor Packagist