EIP-2026-109500

The provided text describes an arbitrary PHP code-execution vulnerability in mkCMS 3.6, but does not include actual exploit code. It references a URL parameter (`cmd=dir`) that may be used to trigger the vulnerability.