Is there a public PoC exploit available for CVE-2026-14749?

Yes, a public proof-of-concept exploit is available for CVE-2026-14749. Prioritise patching immediately. EPSS: 0.3%.

stumasy CVE-2026-14749

Q: What is the CVSS score of CVE-2026-14749?

CVE-2026-14749 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41755 MEDIUM

Code Injection (CWE-94)

2026-07-05 VulDB

GHSA-gq7f-p38f-cwj8

PHP RCE Code Injection Stumasy Mjperpinosa

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Network-accessible eval() injection with no authentication or complexity barriers; PHP code execution implies full confidentiality, integrity, and availability impact on the server.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 13:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 13:21 vuln.today

DescriptionCVE.org

A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Impacted is the function eval of the file application/pages/imba_calculator/calculate.php. The manipulation of the argument mathematical_sentence leads to code injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Remote PHP code injection in stumasy's calculator module allows unauthenticated network attackers to execute arbitrary server-side code by manipulating the mathematical_sentence parameter passed unsanitized into PHP's eval() function in calculate.php. A public proof-of-concept exploit exists (GitHub issue #5), and no patch has been released - the project maintainer has not responded to the disclosure. The rolling release model means no fixed version can be cited; the vulnerability is present through at least commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be.

Technical ContextAI

stumasy (CPE: cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:*) is a PHP web application. The affected component is the imba_calculator feature, specifically application/pages/imba_calculator/calculate.php. The root cause is CWE-94 (Improper Control of Generation of Code - Code Injection): the function eval() is called with user-supplied input from the mathematical_sentence HTTP parameter without sufficient sanitization or allowlist validation. PHP's eval() executes arbitrary PHP code at runtime, meaning any attacker-controlled string injected here is interpreted and executed as server-side PHP. This is a textbook eval-injection pattern common in PHP applications that attempt to evaluate mathematical expressions via eval() rather than using a dedicated safe math parser library.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the disclosure reported via GitHub issue #5 (https://github.com/mjperpinosa/stumasy/issues/5). As an immediate compensating control, restrict or disable web access to the calculate.php endpoint entirely (e.g., deny access via web server configuration rules for the path application/pages/imba_calculator/calculate.php) - trade-off is loss of the calculator feature. If the feature must remain accessible, apply a strict server-side allowlist that permits only numeric characters, standard arithmetic operators (+, -, *, /), parentheses, and decimal points in the mathematical_sentence parameter before it reaches eval(); this eliminates the injection surface but requires code modification. Replacing PHP's eval() with a safe math-parsing library (e.g., mossadal/math-parser or similar) is the correct long-term fix. Monitor VulDB entry https://vuldb.com/vuln/376338 and the GitHub repository for any upstream patch.