Which versions of PHP are affected by CVE-2026-2944?

A high-severity vulnerability in Tosei Online Store Management System versions 1.01 allows attackers to exploit the HTTP POST request handler in monitor.php, potentially compromising store operations…

Is there a public PoC exploit available for CVE-2026-2944?

Yes, a public proof-of-concept exploit is available for CVE-2026-2944. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-2944?

Within 24 hours: Identify all systems running Tosei 1.01 and isolate them from internet-facing access; monitor logs for exploitation attempts. Within 7 days: Implement WAF rules to block malicious POST requests to /cgi-bin/monitor.php; disable the monitor.php functionality if operationally feasible. Within 30 days: Contact Tosei vendor for patch availability; evaluate migration to patched version or alternative system; conduct forensic analysis for signs of prior compromise.

PHP CVE-2026-2944

Q: What is the CVSS score of CVE-2026-2944?

CVE-2026-2944 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

Command Injection (CWE-77)

2026-02-22 cna@vuldb.com

PHP Command Injection Online Store Management System Tosei Corporation

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 26, 2026 - 20:45 vuln.today

Public exploit code

CVE Published

Feb 22, 2026 - 11:16 nvd

HIGH 7.3

DescriptionCVE.org

A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01. Affected is the function system of the file /cgi-bin/monitor.php of the component HTTP POST Request Handler. Performing a manipulation of the argument DevId results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote code execution in Tosei Online Store Management System 1.01 allows unauthenticated attackers to execute arbitrary OS commands through the DevId parameter in /cgi-bin/monitor.php. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. The attack requires no user interaction and is exploitable over the network.

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects Online Store Management System. A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01. Affected is the function system of the file /cgi-bin/monitor.php of the component HTTP POST Request Handler. Performing a manipulation of the argument DevId results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.