Is there a public PoC exploit available for CVE-2026-9302?

Yes, a public proof-of-concept exploit is available for CVE-2026-9302. Prioritise patching immediately. EPSS: 0.1%.

vps-inventory-monitoring CVE-2026-9302

Q: What is the CVSS score of CVE-2026-9302?

CVE-2026-9302 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31537 LOW

Code Injection (CWE-94)

2026-05-23 VulDB

GHSA-h535-h6xq-7vr9

PHP Code Injection RCE

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 26, 2026 - 19:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:37 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 23, 2026 - 14:00 vuln.today

DescriptionCVE.org

A vulnerability was determined in 546669204 vps-inventory-monitoring up to 98c00b370668c96ae75e91c15548d9ea113652d9. This issue affects the function eval of the file app/index/command/VpsTest.php of the component VpsTest Console. Executing a manipulation of the argument vf can lead to code injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Remote code injection in vps-inventory-monitoring allows authenticated attackers to execute arbitrary PHP code through the VpsTest console command. The vulnerability exists in the eval() function within VpsTest.php, exploitable by manipulating the 'vf' parameter with low attack complexity. Publicly available exploit code exists (GitHub POC published), and the maintainer has not responded to early disclosure attempts. CVSS 6.3 reflects moderate impact across confidentiality, integrity, and availability, with EPSS data unavailable but risk elevated by confirmed POC and unresponsive vendor.

Technical ContextAI

This vulnerability stems from unsafe use of PHP's eval() function in app/index/command/VpsTest.php within the VpsTest Console component. CWE-94 (Code Injection) occurs when user-controllable input ('vf' argument) is passed directly to eval() without sanitization, allowing execution of arbitrary PHP code in the application's runtime context. The product vps-inventory-monitoring (CPE: cpe:2.3:a:546669204:vps-inventory-monitoring) is a PHP-based VPS monitoring tool that uses console commands for administrative operations. The vulnerable eval() pattern is a classic PHP anti-pattern where dynamic code evaluation creates direct command execution pathways. The console command context suggests this may be part of a web-accessible management interface or CLI tool exposed through the application's routing system.

RemediationAI

No vendor-released patch identified at time of analysis-the maintainer has not responded to vulnerability disclosure (GitHub issue #36) despite early notification per VulDB submission 811843. Organizations currently running vps-inventory-monitoring must implement compensating controls immediately: (1) Restrict access to VpsTest console command functionality to only absolutely necessary administrative accounts using principle of least privilege-audit which users/roles can execute console commands and revoke unnecessary access. (2) If the console is web-accessible through routing, modify framework configuration to deny network access to app/index/command/VpsTest.php, forcing console commands to require local CLI access only (trade-off: breaks remote administration workflows). (3) Implement web application firewall (WAF) rules to detect and block requests containing 'vf' parameter with suspicious PHP function calls (eval, system, exec, shell_exec), though this is bypassable with encoding (trade-off: false positive risk on legitimate admin operations). (4) Deploy runtime application self-protection (RASP) or PHP monitoring to detect eval() calls with external input sources. (5) Consider migrating to alternative VPS monitoring solutions with active maintenance if vendor remains unresponsive. Monitor https://github.com/546669204/vps-inventory-monitoring/ and https://vuldb.com/vuln/365249 for patch announcements, and check commit history beyond 98c00b370668c96ae75e91c15548d9ea113652d9 for potential silent fixes.