Is there a public PoC exploit available for EUVD-2026-17875?

Yes, a public proof-of-concept exploit is available for EUVD-2026-17875. Prioritise patching immediately. EPSS: 0.2%.

PHP EUVD-2026-17875

Q: What is the CVSS score of EUVD-2026-17875?

EUVD-2026-17875 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-29014 CRITICAL

Code Injection (CWE-94)

2026-04-01 VulnCheck

PHP RCE Code Injection

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 20:38 vuln.today

Public exploit code

EUVD ID Assigned

Apr 01, 2026 - 13:00 euvd

EUVD-2026-17875

Analysis Generated

Apr 01, 2026 - 13:00 vuln.today

CVE Published

Apr 01, 2026 - 12:22 nvd

CRITICAL 9.3

DescriptionCVE.org

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.

Articles & Coverage 1

vuln.today Threat Landscape 30/03-06/04/2026: Chrome Zero-Day, TrueConf Supply Chain, ShareFile Kill Chain Apr 06, 2026

AnalysisAI

MetInfo CMS 7.9, 8.0, and 8.1 allows unauthenticated remote code execution through PHP code injection in insufficient input validation mechanisms. Attackers can send crafted requests containing malicious PHP code to execute arbitrary commands and achieve full server compromise without authentication. Publicly available exploit code exists for this vulnerability.

Technical ContextAI

The vulnerability stems from CWE-94 (Improper Control of Generation of Code, Code Injection), where MetInfo CMS fails to properly neutralize user-supplied input before passing it to PHP execution contexts. The affected product is a Content Management System written in PHP, as indicated by the CPE string cpe:2.3:a:metinfo_cms:metinfo_cms and the PHP tag. The insufficient input sanitization in the execution path allows attackers to inject and execute arbitrary PHP code directly on the server, bypassing normal application logic and security controls. This type of vulnerability is particularly severe in CMS platforms because they typically run with elevated privileges and have direct access to databases and file systems.

RemediationAI

Organizations running MetInfo CMS should immediately upgrade to versions above 8.1 if available from the vendor. Patch availability and specific remediated versions should be confirmed directly with MetInfo CMS at https://www.metinfo.cn/. As an interim measure, implement network-level access controls to restrict HTTP requests to MetInfo CMS instances to trusted networks only, apply Web Application Firewall (WAF) rules to detect and block PHP code injection patterns, and monitor logs for suspicious POST/GET requests containing PHP code patterns such as '<?php', 'eval()', 'system()', or 'exec()'. Given the unauthenticated nature and network vector, patching should be expedited as a critical priority. Detailed exploit analysis is available at https://karmainsecurity.com/KIS-2026-06.