EUVD-2026-31537
GHSA-h535-h6xq-7vr9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in 546669204 vps-inventory-monitoring up to 98c00b370668c96ae75e91c15548d9ea113652d9. This issue affects the function eval of the file app/index/command/VpsTest.php of the component VpsTest Console. Executing a manipulation of the argument vf can lead to code injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Remote code injection in vps-inventory-monitoring allows authenticated attackers to execute arbitrary PHP code through the VpsTest console command. The vulnerability exists in the eval() function within VpsTest.php, exploitable by manipulating the 'vf' parameter with low attack complexity. Publicly available exploit code exists (GitHub POC published), and the maintainer has not responded to early disclosure attempts. CVSS 6.3 reflects moderate impact across confidentiality, integrity, and availability, with EPSS data unavailable but risk elevated by confirmed POC and unresponsive vendor.
Technical ContextAI
This vulnerability stems from unsafe use of PHP's eval() function in app/index/command/VpsTest.php within the VpsTest Console component. CWE-94 (Code Injection) occurs when user-controllable input ('vf' argument) is passed directly to eval() without sanitization, allowing execution of arbitrary PHP code in the application's runtime context. The product vps-inventory-monitoring (CPE: cpe:2.3:a:546669204:vps-inventory-monitoring) is a PHP-based VPS monitoring tool that uses console commands for administrative operations. The vulnerable eval() pattern is a classic PHP anti-pattern where dynamic code evaluation creates direct command execution pathways. The console command context suggests this may be part of a web-accessible management interface or CLI tool exposed through the application's routing system.
RemediationAI
No vendor-released patch identified at time of analysis-the maintainer has not responded to vulnerability disclosure (GitHub issue #36) despite early notification per VulDB submission 811843. Organizations currently running vps-inventory-monitoring must implement compensating controls immediately: (1) Restrict access to VpsTest console command functionality to only absolutely necessary administrative accounts using principle of least privilege-audit which users/roles can execute console commands and revoke unnecessary access. (2) If the console is web-accessible through routing, modify framework configuration to deny network access to app/index/command/VpsTest.php, forcing console commands to require local CLI access only (trade-off: breaks remote administration workflows). (3) Implement web application firewall (WAF) rules to detect and block requests containing 'vf' parameter with suspicious PHP function calls (eval, system, exec, shell_exec), though this is bypassable with encoding (trade-off: false positive risk on legitimate admin operations). (4) Deploy runtime application self-protection (RASP) or PHP monitoring to detect eval() calls with external input sources. (5) Consider migrating to alternative VPS monitoring solutions with active maintenance if vendor remains unresponsive. Monitor https://github.com/546669204/vps-inventory-monitoring/ and https://vuldb.com/vuln/365249 for patch announcements, and check commit history beyond 98c00b370668c96ae75e91c15548d9ea113652d9 for potential silent fixes.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today