EUVD-2026-84620
GHSA-x23m-fhhv-vj5x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated command injection to root with no user interaction gives AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; S:U chosen to match vendor, though S:C is defensible given control of all managed VPS.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.
AnalysisAI
Unauthenticated remote command execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 branch) lets attackers take root on the host and all managed VPS instances by exploiting the billing module handler. Publicly available exploit code exists, and exploitation requires only network reachability to the billing/panel interface-no authentication or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Softaculous Virtualizor before 3.2.9 (Patch 9), plus the 3.0.0 branch. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Softaculous Virtualizor 3.2.9 Patch 9 or 3.3.0; these are the vendor-released patched versions (see https://www.virtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/ and https://www.virtualizor.com/blog/virtualizor-3-3-0/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Virtualizor deployment across all environments, confirm which hosts sit on versions earlier than 3.2.9 Patch 9 or the 3.0.0 branch, and upgrade to the vendor-released patch 3.2.9 Patch 9 or 3.3.0; where an upgrade cannot be completed the same day, restrict network access to the billing/panel interface to trusted administrative ranges only and place the host behind a filtering layer. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Softaculous
View allRemote code execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 line) allows unauthenticated remote
index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharact
Unauthenticated attackers can rewrite any tenant's account balance in Softaculous Virtualizor before 3.2.9 (Patch 9) and
A vulnerability has been found in AMPPS 2.7 and classified as problematic. Rated high severity (CVSS 7.5), this vulnerab
The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attem
The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which a
Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Rated criti
Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. Rated high severity (
Softaculous Webuzo contains a command injection in the password reset functionality. Rated high severity (CVSS 8.8), thi
Cross-site scripting (XSS) vulnerability in filemanager/login.php in the File Manager module in Softaculous Webuzo befor
The Backuply - Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all version
The Backuply - Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options'
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today