Code Injection Vulnerability in vps-inventory-monitoring by 546669204
CVE-2026-9302

5.3MEDIUM

Key Information:

Vendor

546669204

Status
Vps-inventory-monitoring
Vendor
CVE Published:
23 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-9302?

A code injection vulnerability exists within the vps-inventory-monitoring product, specifically in the eval function of the VpsTest.php file located in app/index/command. By manipulating the argument 'vf', an attacker may execute arbitrary code remotely. This issue has been publicly disclosed and could be exploited if not addressed. The project utilizes a rolling release system for deployment, and information regarding version updates or affected releases has not been made available. Despite being notified of this vulnerability early, the vendor has not provided a response.

Affected Version(s)

vps-inventory-monitoring 98c00b370668c96ae75e91c15548d9ea113652d9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-9302 - Proof of Concept

References

https://vuldb.com/vuln/365249
vdb-entrytechnical-description
https://vuldb.com/vuln/365249/cti
signaturepermissions-required
https://vuldb.com/submit/811843
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

zyhhoward (VulDB User)
VulDB CNA Team
.