EIP-2026-104759

PRE-CVE

PHP Utility Belt - Remote Code Execution (Metasploit)

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104759. PoCs published by Metasploit.

AI-analyzed exploit summary This Metasploit module exploits a remote code execution vulnerability in PHP Utility Belt by sending arbitrary PHP code via POST request to the 'code' parameter. The vulnerability is due to the application's intended functionality of executing arbitrary PHP code, making it unsafe for production environments.

Description

PHP Utility Belt - Remote Code Execution (Metasploit)

Exploits (1)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/39554

This Metasploit module exploits a remote code execution vulnerability in PHP Utility Belt by sending arbitrary PHP code via POST request to the 'code' parameter. The vulnerability is due to the application's intended functionality of executing arbitrary PHP code, making it unsafe for production environments.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: PHP Utility Belt (unspecified version)
No auth needed
Prerequisites: PHP Utility Belt installed and accessible · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026