Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-107634. PoCs published by Dr.DaShEr.
AI-analyzed exploit summary This exploit demonstrates a remote PHP code injection vulnerability in HostBill v2.3. The attacker injects malicious PHP code into the 'subject' field of a ticket submission form, which is then executed on the server.
Description
HostBill App 2.3 - Remote Code Injection
Exploits (1)
exploitdb
WORKING POC
by Dr.DaShEr · textwebappsphp
https://www.exploit-db.com/exploits/18428
This exploit demonstrates a remote PHP code injection vulnerability in HostBill v2.3. The attacker injects malicious PHP code into the 'subject' field of a ticket submission form, which is then executed on the server.
Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target:
HostBill v2.3
No auth needed
Prerequisites:
Access to the ticket submission form · Base64 encoding of the malicious payload
devstral-2 · analyzed Feb 18, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026