CVE-2026-2944

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-2944
A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01. Affected is the function system of the file /cgi-bin/monitor.php of the component HTTP POST Request Handler. Performing a manipulation of the argument DevId results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/CVE-Hunter-Leo/CVE/issues/9 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.347314 Permissions Required VDB Entry
https://vuldb.com/?id.347314 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754579 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:tosei-corporation:online_store_management_system:1.01:*:*:*:*:*:*:*
History

26 Feb 2026, 20:45

Type Values Removed Values Added
First Time Tosei-corporation online Store Management System
Tosei-corporation
CPE cpe:2.3:a:tosei-corporation:online_store_management_system:1.01:*:*:*:*:*:*:*
References () https://github.com/CVE-Hunter-Leo/CVE/issues/9 - () https://github.com/CVE-Hunter-Leo/CVE/issues/9 - Exploit, Issue Tracking, Third Party Advisory
References () https://vuldb.com/?ctiid.347314 - () https://vuldb.com/?ctiid.347314 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.347314 - () https://vuldb.com/?id.347314 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.754579 - () https://vuldb.com/?submit.754579 - Third Party Advisory, VDB Entry

23 Feb 2026, 18:13

Type Values Removed Values Added
Summary
  • (es) Una falla de seguridad ha sido descubierta en Tosei Online Store Management System ??????????? 1.01. Se ve afectado el sistema de funciones del archivo /cgi-bin/monitor.php del componente Gestor de Solicitudes POST HTTP. La manipulación del argumento DevId da como resultado una inyección de comandos del sistema operativo. El ataque puede iniciarse remotamente. El exploit ha sido publicado y puede ser utilizado para ataques. El proveedor fue contactado con antelación sobre esta divulgación, pero no respondió de ninguna manera.

22 Feb 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-22 11:16

Updated : 2026-02-26 20:45

NVD link : CVE-2026-2944

Mitre link : CVE-2026-2944

CVE.ORG link : CVE-2026-2944

JSON object : View

Products Affected

tosei-corporation

  • online_store_management_system
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')