Vulnerability · Published Feb 22, 2026 · Assigned by VulDB
CVE-2026-2944Tosei Online Store Management System ネット店舗管理システム HTTP POST Request monitor.php system os command injection
High 7.3
In plain English
A high-severity OS command injection in Online Store Management System ネット店舗管理システム from Tosei. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 6.9% (higher than 94% of all known vulnerabilities).
Official description
A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01. Affected is the function system of the file /cgi-bin/monitor.php of the component HTTP POST Request Handler. Performing a manipulation of the argument DevId results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tosei | Online Store Management System ネット店舗管理システム | 1.01 |
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-347314 | Tosei Online Store Management System ネット店舗管理システム HTTP POST Request monitor.php system os command injection vdb-entry, technical-description
- VDB-347314 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #754579 | Tosei Tosei Online Store Management System ネット店舗管理システム 1.01 OS Command Injection / Remote Code Execution third-party-advisory
- https://github.com/CVE-Hunter-Leo/CVE/issues/9 exploit, issue-tracking