Vulnerability threat dossier
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
VTP analyst assessment
CVE-2017-9841 allows remote PHP code execution when a vulnerable PHPUnit eval-stdin endpoint is exposed. CISA KEV lists it as known to be exploited globally. The supplied exploit-source record does not describe this CVE, so it adds no useful exploit detail.
1 record references and 3 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
No first-party telemetry is configured, so VTP observation is unknown.
The supplied exploit-source record is unrelated to this CVE.
CISA KEV confirms known global exploitation, not activity in a specific environment.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Review in your environment: if you use PHPUnit, check whether the eval-stdin.php path is externally reachable under a vendor directory.
First-party deterministic correlation
Honeypot request semantics are strongly consistent with CVE-2017-9841. This identifies likely attack intent, not successful exploitation or execution.
Basis: deterministic technical candidate
First-party deterministic correlation
Honeypot request semantics are strongly consistent with CVE-2017-9841. This identifies likely attack intent, not successful exploitation or execution.
Basis: deterministic technical candidate
First-party deterministic correlation
Honeypot request semantics are strongly consistent with CVE-2017-9841. This identifies likely attack intent, not successful exploitation or execution.
Basis: deterministic technical candidate
VTP deterministic assessment
CISA KEV lists this vulnerability as known to be exploited globally.
EPSS is 1.00; this is predictive context, not exploitation evidence.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Material change ledger
Claim provenance
0 primary sources · 0 dependent secondary reports · 1 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
ProjectDiscovery Nuclei Templates Releases published evidence linked to CVE-2017-9841.
CISA lists global known exploitation. This is not a VTP sensor observation.
Original publications
New Templates Added: 182 | CVEs Added: 116 | First-time contributions: 7 🔥 Release Highlights 🔥 [ CVE-2026-25892 ] Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS ( @dhiyaneshdk ) [high] 🔥 [ CVE-2026-23744 ] MCPJam Inspector - Remote Code Execution ( @louay-075 ) [critical] 🔥 [ CVE-2026-22812 ] OpenCode < 1.0.216 - Unauthenticated Remote Code Execution ( @princechaddha ) [high] 🔥 [CVE-2026-21891] ZimaOS - Authentication Bypass ( @dhiyaneshdk ) [critical] 🔥 [ CVE-2026-21877 ] n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution ( @s4e-io ) [critical] 🔥 [ CVE-2026-1731 ] BeyondTrust Remote Support - Unauth WebSocket RCE (@attackerkb, @hacktron , @pdteam ) [critical] (KEV) 🔥 [ CVE-2026-1207 ] Django RasterField - SQL Injection ( @omarkurt ) [high] 🔥 [ CVE-2025-54068 ] Laravel Livewire v3 - Remote Command Execution ( @flame-11 ) [critical] 🔥 [ CVE-2025-40551 ] SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE (@Horizon3.ai) [critical] (KEV) 🔥 [ CVE-2025-14528 ] D-Link DIR-803 - Authentication Bypass ( @dhiyaneshdk ) [high] 🔥 [ CVE-2025-2611 ] ICTBroadcast - Command Injection ( @Chocapikk ) [critical] (vKEV) 🔥 [ CVE-2024-8943 ] LatePoint <= 5.0.12 - Authentication Bypass ( @daffainfo ) [critical] (vKEV) 🔥 [ CVE-2024-8911 ] LatePoint <= 5.0.11 - SQL Injection ( @daffainfo ) [critical] (vKEV) 🔥 [ CVE-2024-6671 ] WhatsUp Gold GetStatisticalMonitorList SQLi - Authentication Bypass ( @daffainfo , @jjcho ) [critical] (vKEV) 🔥 [ CVE-2024-6250 ] LOLLMS WebUI - Absolute Path Traversal ( @ritikchaddha ) [high] 🔥 [ CVE-2024-0705 ] Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauth SQL Injection ( @Shivam Kamboj) [critical] 🔥 [ CVE-2023-35708 ] MOVEit Transfer - SQL Injection ( @daffainfo , @jjcho ) [critical] (vKEV) 🔥 [ CVE-2022-31678 ] VMWare Cloud Foundation NSX-V - XML External Entity (XXE) ( @daffainfo ) [critical] (vKEV) 🔥 [ CVE-2022-3236 ] Sophos Firewall <= 19.0 MR1 - Remote Code Execution ( @daffainfo ) [critical] (KEV) 🔥 [ CVE-2021-22017 ] vCenter Server - Improper Access Control ( @daffainfo ) [medium] (KEV) 🔥 [ CVE-2019-13608 ] Citrix StoreFront Server - XML External Entity ( @daffainfo ) [high] (KEV) 🔥 [ CVE-2017-9841 ] PHPUnit - Remote Code Execution (@Random_Robbie, @pikpikcu ) [critical] (KEV) 🔥 What's Changed Bug Fixes Fixed incorrect tag formatting (- appearing as a tag) in CVE-2019-17444 template (PR #15306 ) Fixed incorrect reference in authentik-panel template (PR #15298 ) Fixed port format in unauth-java-message-broker-detect template (PR #15117 ) Fixed tag formatting (double comma) in templates (PR #15118 ) Fixed formatting of tags in CVE-2019-5591 template (PR #15119 ) Fixed port used on CVE-2014-0160 Heartbleed — was testing port 443 twice instead of testing plain HTTP port (PR #14653 ) Fixed path for gude-default-login template (PR #15134 ) Moved CVE-2024-43283 .yaml to correct directory http/cves/2024 (PR #15100 ) Updated CVE-2025-68645 .yaml (PR #15109 ) Updated CVE-2024-13094 .yaml with new alert script (PR #15299 ) Updated CVE-2021-24527 .yaml (PR #14980 ) False Negatives Fixed false negative in CVE-2025-24963 on Linux targets (Ubuntu/Debian) due to strict /etc/passwd matching (PR #15301 , Issue #15205 ) False Positives Reduced false positives in wp-wps-hide-login-log template that triggered on non-WordPress SPA sites (PR #15096 , Issue #15089 ) Fixed false positives in CVE-2021-35042 matcher — status_code == 500 alone was triggering on generic 500 pages (PR #15250 ) Made matchers for weak-csp-detect more granular to avoid duplicate matching results (PR #15123 ) Improved weak CSP detection logic, fixed matcher conditions and corrected regex typo (PR #15014 ) Enhancements Enhanced Cisco UCM username enumeration template to extract usernames, emails, and phone numbers added 3 new Cisco UCM templates (PR #15049 ) Refactored Open WebUI template to make detection more generic (PR #15251 ) Rewrote templates from RAW HTTP to normal HTTP for clustering support, saving
Technical vulnerability data
Raw observations
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.