CVE-2017-9841 Scanner
Targets the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php script via HTTP POST to execute arbitrary PHP code on the server.
Used 2.8k times · 5.9k assets checked · domain, subdomain, ipv4
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVE
CVE-2017-9841
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
Updated Sep 18, 2026View on NVD →
S4E scanner
Monitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →