CVE-2026-2956Exploit(dst-admin_project / dst-admin)

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A security flaw has been discovered in qinming99 dst-admin up to 1.5.0. This affects the function revertBackup of the file /home/restore. The manipulation of the argument Name results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

dst-admin_project CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://fx4tqqfvdw4.feishu.cn/docx/ObYgdtoweowo8Vx4dmuckqC7nBe?from=from_copylink

Vendor / third-party advisories

Other references

https://vuldb.com/?ctiid.347323

Weakness type (CWE)

CWE-74CWE-77

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

dst-admin

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
Exploit: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

dst-admin_project

Products

dst-admin

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Exploit

1100.0%

Full discourse1 post

Cybersecurity Aide@SecAideInfo225d
Exploit
🚨⚠️ Alert: CVE-2026-2956 poses a major threat! A command injection flaw in qinming99 dst-admin ≤1.5.0, specifically in the revertBackup function, can be exploited remotely. Public exploit available & vendor unresponsive. Stay vigilant! 🔍🛡️ #CyberSecurity #Infosec
Post summary
CVE-2026-2956 is a command injection vulnerability in qinming99 dst-admin ≤1.5.0, with a public exploit available and no vendor patch, posing a major threat.
0000039
20 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	dst-admin_project	dst-admin	-	-	-

Explore more

Back to dashboard dst-admin_project CVEs dst-admin vulnerabilities