The vulnerability is a code injection flaw that enables remote attackers to execute arbitrary code through the index.php script of AltumCode 66Uptime. Attackers can send specially crafted requests that cause the application to run injected code, leading to complete compromise of the affected system. This flaw is classified as CWE‑94. The CVSS score of 9.8 highlights the extreme severity of the impact.

The affected products are AltumCode 66Uptime versions earlier than 54.0.0 and the 66Uptime ping‑servers plugin versions earlier than 2.0.0. No vendor or product naming is provided beyond the product name, and specific affected configurations are limited to those pre‑release thresholds.

The flaw is remotely exploitable via HTTP(S) requests directed at index.php, with no known current exploitation probability but a high CVSS indicating a substantial attack surface. Although not listed in CISA’s KEV catalog, the impact is severe enough that attackers could gain full system control if the vulnerability is leveraged. The attack would involve submitting a payload that is interpreted as executable code by the vulnerable script.