CVE-2026-14749 describes a code injection vulnerability in the mjperpinosa stumasy project affecting the eval function in application/pages/imba_calculator/calculate.php. An attacker can remotely manipulate the mathematical_sentence argument to inject and execute arbitrary code. The product's rolling release strategy prevents precise version identification of affected or fixed releases. No vendor response or patch is currently available. The vulnerability has a CVSS 4.0 base score of 6.9 with network attack vector, low complexity, no privileges or user interaction required, and low impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote code injection via the mathematical_sentence parameter, potentially enabling arbitrary code execution within the context of the vulnerable application. This can compromise the integrity and confidentiality of the system. However, the impact is rated as medium severity given the limited scope of impact metrics and no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, restricting access to the vulnerable function or input validation on the mathematical_sentence parameter may reduce risk.