EIP-2026-102514

PRE-CVE

NXFilter 3.0.3 - Multiple Cross-Site Scripting Vulnerabilities

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-102514. PoCs published by hyp3rlinx.

AI-analyzed exploit summary The exploit demonstrates persistent and reflected XSS vulnerabilities in NXFilter v3.0.3 via the 'name', 'user', and 'kw' parameters. It bypasses filtering using JavaScript String.fromCharCode() to execute arbitrary client-side code.

Description

NXFilter 3.0.3 - Multiple Cross-Site Scripting Vulnerabilities

Exploits (1)

exploitdb WORKING POC
by hyp3rlinx · textwebappsjsp
https://www.exploit-db.com/exploits/38646

The exploit demonstrates persistent and reflected XSS vulnerabilities in NXFilter v3.0.3 via the 'name', 'user', and 'kw' parameters. It bypasses filtering using JavaScript String.fromCharCode() to execute arbitrary client-side code.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: NXFilter v3.0.3
No auth needed
Prerequisites: Access to the vulnerable NXFilter web interface
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026