EIP-2026-104299

PRE-CVE

KEMP LoadMaster 7.135.0.13245 - Persistent Cross-Site Scripting / Remote Code Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104299. PoCs published by SecuriTeam.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in KEMP LoadMaster v7.1.35.0.13245, allowing an unauthenticated attacker to inject malicious JavaScript into the audit log via SSH login attempts. The injected script creates a new administrative user with full privileges.

Description

KEMP LoadMaster 7.135.0.13245 - Persistent Cross-Site Scripting / Remote Code Execution

Exploits (1)

exploitdb WORKING POC
by SecuriTeam · textwebappsmultiple
https://www.exploit-db.com/exploits/42090

This exploit demonstrates a stored XSS vulnerability in KEMP LoadMaster v7.1.35.0.13245, allowing an unauthenticated attacker to inject malicious JavaScript into the audit log via SSH login attempts. The injected script creates a new administrative user with full privileges.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: KEMP LoadMaster v7.1.35.0.13245
No auth needed
Prerequisites: Network access to the KEMP LoadMaster web interface · Ability to initiate SSH connections to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026