EIP-2026-104494

PRE-CVE

Wolters Kluwer TeamMate 3.1 - Cross-Site Request Forgery

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104494. PoCs published by Bhadresh Patel.

AI-analyzed exploit summary The provided code is a functional CSRF exploit for Wolters Kluwer TeamMate+ (CVE-2019-10253), demonstrating how an attacker can upload malicious files by enticing an authenticated user to visit a crafted HTML page. The exploit targets the 'DomainObjectDocumentUpload.ashx' endpoint, which lacks CSRF token validation.

Description

Wolters Kluwer TeamMate 3.1 - Cross-Site Request Forgery

Exploits (1)

exploitdb WORKING POC
by Bhadresh Patel · htmlwebappsmultiple
https://www.exploit-db.com/exploits/47342

The provided code is a functional CSRF exploit for Wolters Kluwer TeamMate+ (CVE-2019-10253), demonstrating how an attacker can upload malicious files by enticing an authenticated user to visit a crafted HTML page. The exploit targets the 'DomainObjectDocumentUpload.ashx' endpoint, which lacks CSRF token validation.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: Wolters Kluwer TeamMate+ <= Version 3.1 (Internal Version: 21.0.0.0)
Auth required
Prerequisites: Authenticated user session · Victim interaction (visiting attacker-controlled page)
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026