Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-104807. PoCs published by LiquidWorm.
AI-analyzed exploit summary This exploit demonstrates a CRLF injection vulnerability in 11in1 CMS v1.0.1 via the 'content' parameter in 'do.php', allowing arbitrary HTTP headers to be injected into the response. The PoC shows how an attacker can manipulate the 'Location' header and insert custom headers.
Description
11in1 CMS 1.0.1 - 'do.php' CRLF Injection
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by LiquidWorm · textwebappsphp
https://www.exploit-db.com/exploits/18095
This exploit demonstrates a CRLF injection vulnerability in 11in1 CMS v1.0.1 via the 'content' parameter in 'do.php', allowing arbitrary HTTP headers to be injected into the response. The PoC shows how an attacker can manipulate the 'Location' header and insert custom headers.
Classification
Working Poc 90%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target:
11in1 CMS v1.0.1
Auth required
Prerequisites:
Admin access to the application · Valid session cookie
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026