EIP-2026-105008

PRE-CVE

AFCommerce - 'adminpassword.php' Remote File Inclusion

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-105008. PoCs published by NoGe.

AI-analyzed exploit summary The provided text describes a remote file inclusion (RFI) vulnerability in AFCommerce, where insufficient input sanitization allows attackers to include arbitrary remote files via the 'rootpathtocart' parameter in 'adminpassword.php'. No actual exploit code is present, only a description and example URL.

Description

AFCommerce - 'adminpassword.php' Remote File Inclusion

Exploits (1)

exploitdb WRITEUP VERIFIED
by NoGe · textwebappsphp
https://www.exploit-db.com/exploits/38921

The provided text describes a remote file inclusion (RFI) vulnerability in AFCommerce, where insufficient input sanitization allows attackers to include arbitrary remote files via the 'rootpathtocart' parameter in 'adminpassword.php'. No actual exploit code is present, only a description and example URL.

Classification
Writeup 80%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: AFCommerce (version unspecified)
No auth needed
Prerequisites: Network access to the target application · Ability to host a malicious file on a remote server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026