Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-105446. PoCs published by frog.
AI-analyzed exploit summary The code describes a remote file inclusion vulnerability in BES-CMS versions 0.4 rc3 and 0.5 rc3, affecting multiple scripts. It provides example URLs demonstrating how an attacker could exploit the vulnerability by manipulating the 'PATH_Includes' parameter.
Description
BES-CMS 0.4/0.5 - 'folder.php' File Inclusion
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by frog · textwebappsphp
https://www.exploit-db.com/exploits/23457
The code describes a remote file inclusion vulnerability in BES-CMS versions 0.4 rc3 and 0.5 rc3, affecting multiple scripts. It provides example URLs demonstrating how an attacker could exploit the vulnerability by manipulating the 'PATH_Includes' parameter.
Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target:
BES-CMS 0.4 rc3, 0.5 rc3
No auth needed
Prerequisites:
Access to the vulnerable BES-CMS scripts · Ability to host malicious files on a remote server
devstral-2 · analyzed Feb 18, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026