EIP-2026-105984
PRE-CVECMS Made Simple 1.x - Cross-Site Scripting / Cross-Site Request Forgery
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-105984. PoCs published by Truong Thao Nguyen.
AI-analyzed exploit summary This is a functional CSRF exploit for CMS Made Simple 1.7.1 and prior, demonstrating how an attacker can trick a victim into submitting a crafted form to create a new admin user. The exploit leverages insufficient input sanitization and lack of CSRF protection.
Description
CMS Made Simple 1.x - Cross-Site Scripting / Cross-Site Request Forgery
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Truong Thao Nguyen · htmlwebappsphp
https://www.exploit-db.com/exploits/34068
This is a functional CSRF exploit for CMS Made Simple 1.7.1 and prior, demonstrating how an attacker can trick a victim into submitting a crafted form to create a new admin user. The exploit leverages insufficient input sanitization and lack of CSRF protection.
Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target:
CMS Made Simple <= 1.7.1
No auth needed
Prerequisites:
Victim must be authenticated and tricked into submitting the form
devstral-2 · analyzed Feb 18, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026