EIP-2026-106149

PRE-CVE

Contrexx 1.0.4 - Multiple Input Validation Vulnerabilities

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-106149. PoCs published by Christopher Kunz.

AI-analyzed exploit summary The exploit demonstrates multiple input validation vulnerabilities in Contrexx, including SQL injection via the 'votingoption' parameter and XSS through crafted input in search terms and blog titles. It provides specific payloads to exploit these vulnerabilities.

Description

Contrexx 1.0.4 - Multiple Input Validation Vulnerabilities

Exploits (1)

exploitdb WORKING POC VERIFIED

by Christopher Kunz · textwebappsphp

https://www.exploit-db.com/exploits/26019

View Code ZIP pw:eip

The exploit demonstrates multiple input validation vulnerabilities in Contrexx, including SQL injection via the 'votingoption' parameter and XSS through crafted input in search terms and blog titles. It provides specific payloads to exploit these vulnerabilities.

Classification

Working Poc 90%

Attack Type

Sqli | Xss | Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Contrexx versions prior to 1.0.5

No auth needed

Prerequisites: Access to the target application · Ability to submit crafted input

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026