EIP-2026-106252

The exploit demonstrates two XXE (XML External Entity) vulnerabilities in CS-Cart <= 4.3.10, affecting the Twigmo addon and Amazon payment module. It includes functional PoC code that triggers outbound HTTP requests to an attacker-controlled server via crafted XML payloads.