Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-106261. PoCs published by SunCSR.
AI-analyzed exploit summary This exploit demonstrates multiple XSS vulnerabilities in CSZ CMS 1.2.9, including reflected and stored XSS via crafted input fields in banner and plugin management. The PoC uses SVG onload events to trigger JavaScript execution.
Description
CSZ CMS 1.2.9 - Multiple Cross-Site Scripting
Exploits (1)
exploitdb
WORKING POC
by SunCSR · textwebappsphp
https://www.exploit-db.com/exploits/49364
This exploit demonstrates multiple XSS vulnerabilities in CSZ CMS 1.2.9, including reflected and stored XSS via crafted input fields in banner and plugin management. The PoC uses SVG onload events to trigger JavaScript execution.
Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target:
CSZ CMS 1.2.9
Auth required
Prerequisites:
Access to editor account with banner/plugin management rights · Victim interaction for reflected XSS
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026