EIP-2026-106860

PRE-CVE

Employee Performance Evaluation System v1.0 - File Inclusion and RCE

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-106860. PoCs published by nu11secur1ty.

AI-analyzed exploit summary The exploit demonstrates a file inclusion vulnerability in Employee Performance Evaluation System v1.0, allowing remote code execution (RCE) via file upload and inclusion. The PoC includes PHP code to rename directories and execute arbitrary code via `phpinfo()`.

Description

Employee Performance Evaluation System v1.0 - File Inclusion and RCE

Exploits (1)

exploitdb WORKING POC

by nu11secur1ty · textwebappsphp

https://www.exploit-db.com/exploits/51049

View Code ZIP pw:eip

The exploit demonstrates a file inclusion vulnerability in Employee Performance Evaluation System v1.0, allowing remote code execution (RCE) via file upload and inclusion. The PoC includes PHP code to rename directories and execute arbitrary code via `phpinfo()`.

Classification

Working Poc 80%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Employee Performance Evaluation System v1.0

No auth needed

Prerequisites: Access to file upload functionality · Server with vulnerable software installed

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026