EIP-2026-107420

PRE-CVE

glFusion 1.1.x/1.2.1 - 'users.php' SQL Injection

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-107420. PoCs published by H3X.

AI-analyzed exploit summary The provided text describes an SQL injection vulnerability in glFusion, with example URLs demonstrating blind SQLi techniques to infer database version information. No actual exploit code is present.

Description

glFusion 1.1.x/1.2.1 - 'users.php' SQL Injection

Exploits (1)

exploitdb WRITEUP VERIFIED
by H3X · textwebappsphp
https://www.exploit-db.com/exploits/35391

The provided text describes an SQL injection vulnerability in glFusion, with example URLs demonstrating blind SQLi techniques to infer database version information. No actual exploit code is present.

Classification
Writeup 80%
Attack Type
Sqli
Complexity
Trivial
Reliability
Theoretical
Target: glFusion (version unspecified)
No auth needed
Prerequisites: Access to the vulnerable endpoint · Database with error-based or time-based SQLi support
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026