EIP-2026-107815

PRE-CVE

ImpressPages CMS 3.6 - Multiple Cross-Site Scripting / SQL Injection Vulnerabilities

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-107815. PoCs published by LiquidWorm.

AI-analyzed exploit summary This exploit demonstrates SQL injection and reflected XSS vulnerabilities in ImpressPages CMS v3.6. It includes HTTP request examples with malicious payloads for parameters like 'pageId' and 'language' for SQLi, and various POST parameters for XSS.

Description

ImpressPages CMS 3.6 - Multiple Cross-Site Scripting / SQL Injection Vulnerabilities

Exploits (1)

exploitdb WORKING POC

by LiquidWorm · textwebappsphp

https://www.exploit-db.com/exploits/29318

View Code ZIP pw:eip

This exploit demonstrates SQL injection and reflected XSS vulnerabilities in ImpressPages CMS v3.6. It includes HTTP request examples with malicious payloads for parameters like 'pageId' and 'language' for SQLi, and various POST parameters for XSS.

Classification

Working Poc 90%

Attack Type

Sqli | Xss

Complexity

Trivial

Reliability

Reliable

Target: ImpressPages CMS v3.6

Auth required

Prerequisites: Access to the target application · Valid session cookie

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026