EIP-2026-107841 - InfraPower PPS-02-S Q213V1 - Multiple Cross-Site Scripting Vulnerabilities

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-107841. PoCs published by LiquidWorm.

AI-analyzed exploit summary This exploit demonstrates multiple XSS vulnerabilities in InfraPower PPS-02-S Q213V1 firmware V2395S, including stored and reflected XSS via various parameters in scripts like SensorDetails.php, FWUpgrade.php, and SNMP.php. The PoC includes HTTP requests with malicious payloads and a PHP source code scan revealing additional vulnerabilities like command injection and header injection.

Description

InfraPower PPS-02-S Q213V1 - Multiple Cross-Site Scripting Vulnerabilities

Exploits (1)

exploitdb WORKING POC

by LiquidWorm · textwebappsphp

https://www.exploit-db.com/exploits/40641

View Code ZIP pw:eip

This exploit demonstrates multiple XSS vulnerabilities in InfraPower PPS-02-S Q213V1 firmware V2395S, including stored and reflected XSS via various parameters in scripts like SensorDetails.php, FWUpgrade.php, and SNMP.php. The PoC includes HTTP requests with malicious payloads and a PHP source code scan revealing additional vulnerabilities like command injection and header injection.

Classification

Working Poc 95%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: InfraPower PPS-02-S Q213V1 (Firmware: V2395S)

No auth needed

Prerequisites: Network access to the target device · Web browser or tool to send HTTP requests

MITRE ATT&CK

T1059.007 - JavaScript

devstral-2 · analyzed Feb 16, 2026 Full analysis →