EIP-2026-107963

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-107963. PoCs published by Saadi Siddiqui.

AI-analyzed exploit summary This exploit demonstrates a persistent XSS vulnerability in iScripts MultiCart <= 2.4 via unsanitized user input in product reviews, combined with a CSRF attack to manipulate user data or takeover accounts. The PoC includes a crafted HTML form for CSRF and an XSS vector for mass email changes.

Description

iScripts MultiCart 2.4 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Cross-Site Scripting / Cross-Site Request Forgery / Mass Accounts Takeover

Exploits (1)

exploitdb WORKING POC

by Saadi Siddiqui · textwebappsphp

https://www.exploit-db.com/exploits/30357

View Code ZIP pw:eip

This exploit demonstrates a persistent XSS vulnerability in iScripts MultiCart <= 2.4 via unsanitized user input in product reviews, combined with a CSRF attack to manipulate user data or takeover accounts. The PoC includes a crafted HTML form for CSRF and an XSS vector for mass email changes.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: iScripts MultiCart <= 2.4

No auth needed

Prerequisites: Access to product_review.php · Victim interaction for XSS execution

MITRE ATT&CK

T1189 - Drive-by Compromise T1059.007 - JavaScript

devstral-2 · analyzed Feb 16, 2026 Full analysis →

iScripts MultiCart 2.4 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Cross-Site Scripting / Cross-Site Request Forgery / Mass Accounts Takeover

Exploitation Summary

Description

Exploits (1)

Details