EIP-2026-108966
PRE-CVEKandidat CMS 1.4.2 - Persistent Cross-Site Scripting
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-108966. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary This is a working PoC for a stored XSS vulnerability in Kandidat CMS 1.4.2. The exploit demonstrates how an attacker can inject arbitrary JavaScript code via the 'title' parameter in the admin settings page, leading to potential cookie theft or session hijacking.
Description
Kandidat CMS 1.4.2 - Persistent Cross-Site Scripting
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by High-Tech Bridge SA · textwebappsphp
https://www.exploit-db.com/exploits/15385
This is a working PoC for a stored XSS vulnerability in Kandidat CMS 1.4.2. The exploit demonstrates how an attacker can inject arbitrary JavaScript code via the 'title' parameter in the admin settings page, leading to potential cookie theft or session hijacking.
Classification
Working Poc 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target:
Kandidat CMS 1.4.2 and prior versions
Auth required
Prerequisites:
Access to the admin panel · Valid session or authentication credentials
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026