EIP-2026-109458

PRE-CVE

MidiCart PHP - 'Item_List.php?SecondGroup' Cross-Site Scripting

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-109458. PoCs published by Exoduks.

AI-analyzed exploit summary The exploit demonstrates a cross-site scripting (XSS) vulnerability in MidiCart PHP due to improper input sanitization. The provided URL injects arbitrary JavaScript code via the 'secondgroup' parameter, which executes in the context of the user's browser.

Description

MidiCart PHP - 'Item_List.php?SecondGroup' Cross-Site Scripting

Exploits (1)

exploitdb WORKING POC VERIFIED

by Exoduks · textwebappsphp

https://www.exploit-db.com/exploits/25619

View Code ZIP pw:eip

The exploit demonstrates a cross-site scripting (XSS) vulnerability in MidiCart PHP due to improper input sanitization. The provided URL injects arbitrary JavaScript code via the 'secondgroup' parameter, which executes in the context of the user's browser.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: MidiCart PHP

No auth needed

Prerequisites: A vulnerable version of MidiCart PHP · User interaction to visit the crafted URL

MITRE ATT&CK

T1059.007 - JavaScript

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026