EIP-2026-109732

PRE-CVE

MyBB Profile Blogs Plugin 1.2 - Multiple Vulnerabilities

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-109732. PoCs published by Zixem.

AI-analyzed exploit summary The exploit demonstrates SQL Injection and Stored XSS vulnerabilities in the MyBB Profile Blogs plugin. The SQLi occurs due to unsanitized input in the 'edit' parameter, while the XSS arises from improper handling of the 'subject' field in blog posts.

Description

MyBB Profile Blogs Plugin 1.2 - Multiple Vulnerabilities

Exploits (1)

exploitdb WORKING POC VERIFIED

by Zixem · textwebappsphp

https://www.exploit-db.com/exploits/23287

View Code ZIP pw:eip

The exploit demonstrates SQL Injection and Stored XSS vulnerabilities in the MyBB Profile Blogs plugin. The SQLi occurs due to unsanitized input in the 'edit' parameter, while the XSS arises from improper handling of the 'subject' field in blog posts.

Classification

Working Poc 90%

Attack Type

Sqli | Xss

Complexity

Trivial

Reliability

Reliable

Target: MyBB Profile Blogs plugin 1.2+

Auth required

Prerequisites: Access to a MyBB account with the Profile Blogs plugin enabled · Ability to create or edit a blog post

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1189 - Drive-by Compromise

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026