Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-109846. PoCs published by ThE g0bL!N.
AI-analyzed exploit summary This exploit demonstrates a remote command injection vulnerability in NC LinkList 1.3.1 by injecting PHP code into the 'Ihr Name' field, which is then executed when the page is viewed. The PoC reads the configuration file to leak database credentials.
Description
NC LinkList 1.3.1 - Remote Command Injection
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by ThE g0bL!N · textwebappsphp
https://www.exploit-db.com/exploits/8747
This exploit demonstrates a remote command injection vulnerability in NC LinkList 1.3.1 by injecting PHP code into the 'Ihr Name' field, which is then executed when the page is viewed. The PoC reads the configuration file to leak database credentials.
Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target:
NC LinkList 1.3.1
No auth needed
Prerequisites:
Access to the vulnerable web application · Knowledge of the link ID
devstral-2 · analyzed Feb 16, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026