EIP-2026-110209

PRE-CVE

Onyx - Multiple Cross-Site Scripting Vulnerabilities

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-110209. PoCs published by High-Tech Bridge SA.

AI-analyzed exploit summary This is a functional proof-of-concept for a stored XSS vulnerability in Onyx 0.3.2. It demonstrates how an attacker can inject malicious JavaScript into the application's settings and category forms, which will execute in the context of an admin user's browser.

Description

Onyx - Multiple Cross-Site Scripting Vulnerabilities

Exploits (1)

exploitdb WORKING POC VERIFIED
by High-Tech Bridge SA · htmlwebappsphp
https://www.exploit-db.com/exploits/34469

This is a functional proof-of-concept for a stored XSS vulnerability in Onyx 0.3.2. It demonstrates how an attacker can inject malicious JavaScript into the application's settings and category forms, which will execute in the context of an admin user's browser.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Onyx 0.3.2
Auth required
Prerequisites: Access to admin settings or category update forms · Victim must visit the affected page
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026