EIP-2026-111530

PRE-CVE

ProfitCode Software PayProCart 3.0 - Ckprvd Cross-Site Scripting

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-111530. PoCs published by Lostmon.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in PayProCart due to insufficient input sanitization. The PoC URL injects arbitrary JavaScript code via the 'ckprvd' parameter, which executes in the context of the user's browser.

Description

ProfitCode Software PayProCart 3.0 - Ckprvd Cross-Site Scripting

Exploits (1)

exploitdb WORKING POC VERIFIED

by Lostmon · textwebappsphp

https://www.exploit-db.com/exploits/25489

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in PayProCart due to insufficient input sanitization. The PoC URL injects arbitrary JavaScript code via the 'ckprvd' parameter, which executes in the context of the user's browser.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: PayProCart (version unspecified)

No auth needed

Prerequisites: Access to a vulnerable PayProCart instance · User interaction to trigger the malicious URL

MITRE ATT&CK

T1059.007 - JavaScript

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026