EIP-2026-112084

PRE-CVE

Simple CRM 3.0 - 'name' Stored Cross site scripting (XSS)

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-112084. PoCs published by Riadh Benlamine.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Simple CRM 3.0 via the 'name' parameter in profile.php. The PoC shows how an authenticated attacker can inject malicious JavaScript to steal administrator cookies.

Description

Simple CRM 3.0 - 'name' Stored Cross site scripting (XSS)

Exploits (1)

exploitdb WORKING POC
by Riadh Benlamine · textwebappsphp
https://www.exploit-db.com/exploits/50044

This exploit demonstrates a stored XSS vulnerability in Simple CRM 3.0 via the 'name' parameter in profile.php. The PoC shows how an authenticated attacker can inject malicious JavaScript to steal administrator cookies.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Simple CRM 3.0
Auth required
Prerequisites: Authenticated session · Access to profile.php
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026