EIP-2026-112726

PRE-CVE

TLM CMS 1.1 - 'index.php' Multiple SQL Injections

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-112726. PoCs published by ZoRLu.

AI-analyzed exploit summary The exploit demonstrates SQL injection vulnerabilities in TLM CMS 1.1 by injecting malicious SQL queries via the 'ID' and 'idnews' parameters. It retrieves sensitive user data (passwords, usernames, emails) from the 'pphp_user' table.

Description

TLM CMS 1.1 - 'index.php' Multiple SQL Injections

Exploits (1)

exploitdb WORKING POC VERIFIED

by ZoRLu · textwebappsphp

https://www.exploit-db.com/exploits/31739

View Code ZIP pw:eip

The exploit demonstrates SQL injection vulnerabilities in TLM CMS 1.1 by injecting malicious SQL queries via the 'ID' and 'idnews' parameters. It retrieves sensitive user data (passwords, usernames, emails) from the 'pphp_user' table.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: TLM CMS 1.1

No auth needed

Prerequisites: Access to the vulnerable TLM CMS application

MITRE ATT&CK

T1189 - Drive-by Compromise T1505 - Server Software Component

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026