Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-112939. PoCs published by Hubert Wojciechowski.
AI-analyzed exploit summary This is a functional proof-of-concept for a stored XSS vulnerability in Uvdesk 1.1.4. The exploit demonstrates how an authenticated user can inject malicious JavaScript via a ticket reply, which executes when viewed by another user (e.g., an admin).
Description
Uvdesk 1.1.4 - Stored XSS (Authenticated)
Exploits (1)
exploitdb
WORKING POC
by Hubert Wojciechowski · textwebappsphp
https://www.exploit-db.com/exploits/51696
This is a functional proof-of-concept for a stored XSS vulnerability in Uvdesk 1.1.4. The exploit demonstrates how an authenticated user can inject malicious JavaScript via a ticket reply, which executes when viewed by another user (e.g., an admin).
Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target:
Uvdesk 1.1.4
Auth required
Prerequisites:
Authenticated access to Uvdesk · Ability to create or reply to a ticket
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026