EIP-2026-112954

PRE-CVE

VANA CMS - 'index.php' Script SQL Injection

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-112954. PoCs published by Black Hat Group.

AI-analyzed exploit summary The exploit demonstrates an SQL injection vulnerability in VANA CMS by injecting a single quote into the 'recordID' parameter, which can be used to manipulate SQL queries. This can lead to unauthorized data access or further exploitation of the database.

Description

VANA CMS - 'index.php' Script SQL Injection

Exploits (1)

exploitdb WORKING POC VERIFIED
by Black Hat Group · textwebappsphp
https://www.exploit-db.com/exploits/37420

The exploit demonstrates an SQL injection vulnerability in VANA CMS by injecting a single quote into the 'recordID' parameter, which can be used to manipulate SQL queries. This can lead to unauthorized data access or further exploitation of the database.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: VANA CMS
No auth needed
Prerequisites: Access to the vulnerable VANA CMS instance
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026