EIP-2026-113296

PRE-CVE

WeBid 1.0.2 - Persistent Cross-Site Scripting (via SQL Injection)

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-113296. PoCs published by Saif.

AI-analyzed exploit summary The document describes a persistent XSS vulnerability in WeBid 1.0.2, leveraged through SQL injection in the 'maxprice' field of adsearch.php. The attack triggers an error that writes malicious HTML/JS to the error log, which executes when viewed by an admin.

Description

WeBid 1.0.2 - Persistent Cross-Site Scripting (via SQL Injection)

Exploits (1)

exploitdb WRITEUP VERIFIED
by Saif · textwebappsphp
https://www.exploit-db.com/exploits/17408

The document describes a persistent XSS vulnerability in WeBid 1.0.2, leveraged through SQL injection in the 'maxprice' field of adsearch.php. The attack triggers an error that writes malicious HTML/JS to the error log, which executes when viewed by an admin.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: WeBid 1.0.2
No auth needed
Prerequisites: Access to adsearch.php · Error log viewing capability by admin
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026