Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-114486. PoCs published by stoffline.com.
AI-analyzed exploit summary The exploit demonstrates a time-based blind SQL injection vulnerability in xt:Commerce, commerce:SEO, and Gambio by manipulating the `pagename` parameter in the URL path, bypassing authentication checks, and using `BENCHMARK` to infer data from the database.
Description
xt:Commerce 3.04 SP2.1 - Blind SQL Injection
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by stoffline.com · textwebappsphp
https://www.exploit-db.com/exploits/20544
The exploit demonstrates a time-based blind SQL injection vulnerability in xt:Commerce, commerce:SEO, and Gambio by manipulating the `pagename` parameter in the URL path, bypassing authentication checks, and using `BENCHMARK` to infer data from the database.
Classification
Working Poc 100%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target:
xt:Commerce <= v3.04 SP2.1, commerce:SEO <= v2.1 CE, Gambio <= v2.0.10 SP1.4
Auth required
Prerequisites:
Valid customer login credentials · Access to the admin/backup.php endpoint
mistral-large-3 · analyzed Feb 18, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026