EIP-2026-114637

PRE-CVE

Zomplog 3.9 - Cross-Site Scripting / Cross-Site Request Forgery

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-114637. PoCs published by 10n1z3d.

AI-analyzed exploit summary The exploit demonstrates multiple CSRF and XSS vulnerabilities in Zomplog CMS 3.9. It includes functional PoC code for changing admin passwords, creating admin users, deleting users, and executing XSS via crafted URLs.

Description

Zomplog 3.9 - Cross-Site Scripting / Cross-Site Request Forgery

Exploits (1)

exploitdb WORKING POC VERIFIED

by 10n1z3d · htmlwebappsphp

https://www.exploit-db.com/exploits/14650

View Code ZIP pw:eip

The exploit demonstrates multiple CSRF and XSS vulnerabilities in Zomplog CMS 3.9. It includes functional PoC code for changing admin passwords, creating admin users, deleting users, and executing XSS via crafted URLs.

Classification

Working Poc 100%

Attack Type

Xss | Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: Zomplog CMS 3.9

No auth needed

Prerequisites: Victim must visit a malicious page or URL

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026