EIP-2026-100096

The exploit demonstrates multiple XSS vulnerabilities in Activedition 4.0 by injecting malicious scripts into the 'workflow' and 'pageid' parameters of the 'aelogin.asp' endpoint. The payloads include alert-based cookie theft and iframe injection, confirming the lack of input sanitization.