EIP-2026-100347

The exploit demonstrates a reflected XSS vulnerability in Hero 3.69 by injecting a malicious script via the 'month' parameter in the events page. The payload bypasses input sanitization and executes arbitrary JavaScript in the context of the affected site.