EIP-2026-100416

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Max Network Technology BBSMAX 4.2 by injecting a script tag into the 'threadid' parameter of a URL. The PoC triggers an alert box, proving arbitrary JavaScript execution in the context of the affected site.