EIP-2026-100845

The exploit demonstrates a cross-site scripting (XSS) vulnerability in LISTSERV 16 by injecting a malicious script via the SHOWTPL parameter in the WA.EXE endpoint. The payload executes arbitrary JavaScript in the context of the affected site, potentially leading to cookie theft or other client-side attacks.