EIP-2026-101316

This exploit demonstrates an authenticated stored XSS vulnerability in ICT Protege GX/WX 2.08, where the 'Name' parameter in the Daylight Savings scheduling feature fails to sanitize input, allowing arbitrary script execution. The PoC includes decrypted and encrypted request examples, along with encryption/decryption functions used by the application.