EIP-2026-101404

This exploit demonstrates an unauthenticated reflected XSS vulnerability in Osprey Pump Controller v1.0.1 by injecting arbitrary JavaScript via the 'userName' GET parameter. The PoC URL triggers a confirmation dialog as proof of execution.