EIP-2026-102320

This advisory details multiple command/path injection vulnerabilities in Wireless Transfer App 3.7 for iOS, where album names can be manipulated to execute unauthorized commands or path requests. The PoC demonstrates how crafted album names can trigger the vulnerability in the application's web interface.