EIP-2026-102353

This exploit demonstrates an unauthenticated command injection vulnerability in Apache Continuum 1.4.2 via the 'installation.varValue' parameter in the 'saveInstallation.action' endpoint. It also includes a reflected XSS example, though the XSS requires authentication.