EIP-2026-102381

This exploit demonstrates a cross-site scripting (XSS) vulnerability in DirectAdmin by injecting malicious JavaScript via the 'domain' parameter in the CMD_DOMAIN endpoint. The PoC uses an onmouseover event to trigger an alert, proving arbitrary script execution in the context of the affected site.