EIP-2026-102427

The exploit demonstrates a cross-site scripting (XSS) vulnerability in Sun Java System Messenger Express by injecting a malicious script via the 'lang' parameter in the URL. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.