EIP-2026-102539

This document describes a persistent XSS vulnerability and filter bypass in Totemomail v4.x and v5.x, where malicious script codes can be injected into the 'Subject' and 'Message Body' fields, executed when the message is saved as HTML. The PoC demonstrates bypassing input validation using img tags with onload events.