EIP-2026-103306

This is a technical writeup detailing a persistent XSS vulnerability in Oracle Siebel CRM 19.0 and prior versions, caused by insecure file upload functionality allowing HTML files with JavaScript payloads. The exploit requires authentication and involves uploading a malicious HTML file via the 'Activity Attachment View' feature.