EIP-2026-103860

The exploit demonstrates a cross-site scripting (XSS) vulnerability in Appweb by injecting a script tag via URL encoding. The payload executes arbitrary JavaScript in the context of the affected site, potentially leading to credential theft or other client-side attacks.