EIP-2026-103907

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Gadu-Gadu Instant Messenger by injecting malicious JavaScript via an input field. The payload loads an external script (x.js) that manipulates the DOM to hide elements and automatically trigger file open requests.