EIP-2026-104133

The exploit demonstrates a cross-site scripting (XSS) vulnerability in XAMPP's showcode.php by injecting a malicious script via the TEXT[global-showcode] parameter. The payload executes arbitrary JavaScript in the context of the affected site, potentially stealing cookies or performing other client-side attacks.