EIP-2026-104198

This exploit demonstrates a CSV injection vulnerability in ChurchCRM 4.2.0, where a malicious payload in the 'Name' field of an event type is executed when the CSV file is opened in Excel. The payload triggers a calculator pop-up as a proof of concept.