EIP-2026-104214

The exploit demonstrates multiple CSRF and XSS vulnerabilities in CrushFTP 7.2.0's web interface. It includes functional PoC code for adding/modifying user accounts via CSRF and executing reflected XSS payloads through manipulated parameters like 'vfs_items' and 'path'.