EIP-2026-104226

This JavaScript exploit demonstrates an unauthenticated stored XSS vulnerability in DNN v9.3.2, where a malicious user registration with a crafted 'Display Name' triggers an admin notification. When the admin clicks the notification, the XSS payload executes, granting the attacker admin privileges via API calls.