EIP-2026-104459

The exploit describes an XSF (Cross-Site Flashing) vulnerability in SWFupload where improper input validation allows loading arbitrary SWF files via the `buttonTextStyle` parameter. The PoC demonstrates how an attacker can exploit this to load malicious SWF content from an external domain.