EIP-2026-104910

This is a vulnerability disclosure writeup describing a stored XSS vulnerability in Achievo 1.4.2, where user-supplied input in the Scheduler Category is not sanitized. The PoC demonstrates adding a malicious script as a category name, which executes when viewed.