EIP-2026-105051

This exploit demonstrates multiple vulnerabilities in Ajax Availability Calendar 3.X.X, including SQL injection, reflected XSS, full path disclosure, and CSRF. The SQL injection PoC extracts admin credentials via a union-based attack, while other sections outline XSS and CSRF attack vectors.