EIP-2026-105612

This is a functional proof-of-concept for a stored XSS vulnerability in BoxBilling 3.6.11 via the 'message' parameter in the 'mod_notification' module. The exploit demonstrates arbitrary script execution by injecting a malicious payload into the notification system.