EIP-2026-105689

The exploit demonstrates a cross-site scripting (XSS) vulnerability in Calendar Express by injecting a malicious script via the 'q' parameter in the search functionality. The payload executes arbitrary JavaScript in the context of the affected site.