EIP-2026-105803

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Private Message System 1.1.3 by injecting a malicious script via the 'tid' parameter in message_send.php. The script executes arbitrary JavaScript, potentially stealing cookies or session data.