EIP-2026-105807

The exploit demonstrates a persistent XSS vulnerability in Chamilo LMS 1.11.8 by injecting malicious JavaScript into the 'firstname' and 'lastname' fields during user registration. The PoC includes a crafted HTTP POST request that triggers the XSS payload when processed by the application.