EIP-2026-105826

This exploit demonstrates a CSRF vulnerability in chilly_CMS that allows an attacker to delete an admin user by tricking them into visiting a malicious HTML page. The PoC uses an img tag to trigger the deletion action via a crafted URL.