EIP-2026-105882

The exploit demonstrates a persistent XSS vulnerability in Claroline 1.10 by injecting a script tag into the first or last name field of a user, which is rendered unencoded in the administration user list.