EIP-2026-105981

The exploit demonstrates a local file inclusion (LFI) vulnerability and a cross-site scripting (XSS) vulnerability in CMS Made Simple 1.6.6. The LFI allows directory traversal to access local files, while the XSS executes arbitrary JavaScript in the context of the affected site.