EIP-2026-106016

The exploit demonstrates a PHP code injection vulnerability in CMSimple via the 'search' parameter in multiple files. The vulnerability arises from improper handling of user input in the `preg_replace` function with the `create_function` callback, allowing arbitrary PHP code execution.