EIP-2026-106116

This exploit demonstrates a cross-site scripting (XSS) vulnerability in COMS by injecting a malicious script via the 'q' parameter in a URL. The payload bypasses sanitization using null bytes and mixed case to execute arbitrary JavaScript.