EIP-2026-106120

This is a functional proof-of-concept for a stored XSS vulnerability in Concrete CMS 5.4.1.1. The exploit leverages unsanitized input in the 'rcID' parameter to inject malicious JavaScript, which executes in the context of the affected site.