EIP-2026-106136

The exploit demonstrates SQL injection via the 'page_id' parameter and reflected XSS via 'user' and 'hash' parameters in Constructr CMS 3.03. The PoC includes direct URLs with injection points, confirming functional exploitability.