EIP-2026-106226

The exploit demonstrates multiple cross-site scripting (XSS) vulnerabilities in CPG Dragonfly by injecting arbitrary JavaScript code via crafted URLs. The PoC includes specific payloads targeting the 'name' and 'profile' parameters, as well as the 'displayimage' module.