EIP-2026-106582

The exploit demonstrates an HTML injection vulnerability in Drupal by using URL-encoded script tags to execute arbitrary JavaScript. The payload bypasses input sanitization by leveraging decimal and hexadecimal HTML entities to obfuscate the malicious script.