EIP-2026-106588

This exploit demonstrates a reflected XSS vulnerability in Drupal's avatar_uploader module v7.x-1.0-beta8. The PoC shows how an attacker can inject malicious JavaScript via the 'file' parameter in the avatar_uploader.pages.inc endpoint.