EIP-2026-106923

The provided text describes an HTML-injection vulnerability in eTransfer Lite 1.0, where user-supplied input is not properly sanitized, allowing attacker-supplied HTML or JavaScript code to execute in the context of the affected site. The example demonstrates persistent XSS via crafted file names in the application's file listing functionality.