EIP-2026-106956

The exploit demonstrates multiple remote file inclusion vulnerabilities in ExBB 1.9.1 due to improper sanitization of the 'exbb[home_path]' parameter. An attacker can include arbitrary remote PHP files, leading to remote code execution in the context of the webserver.