EIP-2026-106972

This exploit demonstrates an HTTP response splitting and XSS vulnerability in ExpressionEngine by injecting malicious headers and script tags via the URL parameter. It leverages improper input sanitization to execute arbitrary JavaScript in the context of a victim's browser.