EIP-2026-107114

This advisory details a command injection vulnerability in Flash Operator Panel v2.31.03, where the `command` parameter in `index.php` allows authenticated users to execute arbitrary system commands via the callforward module. The vulnerability is exploitable via a GET request and requires low-privileged authentication.