EIP-2026-107122

This exploit targets Flat Calendar v1.1 by injecting HTML content into the calendar's event description field via an unauthenticated POST request to 'admin/calAdd.php'. It then retrieves the event number to confirm the injection.