EIP-2026-107423

The exploit demonstrates a stored XSS vulnerability in glFusion CMS 1.2.1 via malformed BBcode image tags. The PoC bypasses input sanitization by injecting JavaScript into the 'w' (width) attribute of an [img] tag, executing arbitrary code when rendered.