EIP-2026-107528

The exploit demonstrates an HTML injection vulnerability in GuppY's 'postguest.php' script, specifically via the '[c]' tag, allowing arbitrary script execution. The provided payload '[c=expression(alert('unsecure'))]texte[/c]' confirms the flaw by injecting JavaScript into the portal.