EIP-2026-107542

This exploit demonstrates a stored XSS vulnerability in GYM Management System 1.0 by injecting a malicious payload into the 'lname' field, which executes when the profile page is accessed. The payload steals cookies via an onmouseover event.