EIP-2026-107551

This exploit demonstrates a script-code-injection vulnerability in HAMweather by injecting PHP code into the 'daysonly' parameter, leading to arbitrary code execution (e.g., phpinfo()).