EIP-2026-107600

The exploit demonstrates a reflected XSS vulnerability in HLstatsX Community Edition 1.6.5 via the 'q' parameter in the search functionality. The PoC URL injects arbitrary HTML/JavaScript, which executes in the context of the victim's browser.