EIP-2026-107919

This is a writeup describing a persistent XSS vulnerability in IP.Board 4.1.4.x, where malicious JavaScript in a private message title executes when the recipient receives a notification. No exploit code is provided, only a description and proof-of-concept steps.