EIP-2026-109048

The exploit demonstrates a reflected XSS vulnerability in KubeLabs PHPDug 2.0.0 by injecting a malicious script via the 'id' parameter in the 'upcoming.php' page. The payload bypasses basic sanitization using mixed case and encoding to execute arbitrary JavaScript in the victim's browser.