EIP-2026-109126

This exploit demonstrates a stored XSS vulnerability in Lifetype 1.2.10 due to improper sanitization of the HTTP Referer header. The PoC shows how an attacker can inject malicious JavaScript into the Referer header, which gets stored in the database and executed when viewed in blog statistics.