EIP-2026-109193

This exploit leverages unauthenticated stored XSS vulnerabilities in Loadbalancer.org Enterprise VA MAX to inject JavaScript payloads into Apache logs, which execute a reverse shell when viewed by an admin. It uses two XSS vectors: Basic Auth and URL parameters.