EIP-2026-109587

This exploit demonstrates a stored Cross-Site Scripting (XSS) vulnerability in Moodle LMS 4.0 via the search functionality in 'course/search.php'. The payload injects JavaScript through an img tag's onerror event to execute arbitrary code.