EIP-2026-109846

This exploit demonstrates a remote command injection vulnerability in NC LinkList 1.3.1 by injecting PHP code into the 'Ihr Name' field, which is then executed when the page is viewed. The PoC reads the configuration file to leak database credentials.