EIP-2026-109904

The provided text describes multiple local file-include vulnerabilities and an HTML-Injection vulnerability in New-CMS 1.08. It outlines how an attacker can exploit these vulnerabilities using directory-traversal strings to execute arbitrary scripts and perform HTML injection.