EIP-2026-110362

The exploit demonstrates a cross-site scripting (XSS) vulnerability in osCommerce by injecting malicious script code via the 'enquiry' parameter in the contact_us.php page. The payload closes the textarea tag and injects a script alert, confirming the vulnerability.