EIP-2026-110441

The exploit describes an input validation flaw in PacketFence's Login.php, specifically in the `check_input` and `check_sensitive_input` functions, which fail to properly sanitize user input, leading to XSS and HTML injection vulnerabilities. The PoC demonstrates how an attacker can inject malicious scripts via the username field.