EIP-2026-110586

This exploit demonstrates stored XSS and path disclosure vulnerabilities in phlyMail Lite 4.03.04. It includes multiple forms that inject malicious scripts into user input fields and trigger path disclosure via a derefer.php endpoint.