EIP-2026-110618

The exploit demonstrates a cross-site scripting (XSS) and remote file inclusion (RFI) vulnerability in Photokorn 1.542. The XSS payload is injected via the 'lang' parameter in install.php, while the RFI is triggered via the 'lg' parameter in index.php.