EIP-2026-110628

This exploit demonstrates a header injection vulnerability in PHP's header() function, allowing arbitrary script code injection via URL-encoded payloads. The PoC shows how an attacker can inject malicious JavaScript into HTTP headers by manipulating the URL parameter.