EIP-2026-110636

The exploit demonstrates a reflected XSS vulnerability in PHP Address Book by injecting a malicious script via the 'group' parameter. The payload uses JavaScript's String.fromCharCode to bypass basic filters and execute arbitrary code in the context of the victim's browser.