EIP-2026-110732

The exploit demonstrates a CSRF vulnerability in PHP MicroCMS 1.0.1, allowing an attacker to change the administrator password via a crafted HTML form. It also includes a separate XSS vulnerability in the 'static_pages_edit' endpoint, which can execute arbitrary JavaScript.