EIP-2026-110805

The exploit demonstrates a stored XSS vulnerability in PHP-Fusion 5.00 by injecting malicious JavaScript via ASCII-encoded BBCode IMG tags. The payload bypasses input sanitization and executes arbitrary script code in a user's browser when rendered.