EIP-2026-110806

This exploit leverages PHP-Fusion's [img] BBCode tag to trick administrators into executing unauthorized actions (e.g., user deletion, banning) by embedding malicious URLs in signatures or posts. The PoC generates exploit strings for different versions (5.x/6.x) and actions.