EIP-2026-110851

This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHP-Nuke by injecting malicious JavaScript into the 'username' parameter of the modules.php script. The PoC uses a simple alert to display the victim's cookies, proving the vulnerability.