EIP-2026-111136

This exploit demonstrates a Cross-Site Scripting (XSS) vulnerability and a Full Path Disclosure (FPD) flaw in phpMyAdmin 2.6.3-pl1. The XSS payload injects JavaScript via the 'hash' parameter, while the FPD is triggered by a malformed SQL query.