EIP-2026-111809

This exploit demonstrates a CSRF attack leading to persistent XSS and RCE via unrestricted file upload in RSS News AutoPilot Script. The PoC crafts a multipart/form-data request to upload a malicious PHP file disguised as an image, bypassing file type restrictions.