EIP-2026-111816

The writeup describes a DOM-based XSS vulnerability in rukovoditel 3.2.1, where data from `location.hash` is passed to `jQuery.parseHTML`, allowing account creation attacks. It includes a proof-of-concept HTTP request and references external proof materials.