EIP-2026-112370

The exploit demonstrates a remote file inclusion vulnerability in SPChat 0.8 via the 'statussess' parameter, allowing an attacker to inject malicious HTML/JS (e.g., cookie theft via iframe). The PoC includes a crafted URL and example attack payload.