EIP-2026-112393

The exploit demonstrates a cross-site scripting (XSS) vulnerability in Spitfire by injecting malicious script code via the 'cms_username' cookie parameter. The payload is delivered through a crafted HTTP GET request, which, if executed, could allow arbitrary JavaScript execution in the context of the affected site.