EIP-2026-112472

This exploit demonstrates a persistent XSS vulnerability in SugarCRM 6.5.18, where malicious script code can be injected into the 'Primary Address State' and 'Alternate Address State' fields. The payload executes when a privileged user views the contact, potentially leading to session hijacking or phishing.