EIP-2026-113445

This exploit demonstrates a CSRF vulnerability in Wing FTP Server Admin 4.4.5, allowing arbitrary user addition via a crafted URL. The PoC leverages JavaScript injection to trigger an unauthorized POST request to the admin_adduser endpoint.