EIP-2026-114603

The exploit demonstrates a reflected XSS vulnerability in Zenphoto by injecting a malicious script via the 'date' parameter in the admin-news-articles.php endpoint. The payload executes arbitrary JavaScript in the context of the affected site, potentially leading to session hijacking or other client-side attacks.