EIP-2026-119376

This exploit demonstrates a persistent XSS vulnerability in Hexamail Server <= 4.4.5 by sending a malicious email with embedded JavaScript. The script executes automatically when the victim views the email in the webmail interface.