I32 SECURITY TEST - full-page CSS takeover
This entire viewport, and the forum header above, are attacker-controlled content stored in this public topic by the oEmbed HTML/CSS injection (CVE-2026-91159). The injected style block applies document-wide and is served to every viewer of this topic, including logged-out visitors and staff.
This is not script execution: it is arbitrary stored HTML/CSS. An attacker could hide the real forum UI and present a fraudulent sign-in page here. The button below is an attacker-controlled link (example.com, harmless):
Sign in to continue