CVE-2026-34564 CI4MS存储型DOM XSS漏洞

// Proof of Concept for CVE-2026-34564 // Step 1: Attacker logs in with low privileges and navigates to Menu Management. // Step 2: Attacker adds a Page to the menu with a malicious payload in the title/description. // Example Payload to be stored in the menu item: var payload = "<img src=x onerror=alert(document.cookie)>"; // Step 3: The application saves the payload to the database without sanitization. // Step 4: When an Administrator or User loads the page rendering the navigation menu: // The browser parses the unsanitized string and executes the script. // Expected Result: An alert box displaying the current session cookies appears, confirming the vulnerability.