# CVE-2026-36358 PoC - Juzaweb CMS v.5.0.0 （XSS） First, set up the platform normally and register an account. Here, the administrator account I registered is `123@123.com` / `123456`. After setting up the platform, you can see the website homepage. image Access `/admin` and log in. image After logging in, you will enter the admin backend dashboard. image Navigate to the `/admin/banner-ads` route and click "Add Banner" to go to the ad creation page. image Change the Type to "HTML" and insert the malicious XSS code into the Body field. image If you encounter an error like this: image Go back to the "Image" Type and enter any URL in the URL field. image After successfully adding the ad, you can see it is active/running. image Now, return to the homepage. The alert box will pop up, demonstrating the XSS vulnerability. image