161 matches found
CVE-2022-34913
CVE-2022-34913 の説明 md2roff 1.7 は、大量の連続した文字を含む Markdown ファイルを処理する際にスタックベースのバッファオーバーフローを引き起こします。 再現方法 脆弱性を再現するには、脆弱なバージョンの md2roff（バージョン 1.7）をダウンロードする必要があります。 root@kitploit: git clone https://github.com/nereusx/md2roff.git cd md2roff git checkout 7fc373d25c91422454f081c8a717222d77fd7add make...
PoC-CVE-2026-20841
PoC CVE-2026-20841 説明 このプロジェクトは、Windows メモ帳の「リモートコード実行」に関する脆弱性に対するシンプルな概念実証（PoC）です。 攻撃者は特別な .md ファイルを作成し、ソーシャルエンジニアリングの手法でユーザーを騙して .md ファイル内のリンクをクリックさせることができます。 要件 メモ帳のバージョンが 11.2510 未満であること ユーザーがソーシャルエンジニアリングにより poc.md ファイルをすでにダウンロードしていること ユーザーとしての操作 poc.md がダウンロードされたら、リンクを順番にクリックしていきます。...
gitbook-xss
gitbook-xss CVE-2019-19596 GitBook 2.6.9 以前では、ローカルの .md ファイルを介して XSS が可能です。 MD ファイルにスクリプトを入力すると、gitbook によって実行される可能性があります。...
CVE-2026-56696 OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands
OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....
GHSA-V8QJ-HXV7-MGVV Open WebUI: Stored XSS in Mermaid Markdown Preview
Summary Open WebUI renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML. Because Mermaid is configured with securityLevel: 'loose', attacker-controlled Mermaid content can be rendered unsafely in this flow. A working paylo...
Windows Notepad Markdown Link Exposure Test
This Metasploit auxiliary module is a non-exploit, safety-focused research tool designed to generate a Markdown file for analyzing how Windows Notepad handles external links. It creates a controlled test document containing a user-defined URL and stores it locally for inspection...
Windows Notepad WebDAV UNC Reference Markdown File Generator
This Metasploit auxiliary module is a file-format generation tool intended for security testing of a CVE-2026-20841 related to Windows Notepad Markdown handling. It produces a Markdown file containing a UNC WebDAV-style path embedded as a clickable link for behavioral analysis...
GHSA-W4RC-P66M-X6QQ Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override
Summary Tested on Form 9.0.3 released on April, 28th The Form plugin's file upload handler at user/plugins/form/classes/Form.php:583 accepts a POST-supplied filename parameter $filename = $post'filename' ?? $upload'file''name' that overrides the original uploaded filename. The override passes...
CVE-2026-44111 OpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_get
OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memoryget function that allows callers to read any Markdown files within the workspace root. Attackers with access to the memory tool can bypass path restrictions by providing arbitrary workspace Markdown...
PT-2026-38283
Name of the Vulnerable Software and Affected Versions Grav form plugin versions prior to 9.1.0 Description An unauthenticated page-content overwrite exists via file upload. The file upload handler in user/plugins/form/classes/Form.php uses a filename parameter that can be controlled via POST...
CVE-2026-40201
@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file...
CVE-2026-40201
@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file...
CVE-2026-35169 LORIS has potential cross-site scripting in help_editor module
LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. From to before 27.0.3 and 28.0.1, the helpeditor module of LORIS did not properly sanitize some user supplied variables which could result i...
Spring AI Agentic Patterns (Part 6): AutoMemoryTools — Persistent Agent Memory Across Sessions
File-Based Long-Term Memory for Spring AI Agents Agents are only as useful as what they remember. Spring AI's Chat Memory stores the full conversation and can persist it across restarts, but when the window fills, the oldest messages are evicted. The upcoming Session API will add recursive...
CVE-2026-4833
CVE-2026-4833 affects Orc discount up to 3.0.1.2, specifically the Markdown Handler's markdown.c compile function. The issue causes uncontrolled recursion when fed input such as an infinitely deep blockquote, leading to a local-execution crash. Public exploit availability exists, and the project ...
CVE-2026-29082
Kestra, an event-driven orchestration platform, has a Stored XSS risk in versions 1.1.10 and earlier due to the execution-file preview rendering user-supplied Markdown with markdown-it (html: true) and injecting the HTML via Vue’s v-html without sanitisation. This can allow an attacker to inject ...
CVE-2025-65716
An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file...
CVE-2025-65716
An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file...
PT-2026-8355
Name of the Vulnerable Software and Affected Versions Visual Studio Code Extensions Markdown Preview Enhanced version 0.8.18 Description A flaw exists in Visual Studio Code Extensions Markdown Preview Enhanced version 0.8.18 that could allow attackers to execute arbitrary code. This is achieved b...