CVE-2023-36003-POC

Privilege escalation using the XAML diagnostics API CVE-2023-36003 This is a POC Proof of Concept of a privilege escalation vulnerability using the XAML diagnostics API. The vulnerability was patched in December's Patch Tuesday, and the CVE assigned to it is CVE-2023-36003. Usage The POC is a C++...

CVE-2025-53693

CVE-2025-53693: HTML Cache Poisoning The XAML handler, located at /-/xaml/, exposes several controls that can be accessed without authentication. The AjaxScriptManager within these controls allows for the execution of methods via reflection. The AddToCache method can be abused to inject arbitrary...

CVE-2023-35813_PoC

curl -k -v -X POST "https://target/sitecorexaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index" -H "Content-Type: application/x-www-form-urlencoded" --data-urlencode "ISEVENT=1" --data-urlencode "SOURCE=" --data-urlencode "PARAMETERS=ParseControl" ""...

CVE-2023-36123

CVE-2023-36123 For demonstration purposes only. Exploit works on all Versions of Plain Craft Launcher 2. Download Custom.xaml and import into Plain Craft Launcher 2,then click "Run Command". https://github.com/Hex-Dragon/PCL2/assets/140469824/636d1436-a26d-4f54-ad4f-a7b1bb123783...

Exploit_CVE-2020-0688

CVE-2020-0688 Exploitation Script for CVE-2020-0688 "Microsoft Exchange default MachineKeySection deserialize vulnerability" Usage: powershell -exec bypass -file .\CVE-2020-0688.ps1 -xaml -uri Example: This is an example of vulnerability validation by seting header in response. powershell -exec...

Altus iX Developer XAML gadget screen RCE

Builds malicious .ix / .ixp with ObjectDataProvider→Process.Start from set payload. Operator opens the file in iX Developer local trigger, not network delivery. """Altus iX Developer XAML Deserialization RCE""" from future import annotations import os import tempfile from kittysploit import impor...

CVE-2020-0688

CVE-2020-0688 Exploitation Script for CVE-2020-0688 "Microsoft Exchange default MachineKeySection deserialize vulnerability" Usage: powershell -exec bypass -file .\CVE-2020-0688.ps1 -xaml -uri Example: This is an example of vulnerability validation by seting header in response. powershell -exec...

GHSA-4J9V-H7PP-725H Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the processing of XAML and XPS content, which may allow unauthorized access to sensitive information. An attacker can obtain confidential data by crafting malicious input that triggers an out-of-bounds read...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the processing of XAML and XPS content, which may allow unauthorized access to sensitive information. An attacker can obtain confidential data by crafting malicious input that triggers an out-of-bounds read...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the processing of XAML and XPS content, which may allow unauthorized access to sensitive information. An attacker can obtain confidential data by crafting malicious input that triggers an out-of-bounds read...

GHSA-FQ6X-PVR9-888R Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

Permissive List of Allowed Inputs

Overview Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via the processing of XAML or XPS content. An attacker can obtain sensitive information by enticing a user to open or navigate to a crafted URI or hyperlink, which may allow unauthorized access to data...

Permissive List of Allowed Inputs

Overview Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via the processing of XAML or XPS content. An attacker can obtain sensitive information by enticing a user to open or navigate to a crafted URI or hyperlink, which may allow unauthorized access to data...

Permissive List of Allowed Inputs

Overview Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via the processing of XAML or XPS content. An attacker can obtain sensitive information by enticing a user to open or navigate to a crafted URI or hyperlink, which may allow unauthorized access to data...

Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A remote code execution...

GHSA-GH2H-RHPH-H37G Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A remote code execution...

GHSA-2969-4Q4W-W5H3 Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An elevation of privilege...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via XAML parsing in Windows Presentation Foundation WPF. An attacker can execute arbitrary code by supplying specially crafted XAML input that is processed by a vulnerable WPF application. Improper handling of...