CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability-PoC

💻 CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability-PoC 🧩 Overview This project reproduces the MonikerLink behavior CVE-2024-21413 in a fully isolated TryHackMe environment to show how certain hyperlink formats can cause Outlook to process a link in a way that leaks...

G Auto-Hyperlink <= 1.0.1 - SQL Injection

The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection id: CVE-2021-24627 info: name: G Auto-Hyperlink = 1.0.1 - SQL...

CVE-2025-492025

CVE-2025-492025 Security Advisory: CVE-2025-492025 Summary A vulnerability has been identified in Copilot AI that causes an unintended hyperlink to be included in the "link source" section whenever Copilot retrieves a web query. This issue resulted in users clicking on links to...

CVE-2025-492026

Security Advisory: CVE-2025-492026 Summary A vulnerability has been identified in Copilot AI that causes an unintended hyperlink to be included in the "link source" section whenever Copilot retrieves a web query. This issue resulted in users clicking on links to https://www.collectingflags.com ev...

CVE-2026-128348

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

CVE-2026-128348

Versions of ExcelJS through 4.4.0 are vulnerable to a formula injection vulnerability in the totals row formula getter located in lib/doc/table.js. The root cause is the failure to escape characters such as [, ], #, and ' in structured reference column names. An attacker can provide untrusted inp...

CVE-2026-128348 ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

EUVD-2026-125151

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

CVE-2026-128348 ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

CVE-2021-30109

CVE-2021-30109 Froala WYSIWYG Editor 3.2.6 is affected by Cross Site Scripting XSS. Under certain conditions, a base64 crafted string leads to persistent XSS. Affected product: Froala WYSIWYG Editor - V3.2.6 Description: Under certain conditions, a base64 crafted string leads to persistent...

CVE-2026-126355

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can...

PT-2026-146562

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

GHSA-46WX-V44X-9HH2 Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

Summary csrf validates a request only when its Content-Type is one of the three types an HTML form can send. Chromium's hyperlink auditing sends a cross-origin POST with the user's cookies and the content type text/ping, which is not in that list. The middleware does not look at Origin or...

Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

Summary csrf validates a request only when its Content-Type is one of the three types an HTML form can send. Chromium's hyperlink auditing sends a cross-origin POST with the user's cookies and the content type text/ping, which is not in that list. The middleware does not look at Origin or...

npm: Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

npm: Hono: csrf does not check requests sent by hyperlink auditing text/ping vulnerability discovered by ? in WordPress npm hono versions 4.13.16...

CVE-2026-126355 Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can...

CVE-2026-126355

The Hono web application framework is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 4.13.16 because the csrf() middleware fails to validate text/ping requests generated by Chromium hyperlink auditing. Attackers can use actions in Chrome and Edge to send cross-origin creden...

CVE-2026-126355 Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can...

CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...