506 matches found
CVE-2021-30109
CVE-2021-30109 Froala WYSIWYG Editor 3.2.6 is affected by Cross Site Scripting XSS. Under certain conditions, a base64 crafted string leads to persistent XSS. Affected product: Froala WYSIWYG Editor - V3.2.6 Description: Under certain conditions, a base64 crafted string leads to persistent...
CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability-PoC
💻 CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability-PoC 🧩 Overview This project reproduces the MonikerLink behavior CVE-2024-21413 in a fully isolated TryHackMe environment to show how certain hyperlink formats can cause Outlook to process a link in a way that leaks...
CVE-2025-492026
Security Advisory: CVE-2025-492026 Summary A vulnerability has been identified in Copilot AI that causes an unintended hyperlink to be included in the "link source" section whenever Copilot retrieves a web query. This issue resulted in users clicking on links to https://www.collectingflags.com ev...
G Auto-Hyperlink <= 1.0.1 - SQL Injection
The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection id: CVE-2021-24627 info: name: G Auto-Hyperlink = 1.0.1 - SQL...
CVE-2025-492025
CVE-2025-492025 Security Advisory: CVE-2025-492025 Summary A vulnerability has been identified in Copilot AI that causes an unintended hyperlink to be included in the "link source" section whenever Copilot retrieves a web query. This issue resulted in users clicking on links to...
CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...
CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...
Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. WPF XPS hyperlink...
GHSA-F749-VHGX-39H6 Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. WPF XPS hyperlink...
CVE-2026-109290 Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...
CVE-2026-109290
Open WebUI versions 0.11.1 before 0.11.4 are susceptible to a stored cross-site scripting (XSS) vulnerability in the DocxPreview.svelte component. An authenticated attacker can execute arbitrary scripts by uploading a specially crafted DOCX attachment containing an OOXML altChunk HTML part or a s...
PT-2026-110707
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.11.1 through 0.11.3 Description Authenticated users can execute scripts by uploading crafted DOCX attachments. The issue resides in DocxPreview.svelte and occurs when attackers embed an OOXML altChunk HTML part or a...
GHSA-3753-M2X2-Q623 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
Summary Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer...
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
Summary Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer...
NPM: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
NPM: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer vulnerability discovered by ? in WordPress Npm msdoc-viewer versions = 0.2.1...
CVE-2026-91127 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...
EUVD-2026-83206
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...
CVE-2026-91127 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...
CVE-2026-91127 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...