CVE-2002-2308: Undefined Security Weakness

Netscape Communicator 6.2.1 allows remote attackers to cause a denial of service in client browsers via a webpage containing a recursive META refresh tag where the content tag is blank and the URL tag references itself...

CVE-2002-2313: Undefined Security Weakness

Eudora email client 5.1.1, with "use Microsoft viewer" enabled, allows remote attackers to execute arbitrary programs via an HTML email message containing a META refresh tag that references an embedded .mhtml file with ActiveX controls that execute a second embedded program, which is processed by...

CVE-2006-4909: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Cisco Guard DDoS Mitigation Appliance before 5.16, when anti-spoofing is enabled, allows remote attackers to inject arbitrary web script or HTML via certain character sequences in a URL that are not properly handled when the appliance sends a meta-refresh...

CVE-2002-2308

Netscape Communicator 6.2.1 allows remote attackers to cause a denial of service in client browsers via a webpage containing a recursive META refresh tag where the content tag is blank and the URL tag references itself...

Code execution via Eudora

Using META REFRESH it's possible to launch mhtml file...

REFRESH: EUDORA MAIL 5.1.1

Tuesday, July 23, 2002 Trivial silent delivery and installation of an executable on a target computer. This can be accomplished with the default installation of the mail client Eudora 5.1.1: 'allow executables in HTML content' DISABLED 'use Microsoft viewer' ENABLED The manufacturer...

Выполнение приложений через Microsoft Internet Explorer для Macintosh (code execution)

Можно выполнить служебный системный скрипт через META REFRESH. Или через файл с образом диска...

netscape-4.x-DoS.txt

Date: Sun, 6 Sep 1998 00:53:24 +0200 From: Michal Zalewski To: [email protected] Subject: Sendmail, lynx, Netscape, sshd, Linux kernel twice Now, some DoSes on Netscape 4.0x browsers: ------------------------------------------ Meta refresh or href to URL "mocha:document.open'300k times A';"...

CVE-2026-48761: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content

More info at https://symfony.com/cve-2026-48761...