CVE-2024-21413

CVE-2024-21413 - Expect 脚本 POC Microsoft Outlook 凭据泄露及远程代码执行漏洞，当与 CVE-2023-21716 配合使用时（通过预览面板） CVSS:3.1 9.8 / 8.5 Outlook 应该会警告你打开外部链接的风险 = 但实际情况并非如此！ 用法：./cve-2024-21413.sh mx.fqdn 端口 发件人 收件人 url ./cve-2024-21413.sh mail.mydomain.com 25 [email protected] [email protected]...

PT-2026-59400

Summary Open WebUI renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML. Because Mermaid is configured with securityLevel: 'loose', attacker-controlled Mermaid content can be rendered unsafely in this flow. A working paylo...

Exploit for CVE-2025-57520

PoC exploit for CVE-2025-57520, a stored cross-site scripting X...

Exploit for Improper Input Validation in Microsoft

CVE-2024-21413 - Expect Script POC Microsoft Outlook Leak cre...

Cross site scripting

In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor with write access as well load the same page into the Markdown editor, the XSS payload will be...

CVE-2020-11051: Improper Neutralization of Input During Web Page Generation

In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor with write access as well load the same page into the Markdown editor, the XSS payload will be...

Microsoft Windows TrueType Font (TTF)远程代码执行漏洞（MS12-078)

BUGTRAQ ID: 56842 CVECAN ID: CVE-2012-4786 Microsoft Windows是Microsoft开发的Windows是目前世界上用户最多、并且兼容性最强的操作系统。 Microsoft Windows未正确处理TrueType Font TTF文件而存在安全漏洞。通过诱使用户浏览恶意网站或打开恶意文件，未经身份验证的远程攻击者可利用此漏洞在内核态中执行任意代码。 0 Microsoft Windows RT Microsoft Windows 8 Microsoft Windows 7 Microsoft Windows XP...

CVE-2004-0726: Undefined Security Weakness

The Windows Media Player control in Microsoft Windows 2000 allows remote attackers to execute arbitrary script in the local computer zone via an ASX filename that contains javascript, which is executed in the local context in a preview panel...