CVE-1999-0487

DHTML Edit ActiveX - Info Disclosure

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-1999-0487. PoCs published by Georgi Guninsky.

AI-analyzed exploit summary The writeup describes multiple vulnerabilities in the DHTML Edit Control Safe for Scripting ActiveX control, including local file theft via upload manipulation, cross-frame security bypass, and spoofed transactions. These vulnerabilities affect Internet Explorer 4 and 5.

Description

The DHTML Edit ActiveX control in Internet Explorer allows remote attackers to read arbitrary files.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Georgi Guninsky · textremotewindows

https://www.exploit-db.com/exploits/19094

View Code ZIP pw:eip

The writeup describes multiple vulnerabilities in the DHTML Edit Control Safe for Scripting ActiveX control, including local file theft via upload manipulation, cross-frame security bypass, and spoofed transactions. These vulnerabilities affect Internet Explorer 4 and 5.

Classification

Writeup 90%

Attack Type

Info Leak | Auth Bypass

Complexity

Moderate

Reliability

Theoretical

Target: Internet Explorer 4 and 5 (DHTML Edit Control Safe for Scripting ActiveX control)

No auth needed

Prerequisites: Victim must visit a malicious website · ActiveX control must be enabled

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-011

Scores

EPSS 0.1329

EPSS Percentile 95.9%

Details

Status published

Products (2)

microsoft/internet_explorer 4.0

microsoft/internet_explorer 5.0

Published May 01, 1999

Tracked Since Feb 18, 2026