Client-Side — PoC Archivehttps://poc.intelseclab.com/tags/client-side/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000BentoPDF Stored XSS to File Exfiltration (CVE-2026-41653)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41653-bentopdf-stored-xss-exfil/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41653-bentopdf-stored-xss-exfil/Critical severity — web · CVE-2026-41653. Status: PoC. Affects: BentoPDF (self-hosted browser-side PDF toolbox). Tags: xss, stored-xss, file-exfiltration, client-side, service-worker, wasm-hijack, pdf-toolbox, markdown-injection.webCriticalxssstored-xssfile-exfiltrationclient-sideservice-workerwasm-hijackpdf-toolboxmarkdown-injectionOpenVPN Connect Server-Pushed Option Current-User Command Executionhttps://poc.intelseclab.com/pocs/network/2026-07-03_openvpn-connect-server-pushed-option-ace/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_openvpn-connect-server-pushed-option-ace/High severity — network · None assigned as of 2026-07-03. Status: PoC. Affects: OpenVPN Connect for Windows. Tags: openvpn, openvpn-connect, malicious-vpn-server, command-execution, script-permission-bypass, pushed-options, windows, client-side.networkHighopenvpnopenvpn-connectmalicious-vpn-servercommand-executionscript-permission-bypasspushed-optionswindowsclient-side