SharePoint ToolPane Register Directive Injection (CVE-2026-65660)
Detects an exploitation attempt targeting SharePoint through the EditingPageParser by injecting a Register directive. This attempt involves bypassing SafeControls through specifically crafted HTTP POST requests to ToolPane.aspx, utilizing the GetPartPreviewAndPropertiesFromMarkup function to execute malicious tag patterns.
Suricata
