LetsDefend-SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298

LetsDefend SOC336: Windows OLE Zero-Click RCE Exploitation Detected This repository documents my investigation of a LetsDefend alert involving a Windows OLE zero-click remote code execution exploit tied to CVE-2025-21298. The goal is to show the reasoning behind the conclusion, from email triage ...

CVE-2018-11761

Summary In a recent research on Apache Tika, I found a DOS Denial of Service vulnerability existed on its XML parser. It is caused that the parser improperly parses XML document. Affected Version Tested on ElasticSearch 6.3.1 using Tika 1.18 and 6.2.3 using Tika 1.17 Analysis As we know, the core...

CVE-2024-39929

Exim CVE-2024-39929 Exploit PoC This repository contains a Proof-of-Concept PoC script to exploit the Exim vulnerability CVE-2024-39929. The vulnerability affects Exim versions prior to 4.98, allowing attackers to bypass file extension blocking mechanisms and potentially deliver executable...

CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94278

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2024-21413

CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC 🚀 Usage Ensure you have appropriate permissions and authorization from the target system owner before using this script. Prerequisites Python 3.x impacket-smbserver Usage Example sudo python3 CVE-2024-21413.py 🛠️ Features...

User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

Zimbra Collaboration Suite - Cross-site Scripting

Cross-site scripting XSS vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite ZCS before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment. id:...

Docmost 0.2.1-0.21.0 - Arbitrary File Read

Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL. id: CVE-2025-57231 info: name: Docmost 0.2.1-0.21.0 - Arbitrary File Read author: anirbala98 severity: high...

netfence

Netfence Like Envoy xDS, but for eBPF filters. Netfence runs as a daemon on your VM/container hosts and automatically injects eBPF filter programs into cgroups and network interfaces, with a built-in DNS server that resolves allowed domains and populates the IP allowlist. Netfence daemons can be...

CVE-2023-47504-POC

CVE-2023-47504 POC Exploit for CVE-2023-47504. According to NIST, this vulnerability should allow unauthenticated users to access functionalities in the Elementor Website Builder Plugin. Based on my research into the vulnerability, and also judging by the URL from Patchstack that describes the...

CVE-2026-34213

CVE-2026-34213 A low-privileged Docmost user could supply a victim attachmentId to the generic upload endpoint and overwrite another page's stored attachment inside the same workspace. Intro I identified, responsibly disclosed, and reproduced a High-severity authorization flaw in Docmost , the...

CVE-2026-105633

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-105633

The open-source project management tool Plane is vulnerable to an authorization bypass in the V2 issue-attachment PATCH endpoint prior to version 1.4.0 . The root cause is that the server accepts an issue_id in the URL but fails to include it in the database query, matching only on pk, workspace,...

EUVD-2026-92547

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Proof of Concept: CVE-2024-42008 and CVE-2024-42010 This proof of concept PoC demonstrates the exploitation of two vulnerabilities in Roundcube Webmail that enable CSS injection and a cross-site scripting XSS. The attack consists of two stages: 1. XSS via malicious XML attachment CVE-2024-42008...

CVE-2025-32432

CVE-2025-32432 Craft CMS 사전 인증 RCE PoC Craft CMS의 치명적인 사전 인증 원격 코드 실행 영향: Craft CMS 3.x, 4.x 및 5.x 5.6.16까지 정보: 이 익스플로잇은 HackTheBox Orion 머신에서 테스트되었습니다. 개요 이 저장소는 CVE-2025-32432 에 대한 개념 증명 익스플로잇을 포함하고 있습니다. 이는 Craft CMS의 치명적인 사전 인증 원격 코드 실행 취약점입니다. 이 취약점은 인증되지 않은 공격자가 Yii2의 동작 첨부 메커니즘과 class 오버라이...

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

CVE-2025-65318-and-CVE-2025-65319

PoC for CVE-2025-65318 and CVE-2025-65319 CVE-2025-65318 BDU:2025-13740: When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of bo...