CVE-2023-36884-MS-Office-HTML-RCE

CVE-2023-36884：利用特制文档实现 MS Office HTML 远程代码执行 2023年7月11日，微软发布了一个补丁，旨在解决多个正在被积极利用的远程代码执行（RCE）漏洞。此次行动还揭露了一场由名为 Storm-0978 的威胁行为者策划的网络钓鱼攻击活动，该活动专门针对欧洲和北美的组织。这场攻击活动的核心是一个被指定为 CVE-2023-36884 的零日漏洞，该漏洞允许攻击者通过精心构造的 Office Open XML（OOXML）文档利用 Windows...

JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler plgajaxhelix3 accessible via the Joomla comajax component. The onAjaxHelix3 plugin method processes dataaction=save requests without any authentication check or CSRF token validation...

Campaign Monitor for WordPress - Information Disclosure

Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled displayerrors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires displayerrors to be...

frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

Malicious code in trongridi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103 The package exposes a single public function permprivatekey that POSTs the caller-supplied TRON wallet private key as JSON to the hardcoded endpoint...

LetterPress-1.2.1-Open-Redirection-Via-Html-Injection-Vulnerability

漏洞标题：LetterPress CLICK THIS"，然后点击“Save Campaign”（保存营销活动）。 2. 查看该营销活动，点击“CLICK THIS”超链接，它将重定向到第三方站点。（例如：evil.com）...

CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit

CVE-2025-61882 - Exploit RCE Pre-Auth de Oracle E-Business Suite Una vulnerabilidad crítica de Ejecución Remota de Código RCE sin autenticación previa en Oracle E-Business Suite versiones 12.2.3–12.2.14 permite a los atacantes obtener control total sobre servidores vulnerables mediante solicitude...

BlackLotus-Detection

CVE-2022-21894 关于 CVE-2022-21894 的公开仓库 主页面 https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ Windows Defender 现在能够移除此威胁“可能易受攻击的 EFI 引导加载程序” 基础检测 挂载指定驱动器的 EFI 系统分区。 $ mountvol /s 搜索存在异常时间戳的 .efi 文件 $ dir...

Cartero

Cartero Cartero现在是一个Go CLI，内置无需配置的工作区数据库，取代了旧版依赖MongoDB的运行时。 当前实现提供： 由Cobra和Lip Gloss驱动的精美终端体验 通过cartero serve运行的本地管理Web UI和安全测试页面 默认安全的战役验证和预览命令 位于.cartero/cartero.sqlite的嵌入式SQLite工作区存储 用于模板种子、克隆导入、受众同步、分析导出和交互记录的第一方插件 从CSV、JSON、SARIF和JSONL导入规范化发现 单向旧版Mongo导出迁移到当前工作区 单元测试、CLI测试和一致性测试，带有冒烟测试工作流...

APT_REPORT

APTREPORT 由 @blackorbird 收集 https://x.com/blackorbird 收集有趣的 APT 报告 & 样本 & 恶意软件 & 技术 & 情报 按国家/地区划分的 APT 组织 Palo Alto Networks Unit 42 追踪的威胁行为者组织 https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/ 样本 Group123 ▶ScarCruft 持续演进，引入蓝牙收集器...

vulnerabilities in Adobe Campaign Classic

Adobe has identified several vulnerabilities in Adobe Campaign Classic. These vulnerabilities involve Server-Side Request Forgery SSRF and OS Command Injection. The SSRF vulnerability allows attackers to manipulate requests on the server, which can lead to the execution of arbitrary code without...

CVE-2026-78138 Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

WordPress Finale Lite plugin < 2.21.0 - Subscriber+ Campaign Configuration Disclosure vulnerability

Subscriber+ Campaign Configuration Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Finale Lite versions 2.21.0...

CVE-2026-78138

CVE-2026-78138 is a missing capability check in the Finale Lite WordPress plugin (versions

MAL-2026-15614 Malicious code in ndmfguyhoxc3 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15617 Malicious code in skxcmwuncbg2 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15616 Malicious code in ndmxchdjxn2 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

CVE-2026-76197

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

CVE-2026-76195

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

CVE-2026-76193

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...