CVE-2021-40444

PoC de CVE-2021-40444 Generador de docx malicioso para explotar CVE-2021-40444 Ejecución remota de código en Microsoft Office Word La creación de este script se basa en ingeniería inversa sobre la muestra utilizada en la naturaleza: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52...

CVE-2021-40444

CVE-2021-40444 Uso Asegúrate de ejecutar primero setup.sh, ya que necesitarás algunos directorios. Una vez que hayas ejecutado el script, deberías poder ejecutar gen.py con el siguiente ejemplo:- Usage python3 gen.py -d document/Sample.docx -p payload/payload.dll -i "http://10.10.10.10" -t...

CVE-2021-40444_builders

Builders de CVE-2021-40444 Este repositorio contiene builders del archivo cab, del archivo html y del archivo docx para el exploit CVE-2021-40444. Este repositorio es solo para pruebas, investigación y fines educativos. Eres responsable del uso que le des al código proporcionado en este...

CVE-2022-30190

CVE-2022-30190 Uso solo Windows Crear archivo docx: $ PoC.py docx your-host-ip Ejecutar servidor directamente: $ PoC.py host...

CVE-2022-30190

CVE-2022-30190 CVE-2022-30190 CVE-2022-30190 Follina POC Aloja exploit.html en localhost, puerto 80. Abre el docx para que aparezca la calculadora. Para cambiar la dirección remota a la que apunta el documento, ábrelo en 7Z y edita word\rels\document.xml.rels para que apunte a una nueva ubicación...

CVE-2025-65482: Improper Restriction of XML External Entity Reference

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

CVE-2025-65482

The opensagres XDocReport library (versions v0.9.2 to v2.0.3 ) contains an XML External Entity (XXE) vulnerability within the fr.opensagres.xdocreport.document.docx component. The root cause is the use of a SAXParser to process uploaded .docx files without disabling DTDs or external entities. Att...

CVE-2019-16338

The tfocommon component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file...

EUVD-2019-7115

Malware in sbrugna...

EUVD-2023-31861

Malicious code in bioql PyPI...

EUVD-2023-31862

Malicious code in bioql PyPI...

EUVD-2023-31863

Malicious code in bioql PyPI...

Microsoft Excel Use After Free - Local Code Execution

Titles: Microsoft Excel Use After Free - Local Code Execution Author: nu11secur1ty Date: 06/09/2025 Vendor: Microsoft Software: https://www.microsoft.com/en/microsoft-365/excel?market=af Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27751 Versions: MS Excel 2016, MS Office...

📄 Microsoft Excel Remote Code Execution

Microsoft Excel appears to suffer from a remote code execution vulnerability via a malicious macro. Titles: Microsoft Excel Local Code Execution Vulnerability Author: nu11secur1ty Date: 06/09/2025 Vendor: Microsoft Software: https://www.microsoft.com/en/microsoft-365/excel?market=af Reference:...

CVE-2023-28150

An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity XXE injection via a remote DTD in a DOCX file...

CVE-2023-28151

An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity XXE injection via a remote DTD in a DOCX file...

CVE-2023-28152

An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity XXE injection via a remote DTD in a DOCX file...

CVE-2020-11536

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server...

CVE-2020-11534

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass parameters to a binary such as curl or wget and remotely execute code on a victim's server...

CVE-2025-0184

A Server-Side Request Forgery SSRF vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests...