Follina-CVE-and-CVE-2021-40444

Follina CVE および CVE-2021-40444 脆弱性の悪用 目次 1. はじめに 2. 前提条件 3. セットアップとインストール 4. 使用方法 5. 詳細な説明 6. コマンド 7. 免責事項 はじめに このリポジトリには、Microsoft Office における Follina CVE および CVE-2021-40444 脆弱性を悪用するためのスクリプトとリソースが含まれています。これらのスクリプトは、ターゲットシステム上で任意のコードを実行できる悪意のある文書ファイルを生成します。 前提条件 Flare VM Python 3.x Microsoft Word...

MSHTMHell

MSHTMHell：针对 CVE-2021-40444 的恶意文档构建器...

halogen

Halogen は、悪意のあるドキュメントに埋め込まれた画像ファイルに基づいて YARA ルールの作成を自動化するツールです。これは、サイバーセキュリティの専門家が悪意のある脅威に対する検出ルールを作成する際や、対応者が特定の脅威を識別する際に役立ちます。現在、Halogen は JPG および PNG ファイルに基づくルールを作成できます。 Halogen ヘルプ root@kitploit: python3 halogen.py -h usage: halogen.py -h -f FILE -d DIR -n NAME --png-idat --jpg-sos...

CVE-2026-57259

Technical details about CVE-2026-57259 are not publicly available in the provided documents; no product/version/root-cause information is present here. Monitor for updates.

CVE-2026-57259

The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to the parser. Malicious documents will construct malicious external entities that, through the protocol, point to local path...

CVE-2026-23863

An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of...

XmlNotepad 代码问题漏洞

XmlNotepad is an open-source XML document browsing and editing tool developed by Microsoft. Versions of XmlNotepad prior to 2.9.0.21 had code vulnerabilities. These vulnerabilities stemmed from the default setting of enabling DTD processing, which could lead to the disclosure of local file conten...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in several Office products. A malicious party can exploit the vulnerabilities to impersonate another user, grant themselves elevated privileges and/or execute arbitrary code and potentially gain access to sensitive data in the victim's context. Successful...

CVE-2025-69437

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can...

HotCRP Conference Review Software Cross-Site Script Vulnerabilities

HotCRP Conference Review Software is a software developed by Eddie Kohler. It is used to manage review processes, especially for academic conferences. The version of HotCRP Conference Review Software dated October 2025 to January 2026 contained a cross-site scripting vulnerability. This...

Microsoft Office zero-day lets malicious documents slip past security checks

Microsoft issued an emergency patch for a high-severity zero-day vulnerability in Office that allows attackers to bypass document security checks and is being exploited in the wild via malicious files. Microsoft pushed the emergency patch for the zero‑day, tracked as CVE-2026-21509, and classifie...

Exploit for CVE-2026-21509

🛡️ CVE-2026-21509 — Microsoft Office Zero-Day !OFFICEhttps...

NULL Pointer Dereference

Overview libxmljs is a libxml bindings for v8 javascript engine Affected versions of this package are vulnerable to NULL Pointer Dereference in the parsing process of specially crafted XML documents when accessing the ref property on entityref and entitydecl nodes. An attacker can cause a...

EUVD-2018-6224

Malware in sbrugna...

EUVD-2018-6220

Malware in sbrugna...

EUVD-2022-50175

Malicious code in bioql PyPI...

EUVD-2023-46195

Malicious code in bioql PyPI...

Confucius Hackers Hit Pakistan With New WooperStealer and Anondoor Malware

The threat actor known as Confucius has been attributed to a new phishing campaign that has targeted Pakistan with malware families like WooperStealer and Anondoor. "Over the past decade, Confucius has repeatedly targeted government agencies, military organizations, defense contractors, and...

GHSA-CMJC-QP7J-XGWR WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability

An authenticated stored Cross-Site Scripting XSS vulnerability exists in WSO2 API Manager components carbon-apimgt due to insufficient validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document whose...

A Decade-Long Landscape of Advanced Persistent Threats: Longitudinal Analysis and Global Trends

An advanced persistent threat APT refers to a covert, long-term cyberattack, typically conducted by state-sponsored actors, targeting critical sectors and often remaining undetected for long periods. In response, collective intelligence from around the globe collaborates to identify and trace...