CVE-2021-41349

CVE-2021-41349 Exploit! Microsoft Exchange Server Spoofing Vulnerability Exploit! Step To Reproduce! 1. Make A HTTP Request Like This & Capture On Burp 2. Make A CSRF PoC Of That Request & Save The HTML Output Into A File 3. Open The Saved Output In A Browser & Boom Or Use The HTML File Given &...

CVE-2023-21716-POC

History In February 2023, Microsoft patched a critical vulnerability in Microsoft Word, identified as CVE-2023-21716 with a CVSS score of 9.8, which could allow attackers to execute remote code without authentication. This vulnerability also affected the Outlook Preview Pane, meaning it can be...

2017-11882_Generator

CVE-2017-11882 Microsoft Office 软件在处理内存中的对象时存在一个远程代码执行漏洞。成功利用此漏洞的攻击者可以在当前用户上下文中运行任意代码。 2017-11882Generator 这是从 Embedi 制作的原始 PoC 重新编辑而来的，用于生成包含远程命令执行的单个 .rtf 文件。 使用方法 python 2017-11882Generator.py -x commandtoexecute -o outputfilename 示例： python 2017-11882Generator.py -x "cmd /c calc" -o test.rtf...

CVE-2021-26855-SSRF-Exchange

CVE-2021-26855-SSRF-Exchange CVE-2021-26855 SSRF Exchange Server Shodan https://beta.shodan.io/search?query=http.component%3A%22outlook+web+app%22 https://beta.shodan.io/search?query=http.html%3A%22%2Fowa%22 Fofa https://fofa.so/result?q=title%3D%22Outlook+Web+App%22...

CVE-2021-26855-d

Basic usage:python owamails.py -u -l -p optional arguments: -h, --help show this help message and exit -u URL, --url URL Url, provide schema and not final / eg https://example.org -l LIST, --list LIST Users mailbox list -p PATH, --path PATH Path to write emails in xml format -f FQDN, --fqdn FQDN...

CVE-2023-36802

CVE-2023-36802 CVE-2023-36802 ITW case Explain Using PreviousMode overwrite primitive https://cwresearch.tistory.com/entry/Microsoft-Streaming-Service-Proxy-Elevation-of-Privilege-Vulnerability-CVE-2023-36802 Thanks to chompie Google Project 0...

CVE-2023-23397_EXPLOIT_0DAY

CVE-2023-23397EXPLOIT0DAY Exploit for the CVE-2023-23397 Credit to domchell EML/MSG Checker for the exploit: !/usr/bin/env python3 from extractmsg import AppointmentMeeting from ..helpers import Status from ..task import Task from ..report import Report from .base import BaseWorker class...

CVE-2023-23397_EXPLOIT

CVE-2023-23397 MS Outlook Vulnerability Exploitation CVE-2023-23397 is a vulnerability in Microsoft Outlook that allows an attacker to potentially exfiltrate user authentication details. The vulnerability stems from the ability of an attacker to specify a Universal Naming Convention UNC path in t...

cve-2023-23397

CVE-2023-23397 This script allows to create TNEF-encoded Outlook e-mails with CVE-2023-23397 exploit payload and send them via pure SMTP - no need in COM objects or EWS. I could not get IPM.Schedule.Meeting.Request message class to work properly it generates both meeting and the reminder but does...

CVE-2018-8495-POC

CVE-2018-8495 POC Simple poc of CVE-2018-8495 Microsoft Edge Remote Code Execution saurce : https://leucosite.com/Microsoft-Edge-RCE/...

ProxyLogon-CVE-2021-26855

ProxyLogon-CVE-2021-26855 RCE exploit for ProxyLogon vulnerability in Microsoft Exchange Working with Python 3.9 Usage: python proxylogonrce.py target email command Example: python proxylogonrce.py 192.168.227.137 [email protected] whoami All credits go to DEVCORE, based on...

follina

follina POC All about CVE-2022-30190, aka follina, that is a RCE vulnerability that affects Microsoft Support Diagnostic Tools MSDT on Office apps such as Word. This is a very simple POC, feel free to check the sources below for more threat intelligence. Usage usage: follina.py -h --command COMMA...

cve-2020-0796

Identifying and Mitigating the CVE-2020–0796 flaw in the fly CVE-2020–0796, is pre-remote code execution vulnerability that resides in the Server Message Block 3.0 SMBv3 network communication protocol, which Microsoft will not address the issue as the part of the March 2020 Tuesday. Usage python3...

CVE-2023-21707

CVE-2023-21707 Exchange deserialization payload generation .\ConsoleApp1.exe "calc"...

EUVD-2026-92421

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

CVE-2026-69836-EXP

CVE-2026-69836 Entra ID: Prueba de Concepto de RCE No Autenticado Resumen CVE-2026-69836 es una vulnerabilidad crítica de ejecución remota de código no autenticada en Microsoft Entra ID debida a la deserialización inadecuada de datos no confiables CWE-502. La falla permite a los atacantes ejecuta...

CVE-2026-104808

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The specific flaw exists within the web portal listening...

CVE-2026-104808 Mitel MiVoice Office 400 stored Cross-Site Scripting

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The specific flaw exists within the web portal listening...

EUVD-2026-92298

DigitalCanion has discovered a stored Cross-Site Scripting XSS vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The specific flaw exists within the web portal listening...

CVE-2026-105250

A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decodemsima of the file src/coding/imadecoder.c of the component Microsoft IMA Decoder. Such manipulation leads to divide by zero. The attack can be executed remotely...