OffensiveVBA

OffensiveVBA In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away...

Office-Malware-Forensics-Lab-REMnux-Static-Analysis

Office Malware Forensics Lab — REMnux Static Analysis Static analysis of two malicious Office files, done entirely inside an isolated REMnux VM. Nothing was ever executed — just inspected. Setup REMnux VM, no shared folders with the host Tools: sha256sum, file, unzip, and the oletools suite oleid...

CVE-2021-40444

EXP Ladon CVE-2021-40444 Office Vulnerability Exploitation Vulnerability Overview On September 8th Beijing time, NSFOCUS CERT monitored that Microsoft released a security advisory disclosing the Microsoft MSHTML remote code execution vulnerability. Attackers can craft malicious ActiveX controls f...

halogen

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing...

CVE-2022-30190

Exploitation of Follina CVE-2022-30190 Follina CVE-2022-30190 is a critical remote code execution RCE vulnerability that affects the Microsoft Support Diagnostic Tool MSDT. This flaw was originally discovered through a malicious file detected on VirusTotal and was named by researcher Kevin...

archiver-MOTW-support-comparison

Comparison of MOTW Mark of the Web propagation support of archiver software for Windows English | Japanese Background On 3 March 2022, Microsoft announced that the default behavior of Office applications on Windows will be changed to block macros in files from the internet such as email attachmen...

CVE-2022-30190

CVE-2022-30190 Follina Proof of Concept Overview This project demonstrates a proof-of-concept exploit for CVE-2022-30190, also known as "Follina" —a critical remote code execution vulnerability affecting Microsoft Office via the MSDT protocol. The application generates malicious Office documents ...

backdoorppt

backdoorppt - 'Herramienta de suplantación de extensiones de Office' Versión lanzada: v1.7-Stable Autor: pedro ubuntu r00t-3xp10it Distribuciones soportadas: Linux Kali, Ubuntu, Mint Suspicious-Shell-Activity© SSA RedTeam develop @2017 Transforma tu payload.exe en un falso documento de word .ppt...

CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

CVE-2026-108750

The OpenDocMan application versions 2.4.0 through 2.10.0 is vulnerable to a decompression bomb (CWE-409) during the upload text extraction process. This flaw allows authenticated users to exhaust PHP memory by uploading small, specially crafted ODT, DOCX, or XLSX files. When processed, the XML en...

CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

vet

vet: File Triage & Artifact Extraction !CIhttps://github...

CVE-2026-64909

Microsoft Office is affected by CVE-2026-649909 due to an integer underflow, enabling local code execution. The root cause is a wrap/wraparound flaw in an Office component, with the impact described as local RCE. No specific affected versions or patches are provided in the supplied documents. Exp...

CVE-2026-63524 Microsoft Office Information Disclosure Vulnerability

...

CVE-2026-65661

Microsoft Office is affected by CVE-2026-65661 due to a heap-based buffer overflow that allows an attacker with local access to execute code on a vulnerable system. The CVSS 3.1 vector indicates a Local attack with user interaction required and a High impact on confidentiality, integrity, and ava...

CVE-2026-39904

Gophish 0.12.1 is affected by a denial-of-service in the ApplyTemplate() path that processes Office documents as ZIP archives. The vulnerability arises from ioutil.ReadAll() on each file entry without sized limits, enabling a zip-bomb payload to cause several gigabytes of in-memory expansion and ...

[SECURITY] Fedora 43 Update: python-wsgidav-4.3.4-1.fc43

A generic and extendable WebDAV server written in Python and based on WSGI. Main features: =E2=80=A2 WsgiDAV is a stand-alone WebDAV server with SSL support, that can be installed and run as Python command line script. =E2=80=A2 The python-pam library is needed as extra requirement if pam-login...

CVE-2026-46722 XML External Entity Injection in extension "Faceted Search" (ke_search)

The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index...

EUVD-2025-209090

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided...

ALPINE-CVE-2025-59031

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided...