9022 matches found
⚡ Weekly Recap — SharePoint Breach, Spyware, IoT Hijacks, DPRK Fraud, Crypto Drains and More
Some risks don't breach the perimeter—they arrive through signed software, clean resumes, or sanctioned vendors still hiding in plain sight. This week, the clearest threats weren't the loudest—they were the most legitimate-looking. In an environment where identity, trust, and tooling are all...
Microsoft SharePoint Zero-Day
Chinese hackers are exploiting a high-severity vulnerability in Microsoft SharePoint to steal data worldwide: The vulnerability, tracked as CVE-2025-53770, carries a severity rating of 9.8 out of a possible 10. It gives unauthenticated remote access to SharePoint Servers exposed to the Internet...
Exploit for Deserialization of Untrusted Data in Microsoft
CVE-2025-53770 This is a multiple site scanner for CVE-2025-53...
Exploit for Deserialization of Untrusted Data in Microsoft
SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-R...
Exploit for Deserialization of Untrusted Data in Microsoft
!Unk9-Logohttps://raw.githubusercontent.com/unk9vvn/unk9vvn.g...
Exploit for Deserialization of Untrusted Data in Microsoft
CVE-2025-53770 - Zero-day exploitation in the wild of Microsof...
ToolShell: Remote Code Execution in Microsoft SharePoint (CVE-2025-53770)
On July 19, 2025, a critical remote code execution RCE vulnerability CVE-2025-53770, also referred to as ToolShell was publicly disclosed, impacting on-premises Microsoft SharePoint Server installations. This vulnerability allows unauthenticated attackers to execute arbitrary code remotely by...
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were...
(Pwn2Own) Microsoft SharePoint ToolPane Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Microsoft SharePoint. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ToolPane endpoint. The application does not adequately restrict access to a...
(Pwn2Own) Microsoft SharePoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft SharePoint Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...
Exploit for Deserialization of Untrusted Data in Microsoft
OurSharePoint - CVE-2025-53770 PoC This is a simple C tool...
Exploit for Deserialization of Untrusted Data in Microsoft
SharePoint "ToolShell" RCE Exploit CVE-2025-53770 Overvi...
Storm-2603 Exploits SharePoint Flaws to Deploy Warlock Ransomware on Unpatched Systems
Microsoft has revealed that one of the threat actors behind the active exploitation of SharePoint flaws is deploying Warlock ransomware on targeted systems. The tech giant, in an update shared Wednesday, said the findings are based on an "expanded analysis and threat intelligence from our continu...
National Nuclear Security Administration Systems Breached in SharePoint Cyberattack
National Nuclear Security Administration and National Institutes of Health targeted in global Microsoft SharePoint vulnerability exploitation. Chinese hacking groups suspected in widespread data breaches...
Exploit for Deserialization of Untrusted Data in Microsoft
suricata-rule-CVE-2025-53770 Detection rules for CVE-2025-5377...
📄 SharePoint Remote Code Execution
This payload is an HTTP request example of the SharePoint remote code execution vulnerability being exploited in the wild. POST /layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:120.0 Gecko/20100101...
Microsoft SharePoint Remote Code Execution
Microsoft SharePoint Server Subscription Edition 16.0.18526.20508 or 2016 16.0.5513.1001 or 2019 16.0.10417.20037 is affected by a vulnerability that allows an unauthenticated attacker to execute arbitrary code through insecure deserialization. No source data...
Microsoft Put Older Versions of SharePoint on Life Support. Hackers Are Taking Advantage
Multiple hacking groups—including state actors from China—have targeted a vulnerability in older, on-premises versions of the file-sharing tool after a flawed attempt to patch it...
Imperva Customers Protected Against Critical “ToolShell” Zero‑Day in Microsoft SharePoint
A critical zero-day vulnerability in Microsoft SharePoint, tracked as CVE-2025-53770, is under active exploitation in the wild. The vulnerability, with a CVSS score of 9.8, impacts on-premises SharePoint Server 2016, 2019, and Subscription Edition, and allows unauthenticated remote code execution...