Tools

samy4samy/cve-2025-59287-wsus-2

Proof-of-concept exploit for CVE-2025-59287, a remote code execution vulnerability in Microsoft WSUS via unsafe deserialization. Sends crafted SOAP…

johnhammond/msdt-follina

Generates a malicious Microsoft Word document exploiting the MS-MSDT 'Follina' vulnerability to execute arbitrary commands or stage payloads via an…

maxprog-svg/cve-2026-55040-mass-exploit

Exploit for CVE-2026-55040 in Microsoft SharePoint, forging JWT tokens via algorithm none, weak HS256 secrets, and RS256 substitution to impersonate…

hypnguyen1209/cve-2026-63520

Exploit chain for unauthenticated RCE on Microsoft SharePoint, combining a JWT authentication bypass with unsafe .NET type instantiation to achieve…

mbanyamer/cve-2026-26030-microsoft-semantic-kernel-1.39.4-rce

Proof-of-concept exploit for CVE-2026-26030, demonstrating remote code execution via unsafe filter expressions in Microsoft Semantic Kernel's…

kimstars/ashwesker-cve-2026-21509

Proof-of-concept exploit for Microsoft Office security feature bypass (CVE-2026-21509). Generates malicious DOCX files with embedded OLE objects to…

hackfaiz/cve-2026-20841-poc

Proof of concept demonstrating command execution in Microsoft Notepad via crafted files, enabling arbitrary code execution and system compromise.

exploit-io/cve-2021-41349

Exploit tool for CVE-2021-41349 that generates an HTML form to deliver XSS payloads to Microsoft Exchange servers, enabling execution of arbitrary…

dogukankurnaz/cve-2026-20841-poc

Proof-of-concept demonstrating command injection in Windows Notepad via crafted Markdown links, enabling remote code execution. Includes attack…

simoesctt/sctt-2026-33-0007-the-ole-vortex-laminar-bypass-

Microsoft just released emergency patches for CVE-2026-21509, a zero-day in the Office Suite that bypasses OLE/COM mitigations when a user simply…

simoesctt/ctt-microsoft-office-ole-manifold-bypass-cve-2026-21509

Exploit for CVE-2026-21509, a Microsoft Office OLE validation bypass using a speculative race-condition technique to evade AMSI/EDR and achieve code…

maxymgorn/cve-2025-59287-exploit-poc

Proof-of-concept exploit for CVE-2025-59287, a critical unauthenticated RCE in WSUS via unsafe BinaryFormatter deserialization, achieving SYSTEM…

timb-machine-mirrors/testanull-cve-2021-42321_poc.py

Proof-of-concept exploit for CVE-2021-42321, demonstrating exploitation of a Microsoft Exchange Server vulnerability for security research and…

b1tbit/cve-2026-32201-exploit

Python exploit for CVE-2026-32201, a reflected XSS in Microsoft SharePoint Server, enabling unauthenticated spoofing and data modification via…

daddybigfish/cve-2025-59287-hawktrace

PoC for Remote Code Execution Vulnerability in Windows Server Update Service by Microsoft CVE-2025-59287 9.8 CRITICAL

hypnguyen1209/cve-2026-62911

Proof-of-concept exploit for CVE-2026-62911: pre-auth RCE on Microsoft Exchange via NTLM relay to MRSProxy, writing an ASPX webshell for SYSTEM…

sentinel-aidefense/cve-2026-69836-exp

CVE-2026-69836 — Unauthenticated RCE via Entra ID deserialization