A successful attack could be launched within any type of document that supports VBA , including Microsoft Word , Excel or PowerPoint .