CVE-2025-30397
HIGH KEVMicrosoft Windows Scripting Engine - Remote Code Execution via Type Confusion
Title source: llmExploitation Summary
CVE-2025-30397 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 13, 2025. EIP tracks 4 public exploits from researchers including Mohammed Idrees Banyamer, mbanyamer, Leviticus-Triage.
AI-analyzed exploit summary This exploit leverages a Use-After-Free vulnerability in the JScript engine (jscript.dll) of Windows Server 2025 via heap spraying to achieve remote code execution. The shellcode executes calc.exe as a demonstration.
Description
Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
Exploits (4)
This exploit leverages a Use-After-Free vulnerability in the JScript engine (jscript.dll) of Windows Server 2025 via heap spraying to achieve remote code execution. The shellcode executes calc.exe as a demonstration.
This repository contains a functional proof-of-concept exploit for CVE-2025-30397, a Use-After-Free vulnerability in the JScript engine (jscript.dll) affecting Windows Server 2025. The exploit leverages heap spraying to achieve remote code execution, demonstrated by launching calc.exe via Internet Explorer 11.
The repository appears to be a framework for Chrome exploits but lacks actual exploit code for CVE-2025-30397. It contains extensive documentation, contribution guidelines, and placeholder structures but no functional PoC or technical details specific to the CVE.
This repository contains a functional exploit for CVE-2025-32433, targeting Erlang/OTP SSH. The exploit demonstrates pre-authentication command execution via crafted SSH packets, leveraging a vulnerability in the SSH protocol handling.
References (4)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H