Apache CXF 4.0.3 Aegis DataBinding Server-Side Request Forgery

Apache CXF versions before 4.0.4, 3.6.3, and 3.5.8 using Aegis DataBinding contain a server-side request forgery vulnerability. The included proof of concept demonstrates processing an XOP Include URL, which can expose local or internal resources. https://packetstorm.news/download/235030...

Apache Druid 0.20.0 Embedded JavaScript Remote Code Execution

Apache Druid versions 0.20.0 and earlier contain an embedded JavaScript execution issue that a crafted ingestion specification can use to execute commands on the server. A proof of concept is included. https://packetstorm.news/download/235029...

Apache APISIX 2.11.0 Default Admin Token Remote Command Execution

Apache APISIX version 2.11.0 uses a default administrative API token that permits route creation. A route script can execute commands, resulting in remote command execution. https://packetstorm.news/download/235028...

Apache CouchDB 2.1.0 Privilege Escalation

Apache CouchDB version 2.1.0 contains an access-control bypass caused by duplicate JSON roles fields, allowing creation of an administrative user. A proof of concept environment and exploitation details are provided. https://packetstorm.news/download/235023...

Apache Dubbo 2.7.3 HTTP Protocol Deserialization

Apache Dubbo version 2.7.3 HTTP protocol providers deserialize POST bodies with Java serialization, allowing a suitable gadget chain to execute commands. This submission supplies a vulnerable lab and proof of concept exploitation details. https://packetstorm.news/download/235019...

Apache HTTP Server 2.4.50 Path Traversal

Apache HTTP Server version 2.4.50 contains a path traversal vulnerability that may disclose files outside the document root and, with CGI enabled, permit command execution. This archive provides a deliberately vulnerable Docker environment and proof of concept requests...

Apache Solr 8.11.0 Log4j JNDI Injection

Apache Solr version 8.11.0 uses Log4j 2.14.1 and is vulnerable to JNDI lookup injection. The proof of concept environment demonstrates a crafted admin request triggering a remote JNDI lookup and possible code execution. https://packetstorm.news/download/235000...

Apache OFBiz 18.12.10 Authentication Bypass Remote Code Execution

Apache OFBiz version 18.12.10 contains an authentication bypass involving requirePasswordChange that exposes the WebTools ProgramExport Groovy runner to unauthenticated users, allowing command execution. A proof of concept vulnerable environment and request are included...

Apache Shiro 1.2.4 RememberMe Deserialization

Apache Shiro version 1.2.4 uses a hard-coded AES key for RememberMe cookies, allowing crafted serialized objects to trigger arbitrary command execution. This proof of concept supplies a vulnerable lab and reproduction details. https://packetstorm.news/download/234979...

Apache Solr 7.0.1 RunExecutableListener Remote Command Execution

Apache Solr version 7.0.1 contains a flaw where an unauthenticated Config API request can add a RunExecutableListener that executes a command when a core update is committed. The supplied proof of concept provides a containerized vulnerable lab and HTTP request sequence...

Apache Solr 8.3.1 Velocity Template Remote Code Execution

Apache Solr versions 5.0.0 through 8.3.1 contain a VelocityResponseWriter issue that permits command execution when an attacker can use the configuration API to enable parameter-provided templates. https://packetstorm.news/download/234977...

Apache Superset 2.0.1 Session Forgery

Apache Superset version 2.0.1 using a known default SECRETKEY allows session-cookie forgery and authentication as another user. This proof of concept verifies default keys, forges a selected user session, and can validate it. https://packetstorm.news/download/234971...

Apache Tomcat 8.5.19 Arbitrary File Write

Apache Tomcat version 8.5.19 with the Default Servlet readonly setting disabled allows HTTP PUT requests with crafted filenames to write JSP files to the web root. https://packetstorm.news/download/234969...

Apache Tomcat 9.0.30 AJP File Read

Apache Tomcat version 9.0.30 exposes an AJP connector that permits an unauthenticated client to use crafted request attributes to read files within deployed web applications. https://packetstorm.news/download/234968...

Apache Unomi 1.5.1 MVEL/OGNL Injection Remote Code Execution

Apache Unomi version 1.5.1 contains an MVEL and OGNL expression injection vulnerability that allows unauthenticated remote code execution through crafted context requests. Proof of concept included. https://packetstorm.news/download/234967...

Apache Log4j 2.14.1 JNDI Remote Code Execution

Apache Log4j version 2.14.1 contains a JNDI lookup vulnerability that can permit remote code execution. This proof of concept provides an isolated lab application, a harmless canary payload, and patch-validation evidence. https://packetstorm.news/download/234959...

Apache HugeGraph 1.7.0 SecurityManager Sandbox Bypass Remote Code Execution

Apache HugeGraph version 1.7.0 contains a SecurityManager sandbox bypass that allows unauthenticated remote command execution through the Gremlin endpoint. !/usr/bin/env bash Apache HugeGraph 1.7.0 Sandbox Bypass Remote Code Execution Vendor: The Apache Software Foundation Product web page:...

PT-2026-109171

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109125

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

PT-2026-109128

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...