Xiaomi Mi Pad 4 Android 8.1 Kernel Privilege Escalation

Xiaomi Mi Pad 4 running Android 8.1, MIUI 10, and kernel version 4.4.78 is vulnerable to a local privilege escalation via the Binder use-after-free flaw. This proof of concept obtains root and deploys an optional SuperSU or Magisk root-management backend. https://packetstorm.news/download/239916...

Fortinet FortiOS 6.2.0 Configuration Backup Decryption

Fortinet FortiOS version 6.2.0, versions 6.0.0 through 6.0.6, and versions 5.6.10 and below use a hard-coded cryptographic key for sensitive ENC configuration data. This proof of concept decrypts supported fields from local plaintext CLI configuration exports...

WordPress Surfer 1.8.0.744 Broken Access Control

WordPress Surfer plugin versions through 1.8.0.744 contain a broken access control vulnerability that allows authenticated Subscribers to retrieve the stored API access key through a crafted profile-page request. https://packetstorm.news/download/239942...

WordPress Wp Social 3.2.3 Cross Site Request Forgery

WordPress Wp Social plugin versions through 3.2.3 contain a cross site request forgery flaw that lets an attacker cause a logged-in administrator to overwrite social-login provider settings. The proof of concept submits the affected settings form. https://packetstorm.news/download/239939...

WordPress PGALL for WooCommerce 5.5.17 Unauthenticated Settings Change

WordPress PGALL for WooCommerce plugin versions through 5.5.17 contain an unauthenticated settings-change vulnerability. The proof of concept obtains a public checkout nonce and replaces WooCommerce Direct bank transfer account details. https://packetstorm.news/download/239934...

Apache Axis2/Java 2.0.1 WS-Addressing Server-Side Request Forgery

Apache Axis2/Java version 2.0.1 and earlier contain a server-side request forgery vulnerability via WS-Addressing ReplyTo and FaultTo endpoints. A proof of concept demonstrates caller-selected server connections and decoupled response delivery. https://packetstorm.news/download/239924...

SQL::Abstract 2.000002 Array Reference SQL Injection

SQL::Abstract versions before 2.000003 contain a SQL injection vulnerability when request-controlled array references are passed to insert, update, or generate methods. The supplied proof of concept demonstrates data disclosure and privilege escalation in a containerized lab...

CivetWeb 1.16 HTTP/2 Use-After-Free

CivetWeb through version 1.16 contains an HTTP/2 use-after-free that retains stale pseudo-header pointers. The proof of concept uses HPACK dynamic-table manipulation to alter a later request's effective method, path, or header and demonstrate conditional access-control bypass...

JFrog Artifactory 7.133.10 Authentication Bypass / Privilege Escalation

JFrog Artifactory Self-Hosted versions before 7.133.11 contain a token scope-validation flaw that can be chained with the trailing-slash anonymous token issuance issue to obtain an administrator-scoped access token. https://packetstorm.news/download/239927...

WordPress eCommerce Product Catalog 3.6.4 Cross Site Scripting

WordPress eCommerce Product Catalog plugin versions through 3.6.4 contain an unauthenticated reflected cross site scripting vulnerability. The supplied proof of concept submits a crafted POST search term to demonstrate script execution. https://packetstorm.news/download/239940...

WordPress Transliterator 2.5.13 SQL Injection

WordPress Transliterator plugin versions through 2.5.13 contain an unauthenticated SQL injection vulnerability via the public name query variable. The proof of concept demonstrates a boolean-based blind database read. https://packetstorm.news/download/239938...

WordPress Blacklist Manager for WooCommerce 2.3.1 Cross Site Request Forgery

WordPress Blacklist Manager for WooCommerce versions through 2.3.1 contain a cross site request forgery vulnerability that can cause a logged-in administrator to create an attacker-controlled administrator account via a crafted request. https://packetstorm.news/download/239933...

CUPS-browsed 2.0.1 Printer Discovery Spoofing

CUPS-browsed version 2.0.1 accepts spoofed UDP printer-discovery announcements, causing it to contact an attacker-controlled printer URI. This proof of concept sends the announcement, captures the callback, and includes a detector. https://packetstorm.news/download/239931...

WordPress Easy Property Listings 3.5.25 Cross Site Scripting

WordPress Easy Property Listings versions through 3.5.25 contain an unauthenticated reflected cross site scripting vulnerability through the eplaction request parameter and search widget select field. https://packetstorm.news/download/239937...

Salt 3000.1 Authentication Bypass / Directory Traversal

Salt versions before 2019.2.4 and 3000.2 contain an authentication bypass and directory traversal vulnerabilities that can allow retrieval of the master root key, arbitrary file access, and command execution. This proof of concept communicates using Salt's ZeroMQ protocol...

Samsung Galaxy S25 FE S731USQS9BZF9 Bootloader Out-Of-Bounds Write

Samsung Galaxy S25 FE SM-S731U1 bootloader versions prior to SMR Nov-2026 Release 1 contain an out-of-bounds write reachable through an unsigned UPPARAM image. The proof of concept builds a replacement boot-logo archive and flashes it in download mode. https://packetstorm.news/download/239919...

Microweber CMS Before 1.1.20 Authentication Bypass

Microweber CMS versions before 1.1.20 contain an authentication bypass that permits unauthenticated disclosure of user database information. This proof of concept submits a request to the exposed users/controller module. https://packetstorm.news/download/239918...

WordPress Simply Schedule Appointments 1.6.12.29 Broken Access Control

WordPress Simply Schedule Appointments plugin version 1.6.12.29 and earlier contains an unauthenticated broken access control vulnerability that permits appointment data disclosure and unauthorized appointment modification or deletion. https://packetstorm.news/download/239936...

WordPress We're Open! 2.6 Unauthenticated Cross Site Scripting

WordPress We're Open! plugin versions through 2.6 contain an unauthenticated reflected cross site scripting vulnerability via the weareopenwpajax action. https://packetstorm.news/download/239941...

WordPress UsersWP 1.2.73 Cross Site Scripting

WordPress UsersWP versions through 1.2.73 contain an unauthenticated cross site scripting vulnerability in the superdupergetpicker AJAX action. A proof of concept is provided. https://packetstorm.news/download/239935...