Grav CMS 1.10.7 Unauthenticated Remote Code Execution

Grav CMS version 1.10.7 and earlier contain an unauthenticated arbitrary YAML write issue in the Admin component that can create a scheduled task and execute arbitrary PHP code. This proof of concept demonstrates remote code execution. https://packetstorm.news/download/238922...

Node.js 26.12.0 Brotli Decoder Remote Code Execution

Node.js versions 22.x, 24.x, and 26.x contain an out-of-bounds write in the Brotli decoder that may permit remote code execution when an application decompresses attacker-controlled Brotli data. https://packetstorm.news/download/238907...

LMCache 0.5.5 Multiprocess Transport Remote Code Execution

LMCache versions 0.3.9 through 0.5.5 contain an unauthenticated pickle deserialization flaw in the multiprocess ZeroMQ transport that allows remote code execution. https://packetstorm.news/download/238913...

Chatwoot 4.15.0 Unauthenticated Arbitrary Blob Creation

Chatwoot versions before 4.16.0 contain an authentication bypass in the conversation direct uploads controller that lets unauthenticated attackers create ActiveStorage blobs and obtain signed URLs to write arbitrary data to the configured storage backend. https://packetstorm.news/download/238921...

Copyparty 1.8.1 Path Traversal

Copyparty version 1.8.1 and prior versions contain a path traversal vulnerability in the /.cpr endpoint that allows unauthenticated retrieval of files accessible to the service. https://packetstorm.news/download/238906...

Gitea 1.27.0 Diffpatch Git Hook Remote Code Execution

Gitea versions 1.17.0 through 1.27.0 contain a diffpatch API flaw that enables repository writers to install and execute a Git hook as the service account. This proof of concept demonstrates the issue. https://packetstorm.news/download/238912...

TP-Link Archer AX17 v1 VPN Client Import Command Injection

TP-Link Archer AX17 v1 versions before 1.5.0 Build 20260605 contain an authenticated OS command injection in VPN client import functionality. An administrative LAN session can import a crafted OpenVPN profile to execute commands as root. https://packetstorm.news/download/238911...

Brotli 1.2.0 Decoder Heap Out-Of-Bounds Write

Brotli versions 1.0.3 through 1.2.0 contain a heap out-of-bounds read and write in the streaming decoder. Included proof of concept Brotli streams trigger the block-switch parsing flaw. https://packetstorm.news/download/238923...

cloudveil-sunshine

No d...

Fortinet FortiNAC keyUpload Cron RCE (CVE-2022-39952)

Horizon3 PoC: unauthenticated POST to /configWizard/keyUpload.jsp with a ZIP placing a cron job under /etc/cron.d/. Use a CMD reverse payload. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2022-39952 — Fortinet FortiNAC arbitrary file write via keyUpload.jsp Horizon3. Uploads a ZIP whose entr...

FortiSIEM SendQueryResult RCE (CVE-2026-106173)

CVE-2026-106173 Horizon3: unauthenticated SendQueryResult gRPC write to /opt/charting/redishb.sh with CMD payload; phxctl.service executes within 1 min. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-106173 — FortiSIEM gRPC file write → delayed RCE via phxctl.service. """ from future impo...

osTicket CVE-2026-22200 Patch Detect

Unauthenticated checks from Horizon3 check.py: login username pre-validation v1.18.3+/v1.17.7+ patch and optional open.php HTML srcset stripping. Full CNEXT RCE chain is not bundled — file read alone does not yield a session. !/usr/bin/env python3 -- coding: utf-8 -- """Detect osTicket...

FortiSIEM Phoenix Monitor RCE (CVE-2025-64155)

CVE-2025-64155 Horizon3: Phoenix Monitor clusterurl injection writes CMD payload to /opt/charting/redishb.sh; phxctl.service runs within 1 min. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2025-64155 — FortiSIEM Phoenix Monitor clusterurl injection → delayed RCE. Reference:...

Palo Alto Expedition Cron RCE (CVE-2024-9464)

Horizon3 chain for CVE-2024-9464: unauthenticated admin password reset CVE-2024-5910 then cron starttime injection to wget and execute an attacker-hosted script. Supports framework CMD payloads reverse shell. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2024-9464 — Palo Alto Expedition admin...

Apache Superset CVE-2023-27524 Default Secret Detect

Horizon3: verifies the session cookie is signed with a known default Flask SECRETKEY. Requires optional flask-unsign package. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Superset default Flask SECRETKEY CVE-2023-27524, Horizon3.""" from future import annotations import re from...

SolarWinds Web Help Desk Ticket Read (CVE-2024-28987)

Horizon3 PoC: default helpdeskIntegrationUser Basic auth on /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets — data read only. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2024-28987 — SolarWinds Web Help Desk hardcoded API credentials Horizon3. Auxiliary: reads Orion tickets via Basic auth...

FortiSIEM Phoenix Monitor Port Probe (CVE-2025-64155)

Checks whether TCP 7900 Phoenix Monitor TLS is reachable on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FortiSIEM Phoenix Monitor TLS port CVE-2025-64155.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner,...

FortiSIEM SendQueryResult Arbitrary File Write (CVE-2026-106173)

CVE-2026-106173: unauthenticated path traversal and embedded NUL in SendQueryResult gRPC/HTTP/2, TCP 27918. Overwrite or create arbitrary files — blind, no session. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-106173 — FortiSIEM unauthenticated arbitrary file write blind. Auxiliary:...

Ivanti Sentry MICSLog RCE (CVE-2023-38035)

Horizon3: unauthenticated Hessian uploadFileUsingFileInput on /mics/services/MICSLogService with root command execution. Uses framework HTTP/Hessian client proxy-aware. CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2023-38035 — Ivanti Sentry MICSLogService Hessian command injecti...

FortiSIEM gRPC HTTP/2 Probe (CVE-2026-106173)

Probes FortiSIEM gRPC TCP 27918: TLS with ALPN h2 or plaintext HTTP/2. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FortiSIEM gRPC surface CVE-2026-106173.""" from kittysploit import from lib.protocols.http2.http2client import Http2client from lib.protocols.tcp.tcpscannerclient import...