341657 matches found
PHP 8.4.26 Session Upload Progress Remote Code Execution
PHP version 8.4.26 contains an issue involving requestparsebody and session upload-progress handling. This proof of concept demonstrates chained unauthenticated remote code execution in a lab application and contrasts the behavior with PHP 8.4.27. https://packetstorm.news/download/236981...
PHP 8.5.11 OOM Corruption Remote Code Execution
PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory corruption issue in Apache modphp that can result in remote code execution. This proof of concept demonstrates the issue in PHP version 8.2.6 using a local Docker environment. https://packetstorm.news/download/237033...
PT-2026-121596
Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A command injection issue exists in the PAPI protocol, which is used for access point management. An unauthenticated attacker can achieve remote code execution by sending specially crafted...
PT-2026-121629
Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description Command injection flaws exist that allow unauthenticated remote code execution. An attacker can achieve this by sending specially crafted PAPI packets, enabling the execution of arbitrary code ...
CVE-2021-48014: Improper Limitation of a Pathname to a Restricted Directory
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer designsavesvg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...
PT-2026-121586
Name of the Vulnerable Software and Affected Versions AOS-10 affected versions not specified Description Buffer overflow issues in the affected interface allow an unauthenticated attacker to achieve remote code execution by sending specially crafted packets. A successful attack enables the...
VulnCheck KEV: CVE-2026-87855
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage function. This is due to the startSession function accepting an empty jtlauth parameter as a valid credential, combined with insufficient fil...
Microsoft Access Code Execution
The vulnerability of Microsoft Access database management systems, as well as Microsoft Office and 365 Apps for Enterprise applications, is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...
Microsoft Visual Studio Code Editor Code Execution
The vulnerability of Microsoft Visual Studio Code’s editor is related to the lack of measures taken at the control level to clean up data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PHP OOM and Stale Global State Verification
PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain OOM corruption and stale global state flaws that can enable remote code execution. This tool provides local condition-verification harnesses...
HPE ArubaOS security vulnerabilities
A security vulnerability exists in HPE ArubaOS. It stems from a buffer overflow flaw in affected interfaces, enabling unauthorized remote code execution. Successful exploitation allows attackers to execute arbitrary code with privileged user privileges on the underlying operating system, resultin...
HPE ArubaOS security vulnerabilities
HPE ArubaOS 8 contains a buffer overflow vulnerability. This vulnerability stems from a buffer overflow in affected interfaces and may lead to unauthenticated remote code execution. Attackers can execute arbitrary code as a privileged user on the underlying operating system...
Microsoft Azure Pipelines command injection vulnerability
Microsoft Azure Pipelines has a command injection vulnerability. This vulnerability stems from improper neutralization of special elements within commands, potentially allowing unauthenticated attackers to execute code over the network...
PHP 8.5.11 Remote Code Execution
PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain a remote code execution issue. This Bash tool checks for CVE-2026-109618 patches, updates system packages, and restarts active Apache or PHP-FPM services...
HPE ArubaOS security vulnerabilities
HPE ArubaOS 8 has a security vulnerability stemming from the sending of specially crafted PAPI packets. This can lead to unauthenticated remote code execution, potentially allowing attackers to execute arbitrary code as a privileged user on the underlying operating system...
Important: php8.3
Issue Overview: PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup...
PT-2026-121737
Name of the Vulnerable Software and Affected Versions NoMachine nxwebrunner affected versions not specified Description A heap-based buffer overflow exists in the web service that listens on TCP port 4443 by default. The issue occurs because the service fails to properly validate the length of...
CVE-2026-51954
An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirecturi...
PHP 8.5.11 session.upload_progress Remote Code Execution
PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain session.uploadprogress state-corruption vulnerabilities that may permit unauthenticated remote code execution. This proof of concept exercises upload-progress and out-of-memory failure paths, with optional LFI-assisted command...
