PHP Session Upload Progress Remote Code Execution

PHP session upload progress can permit attacker-controlled object deserialization when an application uses phpbinary or phpserialize and switches to the php serializer before sessionstart. Included proof of concept demonstrates the serializer-switch condition and a session-file LFI lab...

Marimo 0.20.4 Pre-Auth Remote Code Execution

Marimo version 0.20.4 and earlier contains an authentication bypass in the terminal WebSocket endpoint that allows unauthenticated remote command execution. This proof of concept connects to the endpoint and sends a command. https://packetstorm.news/download/237403...

Gitea 1.27.0 Arbitrary File Read

Gitea version 1.27.0 and prior affected versions contain an arbitrary file read through Org-mode +INCLUDE directives submitted to a public repository markup endpoint. The proof of concept retrieves target files and attempts a chain to command execution. https://packetstorm.news/download/237363...

PHP 8.4.26 Stale Session Global State Remote Code Execution

PHP version 8.4.26 contains a stale session global-state use-after-free vulnerability that can lead to remote code execution. This proof of concept demonstrates the issue through session upload progress handling. https://packetstorm.news/download/237408...

YOOtheme Pro 5.0.52 Unauthenticated Remote Code Execution

YOOtheme Pro versions 5.0.0 through 5.0.52 contain an unauthenticated remote code execution vulnerability in the public image transformation handler. The supplied proof of concept reuses a signed image URL to inject image operations and write an executable polyglot outside the cache directory...

Laravel Framework 12.67.0 TokenGuard Authentication Bypass

Laravel Framework version 12.67.0 contains an authentication bypass in TokenGuard when used with an Eloquent user provider and MySQL or MariaDB. The supplied proof of concept demonstrates authentication with a crafted non-string API token. https://packetstorm.news/download/237410...

PHP 8.5.12 Session Upload Progress Serializer Confusion

PHP version 8.5.12 contains a session upload progress serializer confusion issue when an application changes the session serializer at runtime, allowing unauthenticated object injection and remote code execution where a suitable gadget is present. https://packetstorm.news/download/237404...

Apache RocketMQ Client C++ 2.2.0 Out-of-Bounds Read

Apache RocketMQ Client C++ version 2.2.0 contains a remote out-of-bounds read in the RemotingCommand decoder that can allow a malicious broker or nameserver to crash a client. !/usr/bin/env bash Apache RocketMQ Client C++ 2.2.0 RemotingCommand::Decode Out-of-Bounds Read Vendor: The Apache Softwar...

GitLab CE/EE 19.5.0 Regular Expression Integer Overflow

GitLab CE/EE versions before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1 contain a regular expression compiler integer overflow that may allow unauthenticated arbitrary code execution. This proof of concept generates crafted Org-mode content and triggers the affected render path...

PHP 8.4.27 Session Upload Progress Serialization Mismatch Remote Code Execution

PHP version 8.4.27 contains a session upload progress serialization-handler mismatch that can lead to unauthenticated object injection and remote code execution when an application changes the session handler at runtime. Included is a proof of concept and Docker lab...

openapi-typescript-codegen 0.31.0 Code Injection

openapi-typescript-codegen version 0.31.0 contains a code injection vulnerability via unescaped OpenAPI specification values rendered into generated TypeScript clients. The proof of concept demonstrates benign import-time execution. https://packetstorm.news/download/237427...

needrestart 3.7 Local Privilege Escalation

needrestart before version 3.8 allows local attackers to execute arbitrary code as root through an attacker-controlled PYTHONPATH environment variable. This proof of concept causes a root needrestart process to create a set-user-ID copy of bash. https://packetstorm.news/download/237426...

Cisco Catalyst SD-WAN Manager 26.2 API Authentication Bypass

Cisco Catalyst SD-WAN Manager versions before the fixed releases contain an API authentication bypass caused by improper URI encoding handling. The included proof of concept details a crafted request that can obtain an administrative API session. https://packetstorm.news/download/237420...

Apache Tomcat 11.0.25 WebSocket Security Constraint Bypass

Apache Tomcat versions through 11.0.25, 10.1.59, and 9.0.121 contain a WebSocket endpoint template-path security constraint bypass. This proof of concept demonstrates anonymous access using an alternate endpoint path. https://packetstorm.news/download/237421...

PHP Session Upload Progress Remote Code Execution

PHP contains a session upload-progress deserialization vulnerability that can result in remote command execution when an application switches the session serializer at runtime. The proof of concept provides a local intentionally vulnerable lab. https://packetstorm.news/download/237419...

Node.js 26.12.0 Brotli Decoder Remote Code Execution

Node.js versions prior to 22.23.4, 24.22.1, and 26.12.1 contain a Brotli decoder out-of-bounds write that may lead to remote code execution when processing crafted compressed input. Included proof of concept demonstrates the issue in local Docker labs. https://packetstorm.news/download/237425...

PHP Session Serialize Handler Confusion

PHP contains a session upload progress serialization handler confusion condition when an application changes its configured handler to php at runtime before sessionstart while upload progress remains enabled. The proof of concept demonstrates attacker-controlled unserialization in a local lab...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions before 13.29.0 contain an authentication bypass in TokenGuard on MySQL or MariaDB. This proof of concept submits a non-string API token value that can authenticate as an unintended existing user. https://packetstorm.news/download/237418...

PHP 8.4.26 Pre-Authentication Remote Code Execution

PHP version 8.4.26 contains out-of-memory handling and use-after-free flaws in request processing. The supplied proof of concept uses crafted HTTP multipart requests to disclose process memory and execute a short command without authentication. https://packetstorm.news/download/237415...

Kitodo.Production 3.9.1 XML External Entity Injection

Kitodo.Production versions before 3.9.2 contain an XML external entity injection vulnerability in XMLUtils EAD imports. The proof of concept demonstrates local file disclosure through external entity resolution. https://packetstorm.news/download/237414...

NetAlertX 25.4.13 Authentication Bypass

NetAlertX versions before 25.4.14 contain an authentication bypass that allows unauthenticated requests to update application settings. The included proof of concept sends a savesettings request through index.php. https://packetstorm.news/download/237413...

GitLab 19.5.0 Integer Overflow

GitLab CE/EE versions before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1 contain an integer overflow in regular expression compilation. The proof of concept demonstrates the underlying Onigmo repeat-ID overflow. https://packetstorm.news/download/237411...

Fortinet FortiSIEM 7.5.0 Path Traversal

Fortinet FortiSIEM version 7.5.0 contains a path traversal flaw in phQueryMaster that allows unauthenticated arbitrary file writes and execution of unauthorized code or commands via specially crafted packets. https://packetstorm.news/download/237290...

PHP 8.4.26 Remote Code Execution

PHP version 8.4.26 contains out-of-memory and stale-state memory-corruption vulnerabilities that can lead to remote code execution under a vulnerable Apache modphp prefork configuration. This proof of concept demonstrates the PHP2Shell exploit chain. https://packetstorm.news/download/237284...

HUSTOJ 26.08.19 Thread Moderation Authorization Bypass

HUSTOJ versions 24.09.10 through 26.08.19 contain a missing authorization check in the threadadmin.php forum moderation endpoint. A proof of concept demonstrates that any authenticated user can delete, lock, or pin arbitrary forum threads. https://packetstorm.news/download/237292...

Systrome Validation & Certification 1.0 Client-Side Denial of Service

Systrome Validation & Certification version 1.0 contains a client-side denial of service condition in qrcodeauth.html. A crafted t URL parameter can cause an unvalidated interval to repeatedly execute and consume browser resources. https://packetstorm.news/download/237295...

Microsoft Windows 11 23H2 Kernel Streaming Privilege Escalation

Microsoft Windows 11 version 23H2 build 22631 contains a Kernel Streaming race condition that can allow a local attacker to enable SeDebugPrivilege and start a SYSTEM command shell. This proof of concept demonstrates exploitation. https://packetstorm.news/download/237294...

PHP 8.5.11 Multipart OOM Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory request-parsing flaw that can lead to remote code execution. The proof of concept sends a chunked multipart request to reproduce the OOM bailout trigger. https://packetstorm.news/download/237279...

Hugging Face datasets 5.1.0 Pandas Pickle Code Execution

Hugging Face datasets version 5.1.0 and earlier passes attacker-controlled data files to pandas.readpickle through its pandas builder, allowing arbitrary Python code execution when a victim loads a malicious pickle-backed dataset. https://packetstorm.news/download/237282...

Apache Qpid Proton C API 0.40.0 Remote Stack Overflow

Apache Qpid Proton C API version 0.40.0 contains an unbounded recursion flaw in its AMQP decoder that allows remote unauthenticated peers to exhaust the stack and cause a denial of service. !/usr/bin/env bash Apache Qpid Proton C API 0.40.0 Remote Stack Overflow Vendor: The Apache Software...

Apache ActiveMQ 5.18.2 OpenWire Remote Code Execution

Apache ActiveMQ versions before 5.15.16, 5.16.7, 5.17.6, and 5.18.3 contain an OpenWire deserialization flaw that allows unauthenticated remote code execution. This proof of concept sends a crafted ExceptionResponse frame. https://packetstorm.news/download/237303...

GitLab 19.5.0 Regular Expression Compiler Integer Overflow

GitLab version 19.5.0 and prior affected versions contain an integer overflow in the regular expression compiler that can allow unauthenticated code execution. This proof of concept triggers the vulnerable Onigmo regular expression path. https://packetstorm.news/download/237296...

Plex Media Server 1.43.3.10828 Timeline Server-Side Request Forgery

Plex Media Server versions before 1.43.3.10861 contain a server-side request forgery vulnerability via the /player/timeline endpoint. The supplied proof of concept demonstrates server-originated requests using an invalid X-Plex-Token value. https://packetstorm.news/download/237300...

Super Store Finder 3.8 SQL Injection

Super Store Finder version 3.8 suffers from multiple remote SQL injection vulnerabilities. Exploit Title: Super Store Finder 3.8 - Multiple SQL Injection Exploit Author: CraCkEr Date: 26/08/2026 Vendor: highwarden Vendor Homepage: https://codecanyon.net/item/super-store-finder/3630922 Software...

JetBrains TeamCity 2026.1.2 Agent Polling Remote Code Execution

JetBrains TeamCity versions before 2026.1.3 and 2025.11.7 contain an unauthenticated agent-polling protocol deserialization vulnerability that allows remote code execution. https://packetstorm.news/download/237301...

PHP 8.4.26 session.upload_progress Remote Code Execution

PHP version 8.4.26 under Apache modphp contains a pre-authentication remote code execution vulnerability in session upload progress handling. This proof of concept chains memory disclosure and stale session state to execute commands as the web worker. https://packetstorm.news/download/237267...

Node.js 26.12.0 Brotli Decoder out of Bounds Write

Node.js versions 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1 contain an out of bounds write in the Brotli decoder that can lead to remote code execution. Included is a proof of concept. https://packetstorm.news/download/237258...

PHP 8.5.11 Multipart OOM Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain out-of-memory and stale request-state flaws that can lead to remote code execution. The supplied proof of concept demonstrates multipart upload-progress trigger paths. https://packetstorm.news/download/237257...

PHP 8.4.26 Remote Code Execution

PHP core versions after 5.4 contain a vulnerability that can result in remote code execution. This proof of concept targets PHP version 8.4.26 running as modphp with a prefork Apache configuration. !/usr/bin/env python3 """ Exploit credited to 9bie, adjusted using AI by OffSec php2shell - one-cli...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain out-of-memory request-state flaws that can lead to remote code execution. The supplied proof of concept targets Apache modphp through multipart request processing. https://packetstorm.news/download/237264...

GitLab 19.5.0 Integer Overflow Remote Code Execution

GitLab CE/EE versions 7.0 through 19.5.0 contain an integer overflow in the regular expression compiler that may allow unauthenticated remote code execution. This proof of concept triggers the issue through a crafted org file rendered by the blob viewer. https://packetstorm.news/download/237263...

PHP 8.4.26 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory state-corruption vulnerability that may allow remote code execution. This proof of concept targets PHP 8.4.26 Apache modphp in an isolated Docker environment. https://packetstorm.news/download/237271...

Pillow 12.3.0 JPEG Decoder Heap Buffer Overflow

Pillow version 12.3.0 and earlier contain a heap buffer overflow in ImagingJpegDecode when thumbnail processes an 8-bit lossless SOF3 JPEG with libjpeg-turbo 3.x. https://packetstorm.news/download/237261...

Anuko Time Tracker 1.20.0.5640 SQL Injection

Anuko Time Tracker versions prior to 1.20.0.5642 contain an authenticated SQL injection vulnerability in the Puncher plugin. A proof of concept is provided to inject a scalar SQL query through the date parameter and read its result. https://packetstorm.news/download/237259...

snapd 2.73 snap-confine Local Privilege Escalation

snapd version 2.73 contains a local privilege escalation vulnerability in set-capabilities snap-confine. The proof of concept races creation of an udev rule to execute a command as root. https://packetstorm.news/download/237266...

GStreamer 1.28.4 GstVideoMeta Heap Buffer Overflow

GStreamer version 1.28.4 contains a heap buffer overflow in libgstvideo when untrusted GstVideoMeta data is deserialized through unixfd. The included proof of concept causes a stock receiver pipeline to read outside the backing frame buffer. https://packetstorm.news/download/237272...

Braces 3.0.3 Stack Exhaustion

Braces versions 3.0.3 and earlier contain uncontrolled recursion that can exhaust the Node.js call stack when processing deeply nested brace patterns. The supplied proof of concept demonstrates the resulting denial of service condition. https://packetstorm.news/download/237281...

Skyworth 65G60 Android 8.0 Local Privilege Escalation

Skyworth 65G60 televisions running Android version 8.0 with kernel 4.9.44 contain a local privilege escalation vulnerability. The proof of concept abuses the Android Binder use-after-free flaw to obtain a temporary root shell. https://packetstorm.news/download/237270...

PHP 8.4.26 Stale Session Global State Remote Code Execution

PHP version 8.4.26 contains a stale session global state use-after-free that can lead to remote code execution. Included proof of concept uses session upload progress in a local Docker Compose lab. https://packetstorm.news/download/237277...

Adobe Commerce and Magento Open Source 2.4.7-p8 Customer Account Takeover

Adobe Commerce and Magento Open Source versions through 2.4.7-p8 contain an incorrect authorization vulnerability. This proof of concept poisons an authenticated customer session to access another customer's account data. https://packetstorm.news/download/237276...