Apache Log4j 2.14.1 JNDI Remote Code Execution

Apache Log4j version 2.14.1 contains a JNDI lookup vulnerability that can permit remote code execution. This proof of concept provides an isolated lab application, a harmless canary payload, and patch-validation evidence. https://packetstorm.news/download/234959...

Spring Security OAuth 2.0.8 Remote Command Execution

Spring Security OAuth version 2.0.8 allows authenticated remote command execution when its whitelabel error view evaluates a malicious responsetype parameter as a Spring Expression Language expression. Included proof of concept generates the expression. https://packetstorm.news/download/234976...

PostgreSQL 10.7 COPY from Program Command Execution

PostgreSQL version 10.7 with default superuser credentials demonstrates COPY FROM PROGRAM execution of an operating-system command as the database server user. https://packetstorm.news/download/234985...

WordPress miniOrange OTP Verification 5.5.7 Account Takeover

WordPress miniOrange OTP Verification plugin versions through 5.5.7 contain an unauthenticated account takeover vulnerability that permits OTP rerouting to an attacker-controlled phone number. A proof of concept is included. https://packetstorm.news/download/235041...

crawl4ai 0.9.2 Arbitrary File Write

crawl4ai versions 0.9.0 through 0.9.2 contain an arbitrary file write in PDFContentScrapingStrategy through untrusted configuration fields. The proof of concept writes a crafted PDF image stream to an attacker-chosen service-account-writable directory. https://packetstorm.news/download/235040...

Apache JMeter 3.3 RMI Deserialization Remote Code Execution

Apache JMeter version 3.3 running in distributed server mode permits unauthenticated deserialization through its RMI registry. This proof of concept provides a Docker-based vulnerable environment and a ysoserial BeanShell1 exploitation example. https://packetstorm.news/download/235004...

Apache Druid 0.20.0 Embedded JavaScript Remote Code Execution

Apache Druid versions 0.20.0 and earlier contain an embedded JavaScript execution issue that a crafted ingestion specification can use to execute commands on the server. A proof of concept is included. https://packetstorm.news/download/235029...

Apache HTTP Server 2.4.50 Path Traversal

Apache HTTP Server version 2.4.50 contains a path traversal vulnerability that may disclose files outside the document root and, with CGI enabled, permit command execution. This archive provides a deliberately vulnerable Docker environment and proof of concept requests...

PHPUnit 5.6.2 Remote Code Execution

PHPUnit version 5.6.2 exposes Util/PHP/eval-stdin.php, which evaluates HTTP POST input and permits remote code execution when its vendor directory is web-accessible. https://packetstorm.news/download/234986...

Zabbix 3.0.3 SQL Injection

Zabbix version 3.0.3 contains SQL injection vulnerabilities in latest.php and jsrpc.php. The supplied proof of concept demonstrates error-based SQL injection through the toggleids parameter. https://packetstorm.news/download/234963...

Apache Superset 2.0.1 Session Forgery

Apache Superset version 2.0.1 using a known default SECRETKEY allows session-cookie forgery and authentication as another user. This proof of concept verifies default keys, forges a selected user session, and can validate it. https://packetstorm.news/download/234971...

Apache ActiveMQ 5.18.1 OpenWire Deserialization Remote Code Execution

Apache ActiveMQ versions prior to 5.18.2 contain an OpenWire deserialization vulnerability that permits remote class instantiation and command execution. This proof of concept demonstrates the issue against version 5.17.3. https://packetstorm.news/download/235031...

H2 Database 2.1.209 Web Console JDBC URL Remote Code Execution

H2 Database versions 1.4.198 through 2.1.209 contain a web console JDBC URL restriction bypass that permits an INIT script to execute Java code. This submission provides a vulnerable H2 2.0.206 lab and proof of concept. https://packetstorm.news/download/235011...

Oracle WebLogic Server 12.2.1.3 Remote Command Execution

Oracle WebLogic Server version 12.2.1.3 contains an authentication bypass that can be chained with a console command-execution issue. A proof of concept environment and exploitation details are provided. https://packetstorm.news/download/234965...

Apache CouchDB 2.1.0 Privilege Escalation

Apache CouchDB version 2.1.0 contains an access-control bypass caused by duplicate JSON roles fields, allowing creation of an administrative user. A proof of concept environment and exploitation details are provided. https://packetstorm.news/download/235023...

Veeam Backup & Replication 12.3.2.4465 Remote Code Execution

Veeam Backup & Replication version 12.3.2.4465 and earlier version 12 builds contain a remote code execution vulnerability exploitable by an authenticated domain user. https://packetstorm.news/download/235039...

Eclipse Jetty 9.4.37 Ambiguous Path Information Disclosure

Eclipse Jetty version 9.4.37 contains an ambiguous path handling issue that permits retrieval of protected WEB-INF resources using an encoded dot segment. This proof of concept provides a vulnerable lab and demonstration. https://packetstorm.news/download/235005...

Nginx 1.13.2 Cache Information Disclosure

Nginx version 1.13.2 contains an integer overflow in the range filter that can disclose cache file headers and cached response data. Included proof of concept sends a crafted Range header to demonstrate the disclosure. https://packetstorm.news/download/234995...

Spring Framework 6.2.10 Generic Method Authorization Bypass

Spring Framework versions through 5.3.44, 6.1.22, and 6.2.10 may fail to resolve method-security annotations on overridden generic methods, permitting an authorization bypass. This proof of concept reproduces the behavior using @PreAuthorize. https://packetstorm.news/download/235034...

Laravel 8.4.2 Ignition Remote Code Execution

Laravel version 8.4.2 with Ignition version 2.5.1 contains an insecure solution endpoint that can allow unauthenticated remote code execution when debug mode is enabled. A proof of concept environment and reproduction steps are included. https://packetstorm.news/download/234962...

Ruby on Rails 5.2.2 Accept Header Arbitrary File Read

Ruby on Rails version 5.2.2 contains an Accept header path traversal vulnerability in controller render file handling that allows remote attackers to read arbitrary files. https://packetstorm.news/download/234983...

Apache Tomcat 8.5.19 Arbitrary File Write

Apache Tomcat version 8.5.19 with the Default Servlet readonly setting disabled allows HTTP PUT requests with crafted filenames to write JSP files to the web root. https://packetstorm.news/download/234969...

Apache Shiro 1.2.4 RememberMe Deserialization

Apache Shiro version 1.2.4 uses a hard-coded AES key for RememberMe cookies, allowing crafted serialized objects to trigger arbitrary command execution. This proof of concept supplies a vulnerable lab and reproduction details. https://packetstorm.news/download/234979...

Adobe ColdFusion 9.0.1 Directory Traversal

Adobe ColdFusion versions 9.0.1 and earlier contain a directory traversal vulnerability in administrator pages that allows remote file reads through the locale parameter. The supplied Docker environment and proof of concept demonstrate CVE-2010-2861. https://packetstorm.news/download/235024...

Joomla 4.2.7 Webservice Improper Access Check

Joomla version 4.2.7 contains an improper access check in webservice endpoints that permits unauthenticated access to application configuration and user information when public=true is supplied. https://packetstorm.news/download/235003...

Apache Unomi 1.5.1 MVEL/OGNL Injection Remote Code Execution

Apache Unomi version 1.5.1 contains an MVEL and OGNL expression injection vulnerability that allows unauthenticated remote code execution through crafted context requests. Proof of concept included. https://packetstorm.news/download/234967...

GNU Bash 4.3.0 Shellshock Remote Command Injection

GNU Bash version 4.3.0 contains the Shellshock remote command injection vulnerability when Apache CGI exposes attacker-controlled request headers as environment variables. This proof of concept supplies a Docker-based Apache CGI lab with vulnerable and unaffected scripts...

Redis 5.0.7 Lua Sandbox Escape

Redis version 5.0.7 as packaged by Debian and Ubuntu leaves the Lua package global accessible, allowing EVAL scripts to load Lua's io module and execute host commands. The supplied environment and proof of concept demonstrate CVE-2022-0543. https://packetstorm.news/download/234982...

SP Page Builder 6.6.1 Unauthenticated Shell Upload

SP Page Builder versions 1.0.0 through 6.6.1 contain an unauthenticated arbitrary ZIP file upload that can result in remote code execution. https://packetstorm.news/download/235042...

Embedthis Appweb 7.0.2 Digest Authentication Bypass

Embedthis Appweb versions before 7.0.3 contain a digest and form authentication bypass. The supplied proof of concept demonstrates authentication bypass against version 7.0.1 by supplying an existing username without a password. https://packetstorm.news/download/235027...

Proxmox VE 8.0 Authentication Bypass

Proxmox VE versions 7.0 through 8.0 contain an authentication bypass in libpve-access-control before version 8.0.4. This proof of concept authenticates as root@pam using an arbitrary tfa-challenge value and opens a terminal session. https://packetstorm.news/download/234960...

Apache Flink 1.11.2 JobManager Directory Traversal

Apache Flink version 1.11.2 contains a directory traversal vulnerability in the JobManager REST interface that allows attackers to read files accessible to the JobManager process. A proof of concept is included. https://packetstorm.news/download/235016...

Ghostscript 9.23 -dSAFER Sandbox Bypass

Ghostscript version 9.23 contains a -dSAFER sandbox bypass that allows a crafted PostScript file submitted through an ImageMagick upload page to execute a command on the target server. The included proof of concept writes the target container's identity to /tmp/success...

Grafana 8.2.6 Plugin Path Traversal

Grafana version 8.2.6 contains an unauthenticated plugin asset path traversal vulnerability. A proof of concept request demonstrates reading files accessible to the Grafana server. https://packetstorm.news/download/235012...

GlassFish 4.1 Admin Console Arbitrary File Read

GlassFish version 4.1 contains an arbitrary file read vulnerability in its admin console due to overlong UTF-8 decoding. The supplied proof of concept uses crafted traversal sequences to read files without authentication. https://packetstorm.news/download/235013...

GitLab Community Edition 13.10.1 Remote Command Execution

GitLab Community Edition version 13.10.1 allows unauthenticated remote command execution when a crafted image is processed by ExifTool's DjVu parser. https://packetstorm.news/download/235014...

Apache Dubbo 2.7.3 HTTP Protocol Deserialization

Apache Dubbo version 2.7.3 HTTP protocol providers deserialize POST bodies with Java serialization, allowing a suitable gadget chain to execute commands. This submission supplies a vulnerable lab and proof of concept exploitation details. https://packetstorm.news/download/235019...

Apache HTTP Server 2.4.49 Path Traversal

Apache HTTP Server version 2.4.49 contains a path traversal flaw that can disclose files outside the document root and, with CGI enabled, allow command execution. This proof of concept provides a vulnerable container and reproduction commands. https://packetstorm.news/download/235010...

Elasticsearch 1.4.2 Groovy Sandbox Bypass

Elasticsearch version 1.4.2 contains a Groovy sandbox bypass that permits arbitrary command execution through crafted search requests. Includes a proof of concept vulnerable environment and reproduction details. https://packetstorm.news/download/235017...

Openfire 4.7.4 Admin Console Authentication Bypass

Openfire version 4.7.4 contains an administrative console authentication bypass via path traversal in setup pages. The supplied proof of concept details creating an administrator without authentication. https://packetstorm.news/download/234992...

Apache HugeGraph 1.7.0 SecurityManager Sandbox Bypass Remote Code Execution

Apache HugeGraph version 1.7.0 contains a SecurityManager sandbox bypass that allows unauthenticated remote command execution through the Gremlin endpoint. !/usr/bin/env bash Apache HugeGraph 1.7.0 Sandbox Bypass Remote Code Execution Vendor: The Apache Software Foundation Product web page:...

Apache Avatica 1.29.0 JDBC Connection Property Injection

Apache Calcite Avatica versions 1.29.0 and 1.28.0 copy unauthenticated client-supplied JDBC connection properties into backend connections. The included proof of concept injects properties that may enable local file disclosure or deserialization under specific backend conditions. !/usr/bin/env...

Samsung Galaxy A57 Android 16 sgpu Driver Use-After-Free

Samsung Galaxy A57 devices running Android version 16 contain a use-after-free race in the sgpu driver’s sgpugemcreate function. The proof of concept races GEM creation and close ioctls to trigger BO swap-list corruption. Samsung sgpu: sgpugemcreate calls sgpuswapaddbo on dangling BO...

Langflow AI Custom Component Eval Injection Unauthenticated Remote Code Execution

Langflow version 1.3.2 is susceptible to unauthenticated remote code execution due to improper input validation in the evalcustomcomponentcode function. Arbitrary code executes under the context of the backend Langflow process. This module requires Metasploit: https://metasploit.com/download...

Langflow AI Code Validation Authenticated Remote Code Execution

Langflow versions 1.0.0 through 1.10.0 are susceptible to authenticated remote code execution due to improper validation of code in the /api/v1/validate/code endpoint. Arbitrary code is executed under the context of the backend Langflow process. This module requires Metasploit:...

Apache SeaTunnel 3.0.0 Remote Code Execution

Apache SeaTunnel versions 3.0.0 and 2.3.13 contain an unauthenticated remote code execution issue in the engine REST API DynamicCompile transform. !/usr/bin/env python Apache SeaTunnel 3.0.0 Remote Code Execution Vendor: The Apache Software Foundation Product web page: https://seatunnel.apache.or...

Apache OzHera 2.2.6 Authenticated SQL Injection

Apache OzHera version 2.2.6 contains an authenticated SQL injection vulnerability in Doris-backed log searches. Apache OzHera 2.2.6 Authenticated SQL Injection Vendor: The Apache Software Foundation Product web page: https://ozhera.apache.org Affected version: 2.2.6-incubating Summary: Apache...

Apache Commons JCS 3.2.1 Unauthenticated Deserialization

Apache Commons JCS version 3.2.1 contains an unauthenticated Java deserialization vulnerability in its TCP Lateral Cache listener that could allow remote code execution when the lateral cache is enabled. / Apache Commons JCS 3.2.1 Unauthenticated Java Deserialization Vendor: The Apache Software...

Apache Curator 5.9.0 Java Deserialization

Apache Curator version 5.9.0 contains an unsafe Jackson deserialization issue in its service-discovery component that can instantiate an attacker-controlled payload class. !/usr/bin/env python Apache Curator 5.9.0 Java Deserialization Vendor: The Apache Software Foundation Product web page:...

Apache Ratis 3.3.1 Java Deserialization

Apache Ratis versions 3.3.0 and 3.3.1 contain an unsafe Java deserialization vulnerability in RPC reply error handling that can allow remote code execution on a client with a suitable gadget chain. !/usr/bin/env python Apache Ratis 3.3.1 Java Deserialization Vendor: The Apache Software Foundation...