Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions prior to 12.68.0 and 13.29.0 contain an authentication bypass in TokenGuard when non-string API credentials are processed with MySQL or MariaDB. The supplied proof of concept scans for affected targets and attempts authentication bypasses...

Wasmtime 49.0.3 AArch64 Sandbox Escape

Wasmtime versions before 36.0.19, 37.0.0 through 48.0.6, and 49.0.0 through 49.0.3 contain an AArch64 Cranelift brtable branch-target flaw. The proof of concept diverts execution to a JIT literal pool to demonstrate host code execution. https://packetstorm.news/download/237864...

SPIP 4.4.19 and Earlier Remote Code Execution

SPIP versions before 4.4.20 contain an unauthenticated remote code execution vulnerability related to PHP block identification and varexport handling. The included proof of concept detects affected targets and deploys command execution and file-upload PHP shells...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 contains an out-of-memory handling flaw that can result in remote code execution. The included proof of concept targets Apache modphp prefork deployments using multipart requests and session-state disclosure. https://packetstorm.news/download/237867...

Apple iOS / iPadOS Information Disclosure

Apple iOS and iPadOS versions prior to 27 contain an authorization issue that may allow an app to access sensitive user data. The proof of concept reads SCDynamicStore network state, including WiFi SSID data, without a wifi-info entitlement. https://packetstorm.news/download/237861...

Apple iOS 27.0 CoreGraphics Type 5 Shading Out-Of-Bounds Write

Apple iOS version 27.0 CoreGraphics contains an out-of-bounds write when processing a PDF Type 5 shading function whose range dimension differs from the color space component count. Proof of concept code generates a crash-triggering PDF and a control PDF. https://packetstorm.news/download/237859...

FreeFloat FTP Server 1.0 Stack Buffer Overflow

FreeFloat FTP Server version 1.0 contains a stack-based buffer overflow in the NOOP command handler. The supplied proof of concept documentation demonstrates control of EIP and remote code execution in a laboratory environment. https://packetstorm.news/download/237895...

Node.js 26.x Brotli Decoder Out-Of-Bounds Write

Node.js versions 22.x prior to 22.23.4, 24.x prior to 24.22.1, and 26.x prior to 26.12.1 contain a Brotli decoder out-of-bounds write. The proof of concept provides decoder probing, fuzzing, target delivery, and decompression-payload generation. https://packetstorm.news/download/237896...

Checkov 3.2.531 Arbitrary Code Execution

Checkov versions 3.2.0 through 3.2.531 contain an arbitrary code execution vulnerability when scanning a directory containing an attacker-controlled configuration file. A proof of concept is provided. https://packetstorm.news/download/237897...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions through 8.5.11 contain session.uploadprogress OOM-corruption and stale-global-state vulnerabilities that can lead to remote code execution. Included is a proof of concept with passive fingerprinting and local Docker lab support. https://packetstorm.news/download/237904...

Lobster_pro 4.12.12-LTS Token Replay / Privilege Escalation

Lobsterpro version 4.12.12-LTS and potentially other versions prior to 25.1.3 suffer from a privilege escalation vulnerability due to allowing use of non-privileged access to achieve administrative access. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Privilege escalation via request replaying ...

Microsoft Windows SMBv1 Remote Code Execution

This document provides a proof of concept workflow for identifying vulnerable Microsoft Windows SMBv1 hosts and exploiting the MS17-010 EternalBlue vulnerability with Metasploit. https://packetstorm.news/download/237889...

WordPress 7.0.1 REST API Batch Route Confusion Remote Code Execution

WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 contain a REST API batch-route confusion issue which, when combined with SQL injection, can lead to remote code execution. https://packetstorm.news/download/237893...

SPIP 4.4.19 Remote Code Execution

SPIP versions before 4.4.20 contain an unauthenticated remote code execution vulnerability. The supplied proof of concept delivers PHP code through the search parameter and attempts to write command and upload shells to successful targets. https://packetstorm.news/download/237890...

Langflow OSS 1.12.4 Authenticated Remote Code Execution

Langflow OSS versions 1.0.0 through 1.12.4 contain an authenticated code injection vulnerability that allows arbitrary code execution on the server. The proof of concept submits a crafted custom component to the update endpoint. https://packetstorm.news/download/237878...

Onyx 5.0.0 Cross Site Scripting

Onyx versions through 5.0.0 contain a cross site scripting vulnerability in the Craft output preview. The proof of concept demonstrates that same-origin preview content with scripts enabled can modify its parent document. https://packetstorm.news/download/237885...

Polkit 0.119 Privilege Escalation

Polkit versions 0.113 through 0.119 contain a local privilege escalation vulnerability. The supplied Bash proof of concept uses interrupted D-Bus AccountService requests to create an administrative account and set its password. https://packetstorm.news/download/237894...

LaraDashboard 1.4.2 SVG Upload Cross Site Scripting

LaraDashboard versions 0.9.0 through 1.4.2 contain a stored cross site scripting vulnerability in SVG media uploads. Authenticated users with the media.create permission can upload an SVG whose script executes when another user opens the inline-served file. https://packetstorm.news/download/23788...

GitLab 19.4.1 CI/CD Regular Expression Remote Code Execution

GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 contain an integer overflow in CI/CD regular expression handling that can allow remote code execution. Includes a proof of concept. https://packetstorm.news/download/237901...

Juniper Junos OS Evolved 25.4 PTX Series Unauthenticated Remote Code Execution

Juniper Junos OS Evolved on PTX Series versions before 25.4R1-S1-EVO and 25.4R2-EVO contain an unauthenticated remote code execution vulnerability. The supplied proof of concept creates and executes a command through the affected configuration API. https://packetstorm.news/download/237898...

LaraDashboard 1.2.2 Path Traversal

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in core-upgrade backup handling, permitting a user with settings.edit to delete arbitrary files or restore an on-disk archive into application directories. The proof of concept verifies vulnerable source markers and...

Zylon PrivateGPT 1.0.1 URI Artifact Loader SSRF

Zylon PrivateGPT versions 1.0.0 and 1.0.1 contain a server-side request forgery vulnerability in the URI Artifact Loader. The proof of concept demonstrates a controlled loopback request. https://packetstorm.news/download/237886...

Alertus Desktop Alert 5.4.98.0 Remote HTML Injection

Alertus Desktop Alert version 5.4.98.0 contains an unauthenticated remote HTML injection vulnerability due to certificate validation bypass. The proof of concept serves forged attacker-signed alert responses that inject HTML into the client and includes a browser protocol-handler demonstration...

FreeFloat FTP Server 1.0 NOOP Buffer Overflow

FreeFloat FTP Server version 1.0 contains a buffer overflow in the NOOP command handler. This proof of concept documents fuzzing, EIP control, bad character identification, and JMP ESP validation. https://packetstorm.news/download/237891...

Langflow 1.12.4 MCP Server Credential Disclosure

Langflow versions 1.0.0 through 1.12.4 contain a cleartext storage of sensitive information vulnerability that allows authenticated remote attackers to retrieve MCP server credentials in plaintext. This proof of concept creates a test MCP server containing a known secret, retrieves it, and delete...

Langflow 1.12.4 Authenticated Remote Code Execution

Langflow versions 1.0.0 through 1.12.4 contain a missing authorization issue in the authenticated A2A JSON-RPC execution path that allows an authenticated user to execute arbitrary code by bypassing execution gates. https://packetstorm.news/download/237876...

Kestra 1.3.20 Authentication Bypass / Remote Code Execution

Kestra version 1.3.20 contains an authentication-filter bypass that permits unauthenticated workflow creation and execution through a path ending in /configs, resulting in command execution inside the worker container. https://packetstorm.news/download/237872...

Windows Server 2025 Active Directory Certificate Services Subject Key Identifier Injection

Windows Server 2025 Active Directory Certificate Services contains a weak authentication issue that allows an authorized attacker to inject an arbitrary Subject Key Identifier into a certificate signing request. https://packetstorm.news/download/237875...

NGINX 1.31.6 TLS Session Ticket Forgery

NGINX versions 1.23.2 through 1.31.6 contain a TLS session-ticket forgery vulnerability that may bypass client-certificate verification when shared session caching and automatic ticket-key rotation are used. The included proof of concept targets a loopback lab server...

WordPress Bookly 28.2 Insecure Direct Object Reference

WordPress Bookly plugin versions through 28.2 contain an unauthenticated insecure direct object reference that exposes order tokens and calendar appointment data. The included proof of concept enumerates order tokens and extracts calendar data. https://packetstorm.news/download/237870...

WordPress Product Filter by WBW 3.4.6 SQL Injection

WordPress Product Filter by WBW versions through 3.4.6 contain an unauthenticated SQL injection vulnerability in the frontend filter AJAX flow. The proof of concept demonstrates attacker-controlled temporary-table identifier handling using a structural response oracle...

Rocq Prover 9.2.0 Universe Checking Bypass Proof of Concept

Rocq Prover versions up to and including 9.2.0 contain a kernel soundness vulnerability caused by improper restoration of universe checking state when a module closes. The Local Unset Universe Checking directive can leave the kernel's universe graph with validation disabled even after the global...

Pillow 12.3.0 Argument Injection

Pillow versions 2.6.0 through 12.3.0 contain an argument injection vulnerability in Ghostscript EPS handling that may allow arbitrary command execution when attacker-controlled filenames are processed. https://packetstorm.news/download/237664...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions through 8.5.11 contain memory-corruption flaws that can allow unauthenticated remote code execution. This proof of concept uses crafted multipart upload-progress requests to trigger the vulnerability chain. https://packetstorm.news/download/237643...

OnePlus 16 PYB110 6.18.21 Local Privilege Escalation

OnePlus 16 PYB110 ColorOS 17 kernel version 6.18.21 contains a POSIX CPU timer use-after-free vulnerability. This proof of concept obtains temporary root access from an Android shell and can hand it to KernelSU or FinaSU. https://packetstorm.news/download/237639...

Asciidoctor Include Ext 0.3.0 Command Injection

Asciidoctor Include Ext versions prior to version 0.4.0 contain a command injection vulnerability when rendering user-supplied AsciiDoc markup. This proof of concept demonstrates the issue through an include directive. https://packetstorm.news/download/237642...

Rocq Prover 9.1 Guard Checker Bypass Proof of Concept

Rocq Prover versions 8.20 through 9.1 contain a kernel soundness vulnerability in the termination guard checker. The finduniformparameters function fails to examine cross-calls between nested mutually recursive fixpoints, incorrectly treating changing parameters as uniform and accepting recursive...

Mirth Connect 4.4.0 Remote Command Execution

NextGen Healthcare Mirth Connect versions before version 4.4.1 contain an unauthenticated remote code execution vulnerability. This proof of concept submits a crafted XML deserialization payload to execute a command on an affected target. https://packetstorm.news/download/237649...

Magento Open Source 2.4.9-2026-aug Template Engine Remote Code Execution

Magento Open Source versions through 2.4.9-2026-aug contain an unauthenticated template engine flaw that can allow arbitrary code execution. The included proof of concept uses GraphQL requests to trigger the issue. https://packetstorm.news/download/237645...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain request-handling memory-corruption flaws. This proof of concept uses multipart upload progress handling to demonstrate remote code execution. https://packetstorm.news/download/237644...

Lean 4.31.0 Kernel Type Confusion Proof of Concept

Lean 4 version 4.31.0 and earlier contain a kernel soundness vulnerability involving insufficient validation of nested inductive type projections. A malicious metaprogram can exploit mismatched structure projections and expression hash collisions to register ill-typed declarations through the...

OpenThread mDNS NULL Pointer Dereference

OpenThread versions before commit b47613f contain an mDNS RecordCache NULL pointer dereference that allows an adjacent commissioned Thread node to crash the process. Included proof of concept delivers two DNS-SD queries. https://packetstorm.news/download/237656...

Cloudflare Universal SSL, WARP, and OpenNext Cloudflare Exploits

Proof of concept and exploit scripts for Cloudflare Universal SSL CAA handling, @opennextjs/cloudflare versions before 1.17.1 SSRF, and Cloudflare WARP for Windows versions before 2024.12.492.0 symlink-based file deletion. https://packetstorm.news/download/237662...

Android 16 QPR2 Wireless Debugging Authentication Bypass

Android versions 14, 15, 16, and 16 QPR2 contain a wireless ADB mutual-authentication bypass in adbd that permits adjacent-network shell-user code execution. This proof of concept opens an unauthenticated shell. https://packetstorm.news/download/237655...

...[ More ]

Coq versions 8.11 through 8.20 and Rocq Prover versions through 9.2.0 contain a proof auditing vulnerability involving the Parameter Inline mechanism in module functors. Definitions created with universe checking disabled can be inlined without preserving the unsafe universe checking metadata,...

...[ More ]

Lean 4 version 4.31.0 and earlier contain a kernel soundness vulnerability caused by improper validation of opaque declarations and stale free-variable inference-cache entries. A malicious metaprogram can exploit the missing closure check in the addopaque path to register an opaque constant of ty...

Google Brotli 1.2.0 out of Bounds Write

Google Brotli version 1.2.0 and prior contains an out-of-bounds write in block-type switch handling when processing crafted compressed input. The included proof of concept demonstrates denial of service and remote code execution against an affected Node.js 24.22.0 local laboratory profile...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an OOM-driven session upload progress use-after-free that can lead to unauthenticated remote code execution. Includes a Python proof of concept for Apache modphp. https://packetstorm.news/download/237652...

Apache ActiveMQ CPP 3.9.5 Remote Denial of Service

Apache ActiveMQ CPP version 3.9.5 contains an uncontrolled memory allocation vulnerability in OpenWire byte-array unmarshalling that allows a malicious broker to crash a client. !/usr/bin/env python Apache ActiveMQ CPP 3.9.5 OpenWireFormat::unmarshal Denial of Service Vendor: The Apache Software...

Rocq Prover 9.1.0 Higher Order Fixpoint Guard Checker Bypass

Rocq Prover version 9.1.0 and earlier contain a kernel soundness vulnerability in the termination guard checker. The checker incorrectly accepts recursive functions passed as higher order arguments to other fixpoints, allowing recursive calls on values that are not structurally decreasing. This...