NUUO Crystal Server 3.19.0.85 Unauthenticated Shell Upload

NUUO Crystal Server version 3.19.0.85 contains an unauthenticated upload.php endpoint that accepts a client-controlled filename and file content, allowing a PHP file to be written into the web root and executed through the server's PHP mapping. A proof of concept is included...

Moxa MAR-2000 FWR_MAR2000_V1.0_Build_15010909 Scenario Ping Command Injection

Moxa MAR-2000 firmware version FWRMAR2000V1.0Build15010909 contains a command injection in scenario ping conditions. An authenticated administrator can save a crafted parameter that the scheduled PingThread executes through a shell. https://packetstorm.news/download/238064...

...[ More ]

This Python utility recovers AES-256-encrypted credentials associated with AXIS Camera Station using cryptographic keys derived from Windows volume serial numbers. It implements HMAC-SHA1, PBKDF2-SHA1, and AES-256-CBC decryption, supporting both known volume serial numbers and exhaustive searches...

Raritan PX3 PDU G4 Firmware 4.3.14 Diagnostics Command Injection

Raritan PX3 PDU G4 firmware version 4.3.14 contains an authenticated command injection vulnerability in the diagnostics ping and traceroute handlers due to inverted hostname-validation handling. The proof of concept sends an authenticated JSON-RPC request containing a crafted host parameter...

Moxa MAR-2000 FWR_MAR2000_V1.0_Build_15010909 IPsec Command Injection

Moxa MAR-2000 firmware version FWRMAR2000V1.0Build15010909 contains an authenticated IPsec tunnel address command injection vulnerability. The supplied proof of concept stores a shell command in the local VPN address field through the management REST interface...

Microsoft Authenticator for Android Token Theft

Microsoft Authenticator for Android versions before 6.2606.4246 contain an improper authentication flaw that may allow a malicious local application to impersonate a trusted application and obtain brokered tokens. This proof of concept generates an Android application source and supports ADB-base...

WordPress Frontend Post Submission Manager Lite 1.2.7 Open Redirect

WordPress Frontend Post Submission Manager Lite versions through 1.2.7 contain an unauthenticated open redirect through the requestedpage POST parameter. A proof of concept is included. https://packetstorm.news/download/238055...

Gradio Server-Side Request Forgery

Gradio versions before 5.0.0 contain a server-side request forgery vulnerability in the /queue/join endpoint. The included proof of concept demonstrates retrieval of a file from an internal HTTP service through a vulnerable Gradio instance. https://packetstorm.news/download/238052...

Magento Open Source 2.4.9 Unrestricted File Upload

Magento Open Source versions through 2.4.9 contain an unrestricted file upload flaw in the guest-cart REST API. The proof of concept starts a loopback lab and demonstrates accepting a GIF/PHP polyglot using a non-executing witness payload. https://packetstorm.news/download/238040...

WordPress midi-Synth 1.1.0 Arbitrary File Upload

WordPress midi-Synth plugin versions through 1.1.0 contain an unauthenticated arbitrary file upload vulnerability in the export AJAX action. The proof of concept uploads a test file or PHP shell. https://packetstorm.news/download/238053...

YOOtheme Pro 5.0.52 Image Handler Shell Upload

YOOtheme Pro versions 5.0.0 through 5.0.52 contain an unauthenticated image-handler signature reuse and path traversal issue that can write a JPEG/PHP polyglot webshell and execute commands. https://packetstorm.news/download/238039...

OpenClaw 2026.1.28 Cross Site WebSocket Hijacking

OpenClaw version 2026.1.28 and prior accepts an unvalidated gatewayUrl query parameter, allowing its Control UI to send a stored gateway token to an attacker-controlled WebSocket endpoint. This proof of concept uses that token to access the local gateway, alter its configuration, and invoke a...

YOOtheme Pro 5.0.52 Unauthenticated Remote Code Execution

YOOtheme Pro versions 5.0.0 through 5.0.52 contain an unauthenticated remote code execution vulnerability in the image handler. The proof of concept reuses a disclosed image signature to write and execute a PHP/JPEG polyglot. https://packetstorm.news/download/238036...

Node.js 26.12.0 DNS Resolution NUL Byte Truncation

Node.js versions prior to 22.23.4, 24.22.1, and 26.12.1 contain a DNS resolution NUL byte truncation vulnerability that may allow a hostname allow-list bypass. https://packetstorm.news/download/238035...

NETGEAR RAX120 V1.2.5.18 SOAP InstallApp Command Injection

NETGEAR RAX120 version V1.2.5.18 contains an authenticated SOAP InstallApp application-name command injection. The proof of concept sends a crafted request that executes a supplied command on the affected router. https://packetstorm.news/download/238065...

...[ More ]

This Python proof-of-concept targets AXIS Camera Station through its Axis.Remoting communication interface, using a crafted .NET deserialization payload to achieve remote code execution. The exploit implements the application's encrypted communication protocol, including RSA certificate exchange,...

Moxa MAR-2000 FWR_MAR2000_V1.0_Build_15010909 Executer Program Argument Command Injection

Moxa MAR-2000 version FWRMAR2000V1.0Build15010909 contains an authenticated command injection in the Executer program table argument field. The proof of concept uploads a benign script, stores a crafted argument, and activates the program. https://packetstorm.news/download/238062...

Gotenberg 8.30.1 ExifTool Argument Injection

Gotenberg versions through 8.30.1 contain an ExifTool argument injection vulnerability in the PDF metadata write endpoint. The proof of concept submits newline-delimited metadata to inject an ExifTool argument and retrieve command output from the target. https://packetstorm.news/download/238043...

WordPress URL Shortify 1.12.1 Open Redirect

The WordPress URL Shortify plugin versions through 1.12.1 contain an unauthenticated open redirect via the redirectto parameter. The supplied Python proof of concept verifies the redirect and can construct a demonstration link. https://packetstorm.news/download/238051...

Fastjson 1.2.83 Remote Code Execution

Fastjson versions 1.2.68 through 1.2.83 contain a remote code execution vulnerability when parsing attacker-controlled JSON in a Spring Boot executable fat-JAR. A proof of concept is included. https://packetstorm.news/download/238048...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions before 12.68.0 and versions 13.0.0 through 13.28.0 contain a TokenGuard authentication bypass when token-based API guards use un-hashed tokens with MySQL or MariaDB. The proof of concept demonstrates authentication as an unintended user using a non-string credential...

Windows Common Log File System Driver Privilege Escalation

Windows Common Log File System Driver contains a privilege escalation vulnerability. This advisory documents a SOC investigation of detected exploitation activity and associated indicators. https://packetstorm.news/download/238031...

Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90 Command Injection

Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 version 3.90 contain an operating system command injection vulnerability in the web interface listbaseconfig.php template parameter. The supplied proof of concept writes and retrieves a marker file to verify command execution...

Pillow 12.3.0 JPEG Comment Heap Buffer Overflow

Pillow versions 9.4.0 through 12.3.0 contain a heap buffer overflow when a JPEG with an exact-fit ICC profile and comment is re-saved. https://packetstorm.news/download/238032...

PrimeFaces 5.2 Expression Language Injection

PrimeFaces version 5.2 contains an expression language injection vulnerability in dynamic content handling. The included proof of concept encrypts and submits an expression that can execute supplied JavaScript or operating system commands. https://packetstorm.news/download/238026...

FOG Project 1.5.10.1673 Authentication Bypass

FOG Project versions through 1.5.10.1673 contain an authentication bypass vulnerability that permits an unauthenticated database dump. Included proof of concept retrieves the dump and also demonstrates SSRF and file-listing requests. https://packetstorm.news/download/238017...

Microsoft Windows Error Reporting 10.0.26100.9549 Argument Injection

Microsoft Windows Error Reporting faultrep.dll version 10.0.26100.9549 contains an argument injection vulnerability that can allow an authorized local attacker to elevate privileges. Included is a proof of concept. https://packetstorm.news/download/238022...

WordPress Business Directory 6.4.2 SQL Injection

WordPress Business Directory plugin version 6.4.2 contains an unauthenticated time-based SQL injection vulnerability through the listingfields parameter. The supplied proof of concept demonstrates the affected search request. https://packetstorm.news/download/238011...

Brotli 1.1.0 Decoder out of Bounds Write

Brotli version 1.1.0 contains an out-of-bounds write in its decoder due to invalid block-switch handling. The proof of concept provides local staged crash, control-flow hijack, and Python requests RCE demonstrations. https://packetstorm.news/download/238037...

ST Engineering iDirect iQ200 4.5.2.1 Local Privilege Escalation

ST Engineering iDirect iQ-Series, 3315-Series, and 9-Series terminal versions through 4.5.2.1 contain a local privilege escalation via unauthenticated Redis IPC keys that cause sysmngr to execute an attacker-controlled script as root. https://packetstorm.news/download/238033...

NGINX 1.31.1 HTTP/3 QPACK Use-After-Free

NGINX versions 1.31.0 and 1.31.1 contain a use-after-free vulnerability in ngxhttpv3module. The included proof of concept demonstrates target-side command execution through a crafted HTTP/3 QPACK encoder stream when ASLR is disabled or bypassed. https://packetstorm.news/download/238030...

WordPress JS Archive List 6.1.5 SQL Injection

WordPress JS Archive List plugin version 6.1.5 and earlier contains an unauthenticated SQL injection vulnerability in the cats parameter of its REST API archive endpoint. The included proof of concept demonstrates identification with ghauri. https://packetstorm.news/download/238016...

WordPress Post SMTP 3.2.0 Privilege Escalation

WordPress Post SMTP versions through 3.2.0 contain an access-control flaw that allows authenticated low-privilege users to access email logs. This proof of concept obtains an administrator password-reset link from those logs. https://packetstorm.news/download/238014...

Microsoft Active Directory Certificate Services Windows Server 2025 Subject Key Identifier Spoofing

Microsoft Active Directory Certificate Services on Windows Server 2025 versions before 10.0.26100.3775 contains a weak authentication vulnerability that allows an authorized attacker to elevate privileges by supplying a chosen Subject Key Identifier during certificate enrollment...

Node.js 24.22.0 Brotli Decoder Denial of Service

Node.js version 24.22.0 contains a Brotli decoder out-of-bounds write vulnerability. The proof of concept sends a crafted Brotli stream that crashes a vulnerable Node.js service. https://packetstorm.news/download/238008...

LibreNMS 26.7.0 REST API Authentication Bypass

LibreNMS versions through 26.7.0 contain a REST API authentication bypass caused by API token type confusion. The supplied proof of concept uses the bypass to inventory devices and retrieve accessible API and SNMP data. https://packetstorm.news/download/238027...

VICIdial 2.14-917a Blind SQL Injection

VICIdial version 2.14-917a contains an unauthenticated time-based SQL injection vulnerability in VERMAJAXfunctions.php. The proof of concept sends crafted Basic Authentication requests to confirm the issue and extract database metadata or limited table data. https://packetstorm.news/download/2380...

HashiCorp consul-k8s 2.0.4 Cross-Namespace Authorization Bypass

HashiCorp consul-k8s versions 0.42.0 through 2.0.4 contain a cross-namespace authorization bypass in component ACL binding rules when system ACL management is enabled. The proof of concept creates a similarly named ServiceAccount in another namespace and attempts Consul ACL authentication...

Apache Tomcat 11.0.1 Race Condition / Remote Code Execution

Apache Tomcat versions 9.0.0.M1 through 9.0.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1 contain a race condition that can allow JSP execution when the DefaultServlet is writable on a case-insensitive filesystem. This proof of concept uses concurrent PUT and GET requests to...

WordPress WP01 2.6.2 Arbitrary File Download

WordPress WP01 plugin version 2.6.2 and earlier contains an unauthenticated arbitrary file download vulnerability that allows remote attackers to retrieve files from the server. https://packetstorm.news/download/238015...

WordPress TranslatePress 3.3.1 Unauthenticated Account Takeover

WordPress TranslatePress plugin versions through 3.3.1 disclose administrator password-reset URLs via the trpgettranslationsregular AJAX action, allowing an unauthenticated attacker to reset an affected account password. The included proof of concept automates disclosure and takeover...

Apple iOS / iPadOS 17.0.2 Kernel Privilege Escalation

Apple iOS and iPadOS versions before 16.7.1 and versions 17.0 through 17.0.2 contain a kernel issue that may allow a local attacker to elevate privileges. The included proof of concept attempts to demonstrate a copy-on-write bypass using Mach memory mappings. https://packetstorm.news/download/238...

Lobster_pro 4.12.12-LTS Token Replay / Privilege Escalation

Lobsterpro version 4.12.12-LTS and potentially other versions prior to 25.1.3 suffer from a privilege escalation vulnerability due to allowing use of non-privileged access to achieve administrative access. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Privilege escalation via request replaying ...

Polkit 0.119 Privilege Escalation

Polkit versions 0.113 through 0.119 contain a local privilege escalation vulnerability. The supplied Bash proof of concept uses interrupted D-Bus AccountService requests to create an administrative account and set its password. https://packetstorm.news/download/237894...

Juniper Junos OS Evolved 25.4 PTX Series Unauthenticated Remote Code Execution

Juniper Junos OS Evolved on PTX Series versions before 25.4R1-S1-EVO and 25.4R2-EVO contain an unauthenticated remote code execution vulnerability. The supplied proof of concept creates and executes a command through the affected configuration API. https://packetstorm.news/download/237898...

Checkov 3.2.531 Arbitrary Code Execution

Checkov versions 3.2.0 through 3.2.531 contain an arbitrary code execution vulnerability when scanning a directory containing an attacker-controlled configuration file. A proof of concept is provided. https://packetstorm.news/download/237897...

LaraDashboard 1.4.2 SVG Upload Cross Site Scripting

LaraDashboard versions 0.9.0 through 1.4.2 contain a stored cross site scripting vulnerability in SVG media uploads. Authenticated users with the media.create permission can upload an SVG whose script executes when another user opens the inline-served file. https://packetstorm.news/download/23788...

Onyx 5.0.0 Cross Site Scripting

Onyx versions through 5.0.0 contain a cross site scripting vulnerability in the Craft output preview. The proof of concept demonstrates that same-origin preview content with scripts enabled can modify its parent document. https://packetstorm.news/download/237885...

Langflow OSS 1.12.4 Authenticated Remote Code Execution

Langflow OSS versions 1.0.0 through 1.12.4 contain an authenticated code injection vulnerability that allows arbitrary code execution on the server. The proof of concept submits a crafted custom component to the update endpoint. https://packetstorm.news/download/237878...

LaraDashboard 1.2.2 Path Traversal

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in core-upgrade backup handling, permitting a user with settings.edit to delete arbitrary files or restore an on-disk archive into application directories. The proof of concept verifies vulnerable source markers and...