51571 matches found
...[ More ]
There is a critical authentication bypass vulnerability residing within Kestra OSS's core request-filtering mechanism. Due to insecure suffix-matching logic instead of strict routing or exact segment validation, attackers can craft custom request paths that bypass security controls. This allows...
...[ More ]
Apache Submarine retired to the Apache Attic suffers from an authentication bypass leading to unauthenticated remote code execution. The security filter CommonFilter.isProtectedApi treats any request whose User-Agent header matches the Python SDK pattern as not requiring authentication, and the...
moosocial Social-Commerce 3.2.4 SQL Injection
moosocial Social-Commerce version 3.2.4 suffers from a remote SQL injection vulnerability. Exploit Title: moosocial Social-Commerce 3.2.4 - SQL Injection time-based blind Exploit Author: CraCkEr Date: 26/08/2026 Vendor: mooSocial Vendor Homepage: https://moosocial.com/ Software Link:...
...[ More ]
This Metasploit module exploits CVE-2000-0979, an information disclosure vulnerability in the share-level password authentication of Microsoft Windows 9x/Me SMB servers. The server validates passwords one character at a time, allowing an attacker to enumerate the correct password byte-by-byte bas...
Krayin CRM 2.2.4 Authentication Bypass
Krayin CRM version 2.2.4 contains an authentication bypass in its installer API that allows an unauthenticated remote attacker to overwrite the super administrator account. https://packetstorm.news/download/233761...
SuiteCRM 8.10.1 Authenticated Server-Side Request Forgery
SuiteCRM versions through 7.15.1 and 8.10.1 contain an authenticated server-side request forgery vulnerability in CalendarAccount testConnection. The proof of concept submits a supplied CalDAV server URL to demonstrate server-side request handling. https://packetstorm.news/download/233762...
POMS PHP 1.0 SQL Injection
The password parameter in POMS PHP By Oretnom23 version 1.0 suffers from a remote SQL injection vulnerability. https://packetstorm.news/download/233756...
InvoicePlane 1.7.1 Configuration Injection Remote Code Execution
InvoicePlane version 1.7.1 contains a setup-module configuration injection vulnerability that can manipulate environment settings and potentially lead to remote code execution. https://packetstorm.news/download/233763...
MikroTik RouterOS 7.23.3 SSH Authentication Bypass / Remote Code Execution
MikroTik RouterOS versions prior to 6.49.21, 7.23.4, and 7.24.2 contain an SSH authentication bypass that can allow an unauthenticated remote attacker to obtain a full administrator session. This proof of concept chains a pre-authentication SSH rekey issue with a session policy-mask handling flaw...
...[ More ]
GDCM Grassroots DICOM is an open-source C++ library for reading, writing, and processing DICOM Digital Imaging and Communications in Medicine medical imaging files. The gdcmFilenameGenerator component, used by the gdcmraw command-line tool to generate output filenames for split fragments, is...
Tree::from_data Decompression Bomb
There is a decompression bomb causing memory exhaustion and an OOM kill, denying service to any application that passes attacker-controlled SVG bytes to usvg::Tree::fromdata. The svgz feature is enabled by default, and SVG upload or conversion endpoints that use usvg are typically reachable befor...
...[ More ]
GDCM Grassroots DICOM is an open-source C++ library for reading, writing, and processing DICOM Digital Imaging and Communications in Medicine medical imaging files. GDCM's command-line tool gdcmxml, which converts between XML and DICOM file formats, is vulnerable to a stack-based buffer overflow ...
...[ More ]
GDCM Grassroots DICOM is an open-source C++ library for reading, writing, and processing DICOM Digital Imaging and Communications in Medicine medical imaging files. The JPEG2000 image codec in GDCM, used for decoding JPEG2000-compressed DICOM pixel data, is vulnerable to an integer overflow that...
Harness Blind SQL Injection
Harness open source Gitness suffers from a registry related blind SQL injection vulnerability. https://packetstorm.news/download/233045...
openEQUELLA Deserialization / SSTI Remote Code Execution
openEQUELLA versions prior to 2026.1.0 contain authenticated remote code execution vulnerabilities involving unsafe Java deserialization and FreeMarker server side template injection. The deserialization issue allows an authenticated non-guest user to bypass a class denylist using a nested...
Harness Hardcoded Password
Harness has a hardcoded password that can be leveraged by an attacker who can reach a Gitspace's published SSH or IDE endpoint. https://packetstorm.news/download/233046...
Honeywell IQ MultiAccess Update Service 27 / 28 Privilege Escalation
Honeywell IQ MultiAccess Update Service suffers from a local privilege escalation vulnerability. Due to a named pipe configured with a NULL DACL a low-privileged user can use the pipe to communicate with the IQUpdSrv service running as SYSTEM. When providing specific data over the pipe, arbitrary...
dive Arbitrary File Write
dive suffers from an arbitrary file write vulnerability that occurs via a traversal. https://packetstorm.news/download/233044...
h5p-nodejs-library Cross Site Scripting
A persistent cross site scripting vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions prior to 9.3.3. The vulnerability allows users to inject malicious JavaScript code in text fields. This code is then executed in victims' browsers when viewing...
...[ More ]
Apache Karaf's JAAS LDAP login module is affected by LDAP filter injection. The user and role LDAP search filters are built in LDAPCache by string substitution: each placeholder %u for the username, %dn for the user DN, %fqdn for the fully qualified DN is inserted with java.util.regex...
...[ More ]
GDCM Grassroots DICOM is an open-source C++ library for reading, writing, and processing DICOM Digital Imaging and Communications in Medicine medical imaging files. The library function gdcm::System::EncodeBytes, defined in Source/Common/gdcmSystem.cxx, is vulnerable to a stack-based buffer...
...[ More ]
GDCM Grassroots DICOM is an open-source C++ library for reading, writing, and processing DICOM Digital Imaging and Communications in Medicine medical imaging files. The gdcmstream command-line tool, used for stream-based reading and writing of DICOM images, is vulnerable to an integer overflow th...
...[ More ]
Apache BuildStream's tar source plugin extracts archives without safely resolving symbolic links link following. A malicious source tarball can include a symlink entry that points outside the staging directory and then a file entry that writes through it, so a crafted upstream source can create o...
XMEye Sofia WFS Use-After-Free
XMEye Sofia contains a potential use-after-free vulnerability in its WFS block buffer cache due to unsynchronized reference count operations. Concurrent access can cause a buffer that is still referenced by one thread to be treated as free and repurposed for another block, resulting in a stale...
SAP NetWeaver Extended Passport Remote Code Execution
SAP NetWeaver AS ABAP and Java and SAP Web Dispatcher contain a stack based buffer overflow vulnerability in Extended Passport processing. Missing bounds validation of attacker-supplied metadata allows an unauthenticated remote attacker to corrupt stack memory and execute arbitrary code through...
Intelbras RF 1200 / RG 1200 Authentication Bypass
Intelbras RF 1200 firmware 1.2.4 and RG 1200 firmware 2.1.9 contain an authentication bypass vulnerability in the GoAhead web server. An unauthenticated LAN attacker can manipulate the request URI to bypass authentication and access protected endpoints, including downloading the device...
H5P Nodejs Library 10.0.4 Cross Site Scripting
Lumi Education h5p-nodejs-library versions through 10.0.4 contain a cross site scripting vulnerability due to insufficient validation of files contained in uploaded H5P content. An attacker can upload content containing malicious JavaScript that executes in another user's browser when the affecte...
...[ More ]
Apache PDFBox version 3.0.8 is prone to a denial of service condition caused by a disproportionate heap allocation in the Flate decode PNG predictor path. When a stream is filtered with FlateDecode and a predictor is declared, PDFBox sizes an internal decoding buffer directly from the PDF-supplie...
...[ More ]
This Metasploit module exploits CVE-2026-85706, an unauthenticated arbitrary file read in the GitLab repository commits and files APIs. A path parsing discrepancy between GitLab Workhorse and Rails allows unsigned upload metadata to reach the Rails handler, where an attacker-controlled local path...
Langflow AI Custom Component Authenticated Remote Code Execution
Langflow versions 1.0.0 through 1.11.1 are susceptible to authenticated remote code execution due to improper enforcement of security restrictions of code generation on the /api/v1/customcomponent endpoint. The endpoint accepts attacker controlled code that is then passed to Pythons exec function...
iLEAPP 2026.4.0 Cross Site Scripting
iLEAPP version 2026.4.0 is vulnerable to persistent cross site scripting in the generated SMS/iMessage chat HTML report. https://packetstorm.news/download/231359...
Easy Media Replace 0.2.0 Cross Site Scripting
Easy Media Replace version 0.2.0 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231132...
...[ More ]
Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the...
WordPress Popup for CF7 with Sweet Alert 1.6.5 Cross Site Request Forgery
WordPress Popup for CF7 with Sweet Alert plugin versions 1.6.5 and below suffer from a cross site request forgery vulnerability. https://packetstorm.news/download/231122...
WordPress WP-Stats 2.5.6 Cross Site Scripting
WordPress WP-Stats plugin versions 2.5.6 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231119...
...[ More ]
This Metasploit module chains three issues in SonicWall SMA1000 appliances. An unauthenticated, absolute-form OPTIONS request makes the WorkPlace listener act as an unintended forward proxy CVE-2026-83548. The module uses this access and a vendor-installed CouchDB update handler to obtain read an...
Next.js Unauthenticated Remote Code Execution
This Metasploit module exploits a remote code execution vulnerability in Next.js applications hosted on Windows servers. Specifically crafted requests can execute arbitrary code on the target server. The affected versions include releases from 13.4.0 up to 15.5.24, and 16.0.0 up to 16.3.3,...
...[ More ]
This Metasploit module exploits CVE-2026-20079, an authentication bypass in the web interface of Cisco Secure Firewall Management Center FMC. It upgrades a boot-created machine session, obtains its session-specific action token, writes a Makeself-compatible shell script, and executes the selected...
...[ More ]
Tozed ZLT X300 5G CPE Router firmware version 6.01.3 contains an OS command injection vulnerability in the TR-069/CWMP client daemon netcwmpd. The IPPingDiagnostics Host parameter is passed unsanitized into sprintf, which constructs a shell command executed via systembyroot as root. An attacker...
1CMS 5.6 Cross Site Scripting
1CMS version 5.6 suffers from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231034...
Langflow AI Authenticated Remote Code Execution
Langflow versions 1.11.1 and below are susceptible to authenticated remote code execution. By saving a flow where data.type is empty, an authenticated user can bypass the flow guard and execute arbitrary Python code. https://packetstorm.news/download/231016...
SPIP Autosave Session Unauthenticated Remote Code Execution
This Metasploit module exploits an unauthenticated RCE in SPIP less than or equal to 4.4.21 via the forum autosave session handler. The action=session endpoint allows any visitor to store arbitrary data in a PHP session variable. By writing PHP code into an autosaveforum session key, the code is...
Zimbra Collaboration Suite 10.1.19 Command Injection
Zimbra Collaboration Suite versions 10.1.1 through 10.1.19 suffer from command injection via SMTP log poisoning. https://packetstorm.news/download/230686...
O-CMS 1.0.0 Command Injection
O-CMS version 1.0.0 contains an authenticated OS command injection vulnerability in the AI CLI configuration functionality. An authenticated attacker with sufficient privileges can supply shell metacharacters and additional commands through the aicliscript parameter of /admin/settings/save...
Flextype CMS 1.0.0-alpha.3 Expression Injection
Flextype CMS version 1.0.0-alpha.3 contains a stored arbitrary expression injection vulnerability in the Entries ExpressionsDirective. An authenticated remote attacker with sufficient privileges to create or modify entries can persist arbitrary expression syntax within an entry field...
...[ More ]
Flextype CMS version 1.0.0-alpha.3 contains a stored server-side request forgery SSRF vulnerability in its shortcode-processing functionality. Attacker-controlled entry fields can be automatically processed by Flextype's shortcode parser. The built-in fetch shortcode accepts an attacker-controlle...
...[ More ]
Payara Server contains a vulnerability in its Server-Side Includes SSI implementation that allows arbitrary operating system command execution via the exec directive. The issue occurs because user-controlled SSI directives are passed directly to Runtime.exec without validation, sanitization, or...
...[ More ]
A stack-based buffer overflow vulnerability exists in the htpasswd utility bundled with thttpd. The vulnerability occurs due to unsafe copying of a user-supplied command-line argument into a fixed-size stack buffer without proper bounds checking.Specifically, the program copies the username...
Paho 1.3.15 Path Hijacking / Code Execution
Arbitrary code execution is possible in the MQTTVersion utility of Paho version 1.3.15 due to uncontrolled loading of shared libraries using non-absolute paths. The application invokes dlopen with relative library names and relies on the dynamic loader’s search path to resolve the target library...
...[ More ]
Eclipse Paho MQTT C Client contains a heap use-after-free vulnerability in the synchronous MQTT client libpaho-mqtt3c when handling incoming PUBLISH messages with retry semantics. When a user-supplied messageArrived callback frees the received message and returns 0 indicating processing failure a...