Pillow 12.3.0 JPEG Decoder Heap Buffer Overflow

Pillow version 12.3.0 and earlier contain a heap buffer overflow in ImagingJpegDecode when thumbnail processes an 8-bit lossless SOF3 JPEG with libjpeg-turbo 3.x. https://packetstorm.news/download/237261...

Anuko Time Tracker 1.20.0.5640 SQL Injection

Anuko Time Tracker versions prior to 1.20.0.5642 contain an authenticated SQL injection vulnerability in the Puncher plugin. A proof of concept is provided to inject a scalar SQL query through the date parameter and read its result. https://packetstorm.news/download/237259...

Node.js 26.12.0 Brotli Decoder out of Bounds Write

Node.js versions 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1 contain an out of bounds write in the Brotli decoder that can lead to remote code execution. Included is a proof of concept. https://packetstorm.news/download/237258...

PHP 8.4.26 Remote Code Execution

PHP core versions after 5.4 contain a vulnerability that can result in remote code execution. This proof of concept targets PHP version 8.4.26 running as modphp with a prefork Apache configuration. !/usr/bin/env python3 """ Exploit credited to 9bie, adjusted using AI by OffSec php2shell - one-cli...

PHP 8.5.11 Multipart OOM Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain out-of-memory and stale request-state flaws that can lead to remote code execution. The supplied proof of concept demonstrates multipart upload-progress trigger paths. https://packetstorm.news/download/237257...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain remote code execution vulnerabilities involving out-of-memory bailout handling and stale request-global state. https://packetstorm.news/download/237024...

nginx 1.31.6 TLS Session Ticket Forgery

nginx versions 1.23.2 through 1.31.6 contain a TLS session-ticket forgery issue that can allow session resumption without client-certificate authentication. The proof of concept forges a ticket using an uninitialized key slot. https://packetstorm.news/download/237045...

PHP 8.5.11 OOM Corruption Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory corruption issue in Apache modphp that can result in remote code execution. This proof of concept demonstrates the issue in PHP version 8.2.6 using a local Docker environment. https://packetstorm.news/download/237033...

PHP 8.5.11 Stale Worker Global State Use-After-Free

PHP version 8.5.11 contains a stale worker-global state use-after-free vulnerability. This proof of concept exercises the fatal-backtrace producer and pre-initialization diagnostic consumer in a local lab. https://packetstorm.news/download/237035...

PHP 8.5.11 Pre-Application OOM Use-After-Free

PHP version 8.5.11 contains a pre-application multipart parsing flaw that can leave stale worker state after an out-of-memory abort. The supplied proof of concept sends chunked multipart requests to demonstrate the affected session upload-progress path. https://packetstorm.news/download/237036...

NGINX 1.31.2 Map Regex Heap Overflow

NGINX versions through 1.31.2 contain a heap buffer overflow when map directives use regex capture variables. The supplied proof of concept demonstrates pre-authentication remote code execution in a laboratory configuration. https://packetstorm.news/download/237028...

PHP 8.0.30-6 Out-Of-Memory Remote Code Execution

PHP version 8.0.30-6 on EL7 Remi builds is vulnerable to out-of-memory state corruption that can lead to remote code execution. This submission provides a backported mitigation and a Docker proof of concept demonstrating affected session upload progress, local file inclusion, and OOM behavior...

NGINX 1.30.0 Rewrite Heap Buffer Overrun

NGINX versions 0.6.27 through 1.30.0 contain a heap buffer overrun in rewrite handling. Included proof of concept demonstrates denial of service and a lab-targeted remote code execution chain. https://packetstorm.news/download/237029...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain OOM-corruption and stale-global-state flaws that can lead to remote code execution. This proof of concept supplies local-lab reproduction, OOM probes, and version detection. https://packetstorm.news/download/237027...

PHP 8.5.11 OOM Handling Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain out-of-memory handling flaws. This proof of concept sends multipart uploads to reach an OOM path and demonstrates a session-lock leak and worker denial of service in a local PHP 8.4.24 lab. https://packetstorm.news/download/237021...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory request-state corruption flaw. This proof of concept demonstrates a build-specific unauthenticated command-execution chain against PHP version 8.4.7 Apache/modphp using a related stale-global-state flaw...

JetBrains YouTrack Helpdesk Account Takeover

JetBrains YouTrack Helpdesk versions before 2025.3.161254 and 2026.1.14042 contain an improper authentication vulnerability that allows unauthenticated account takeover through a self-asserted reporter email address. This proof of concept obtains a reporter session, changes its email address, and...

PHP 8.4.26 Remote Code Execution

PHP version 8.4.26 contains upload-progress and stale-state vulnerabilities that can allow unauthenticated remote code execution. This proof of concept targets Apache modphp prefork deployments. https://packetstorm.news/download/237017...

Node.js 26.12.0 dns.resolve NUL Byte Truncation

Node.js versions 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1 contain a dns.resolve NUL byte truncation flaw that can bypass host allow-list checks. https://packetstorm.news/download/237016...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions before 12.68.0 and 13.29.0 contain an authentication bypass in TokenGuard. The proof of concept submits a non-string apitoken value to cause unintended credential matching on MySQL or MariaDB. https://packetstorm.news/download/237014...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 contains a stale request-global state flaw that can be triggered through session upload-progress multipart handling, allowing code execution in the supplied Docker lab. https://packetstorm.news/download/237010...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 and prior affected versions contain use-after-free vulnerabilities that can lead to unauthenticated remote code execution. This proof of concept targets PHP 8.4.26 with Apache modphp prefork. https://packetstorm.news/download/237019...

PHP 8.4.26 Remote Code Execution

PHP version 8.4.26 contains a memory-corruption issue triggered by request parsing under memory exhaustion. The supplied proof of concept uses crafted multipart requests to leak addresses and execute a command against a vulnerable Apache/modphp target. https://packetstorm.news/download/237008...

Node.js 26.12.0 Brotli Decoder Out-of-Bounds Write

Node.js versions before 22.23.4, 24.22.1, and 26.12.1 contain a Brotli decoder out-of-bounds write vulnerability that permits remote code execution. The included proof of concept sends crafted Brotli request data to a vulnerable service. https://packetstorm.news/download/237004...

MongoDB Server 8.2.2 Zlib Memory Disclosure

MongoDB Server versions through 8.2.2 contain an unauthenticated memory disclosure issue caused by mismatched lengths in zlib-compressed protocol headers. The proof of concept sends malformed compressed messages and extracts returned heap fragments. https://packetstorm.news/download/237022...

NocoBase 2.0.60 SQL Injection

NocoBase versions prior to 2.0.61 contain an SQL injection vulnerability in the in-app message notification filter. The supplied proof of concept registers a user, authenticates, and submits a time-based SQL injection probe to the affected endpoint. https://packetstorm.news/download/237002...

PHP 8.5.11 Multipart Exploitation Detection

A Sigma rule detects external multipart POST requests returning 500 or 502 errors, which may indicate attempts to exploit PHP memory corruption vulnerabilities. https://packetstorm.news/download/237001...

RedisBloom 2.8.23 CMSketch RDB Load Integer Overflow

RedisBloom versions 2.0.0 through 2.8.23 contain an integer overflow in CMSketch RDB loading. The proof of concept demonstrates a crafted serialized object triggering a Redis server crash. https://packetstorm.news/download/236998...

GeoServer 2.25.1 OGC Filter Evaluation Remote Code Execution

GeoServer versions 2.22.5 and earlier, 2.23.5 and earlier, 2.24.0 through 2.24.3, and 2.25.0 through 2.25.1 contain an OGC request-parameter evaluation flaw that allows unauthenticated remote code execution. https://packetstorm.news/download/236996...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory request parsing vulnerability that can lead to remote code execution. The included proof of concept targets Apache modphp using multipart form input and session upload progress handling...

Keycloak 26.7.1 Unauthenticated Account Takeover

Keycloak versions 26.0.0 through 26.4.14, 26.5.0 through 26.6.5, and 26.7.0 through 26.7.1 contain a reset-credentials flow bypass that can allow an unauthenticated attacker to set a user password. Exploit Title: Keycloak 26.7.2 - Unauthenticated Account Takeover Date: 2026-10-15 Exploit Author:...

Apache CarbonData 2.3.2 Index Server Java Deserialization

Apache CarbonData version 2.3.2 contains a Java deserialization vulnerability in the Distributed Index Server Hadoop IPC endpoint that may allow remote code execution when a suitable gadget class is available on the server classpath. !/usr/bin/env bash Apache CarbonData 2.3.2 Index Server Java...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP version 8.5.11 contains a use-after-free in session upload progress handling that can lead to remote code execution. This proof of concept targets an isolated local Apache container. https://packetstorm.news/download/236991...

PHP 8.5.11 Stale Global State Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain a stale global state use-after-free condition that can lead to remote code execution. https://packetstorm.news/download/236995...

PHP 7.0.33 Multiple Vulnerability Backport

PHP version 7.0.33 is affected by out-of-memory request-state corruption and stale request-owned state issues. This unofficial source backport mitigates the flaws and includes differential proof of concept verification scripts. https://packetstorm.news/download/236982...

PHP 8.4.26 Session Upload Progress Remote Code Execution

PHP version 8.4.26 contains an issue involving requestparsebody and session upload-progress handling. This proof of concept demonstrates chained unauthenticated remote code execution in a lab application and contrasts the behavior with PHP 8.4.27. https://packetstorm.news/download/236981...

Open eClass 3.15 Shell Upload

Open eClass version 3.15 contains an unrestricted file upload vulnerability that allows authenticated users to upload a PHP shell and execute commands remotely. Exploit Title: Open eClass 3.15 - RCE Date: Mar 15, 2024 Exploit Author: Georgios Roumeliotis Vendor Homepage: https://www.openeclass.or...

PHP 8.5.11 OOM and Stale State Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain OOM-corruption and stale-global-state flaws that can lead to unauthenticated remote code execution. This proof of concept targets affected session upload progress handling. https://packetstorm.news/download/236977...

PHP 8.5.11 Multipart Remote Code Execution

PHP version 8.5.11 contains multipart parsing vulnerabilities that can lead to remote code execution. This package provides a lab proof of concept and validation tooling. https://packetstorm.news/download/236978...

PHP 8.4.26 session.upload_progress Remote Code Execution

PHP version 8.4.26 with Apache modphp contains a session.uploadprogress stale-pointer condition that can be exploited remotely without authentication to leak memory and execute commands. This proof of concept targets a pinned Docker image. https://packetstorm.news/download/236989...

Node.js 24.9.0 Brotli Decoder Memory Corruption

Node.js version 24.9.0 contains a Brotli decoder memory-corruption issue. This proof of concept demonstrates bounded command execution in a deliberately non-PIE local harness and a crash or bounded memory disclosure in stock Node.js. https://packetstorm.news/download/236997...

...[ More ]

NetScaler ADC and Gateway 13.1 before build 64.23 and 14.1 before build 73.37 copy an unauthenticated failed-login username into system logs. During a later diagnostic run, nsmonuploadderr.pl mistakes a crafted login record for a packet-engine failure and inserts attacker-controlled text into a...

PHP 8.2.x / 8.3.x / 8.4.x / 8.5.x Affected Checker

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain a use-after-free flaw during OOM handling. This tool fingerprints exposed PHP version banners to identify potentially affected systems without attempting exploitation. https://packetstorm.news/download/237070...

Gitea 1.27.0 Arbitrary File Read

Gitea versions 1.22.1 through 1.27.0 contain an unauthenticated arbitrary file-read vulnerability in Org-mode markup rendering. The supplied Python proof of concept requests a specified server-side file through a public repository markup endpoint. https://packetstorm.news/download/237059...

WordPress 7.0.1 Remote Code Execution

WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 contain a REST API batch route-confusion flaw and a WPQuery SQL injection flaw that can be chained for unauthenticated remote code execution. https://packetstorm.news/download/237062...

PHP 8.5.5 JSON Encoding Use-After-Free

PHP versions 8.4.x and 8.5.x contain a use-after-free in jsonencode when a nested JsonSerializable callback resizes the encoded object's property table. A proof of concept is included. https://packetstorm.news/download/237054...

PHP 8.5.12 Fiber Callable Use-After-Free

PHP version 8.5.12 and earlier affected versions contain a Fiber callable use-after-free vulnerability that can lead to type confusion, information disclosure, and remote code execution. Proof of concept code is included. https://packetstorm.news/download/237053...

PHP 8.5.11 Session Upload Progress Use-After-Free

PHP version 8.5.11 session.uploadprogress handling contains a cross-request use-after-free caused by stale decoder state. The included proof of concept builds a local PHP server and triggers a worker crash with two local multipart requests. https://packetstorm.news/download/237068...

PHP 8.5.11 session.upload_progress Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain session.uploadprogress state-corruption vulnerabilities that may permit unauthenticated remote code execution. This proof of concept exercises upload-progress and out-of-memory failure paths, with optional LFI-assisted command...

Gitea 1.25.1 User Enumeration

Gitea version 1.25.1 contains a user enumeration vulnerability that returns distinct API authentication errors for nonexistent accounts and invalid passwords. The proof of concept identifies registered usernames and exposed user IDs. https://packetstorm.news/download/237072...