Filament 5.6.4 Unauthenticated Temporary File Upload

Filament versions 3.0.0 through 3.3.51, 4.0.0 through 4.11.4, and 5.0.0 through 5.6.4 contain an unauthenticated temporary-file upload issue on authentication pages. The proof of concept uploads test files and checks retrieval paths. https://packetstorm.news/download/238694...

OpenSTAManager 2.10 Shell Upload

OpenSTAManager versions 2.10 and earlier contain an arbitrary file upload vulnerability in the module update functionality. The included proof of concept authenticates, creates a malicious module containing a PHP shell, and uploads it. https://packetstorm.news/download/238693...

Realtek SDK miniigd Command Injection

Realtek SDK miniigd contains an unauthenticated OS command injection vulnerability in UPnP WANIPConnection AddPortMapping handling. The proof of concept submits a controlled NewInternalClient value. https://packetstorm.news/download/238692...

Guangzhou 1GE ONU formPing Command Injection

Guangzhou 1GE ONU V2801RW and V2804RGW devices contain an unauthenticated command injection vulnerability in the formPing targetaddr parameter. The included proof of concept demonstrates the issue. https://packetstorm.news/download/238683...

Gogs 0.13.3 Symlink Arbitrary File Write

Gogs version 0.13.3 and prior contain a symlink handling flaw in the PutContents API that allows an authenticated user to overwrite files writable by the Gogs process. The supplied proof of concept demonstrates the issue. https://packetstorm.news/download/238685...

Samba 3.0.20 Username Map Script Command Injection

Samba version 3.0.20 through 3.0.25rc3 with username map script enabled contains a command injection vulnerability that allows unauthenticated remote command execution. This proof of concept delivers a reverse shell payload through a crafted SMB username. https://packetstorm.news/download/238684...

Cacti 1.2.28 Authenticated Arbitrary File Creation / Remote Code Execution

Cacti version 1.2.28 and prior contain an authenticated arbitrary file creation vulnerability in graph template handling that can lead to remote code execution. This proof of concept writes and triggers a PHP payload through crafted rrdtool graph options. https://packetstorm.news/download/238686...

FreePBX Endpoint Manager 17.0.2 SQL Injection / Remote Code Execution

FreePBX Endpoint Manager versions before 15.0.66, 16.0.89, and 17.0.3 contain an unauthenticated SQL injection vulnerability that allows database manipulation and remote code execution. Included proof of concept inserts a cron job to execute commands as asterisk...

React 19.2.0 React Server Components Remote Code Execution

React Server Components version 19.2.0 and earlier affected releases contain an unsafe deserialization issue that permits unauthenticated remote code execution. This proof of concept sends a crafted Flight payload to execute a supplied command. https://packetstorm.news/download/238687...

TOTOLINK A810R Firmware 4.1.2cu.5182_B20201026 Pre-Authentication Remote Command Execution

TOTOLINK A810R firmware version 4.1.2cu.5182B20201026 contains a pre-authentication remote command execution vulnerability in setNoticeCfg through the NoticeUrl parameter. The proof of concept demonstrates the issue against a local lab model or a user-supplied device...

Flowise 3.0.5 Account Takeover

Flowise version 3.0.5 and earlier return a valid password-reset tempToken from the unauthenticated forgot-password endpoint, allowing an attacker to reset an arbitrary account password and take over the account. The proof of concept demonstrates the reset flow...

ASUS RT-AX55 3.0.0.4.386.51598 Command Injection

ASUS RT-AX55 firmware version 3.0.0.4.386.51598 contains an authenticated OS command injection vulnerability in the qosbwrulelist parameter of /startapply.htm. A proof of concept and local laboratory model are included. https://packetstorm.news/download/238691...

Anyscale Ray 2.8.0 Job Submission API Code Execution

Anyscale Ray versions 2.6.3 and 2.8.0 allow remote attackers to execute arbitrary code via the unauthenticated job submission API. https://packetstorm.news/download/238680...

ASUS RT-AX55 3.0.0.4.386.51598 Command Injection

ASUS RT-AX55 firmware version 3.0.0.4.386.51598 contains an authenticated command injection vulnerability in its token-refresh module. The included proof of concept submits a benign marker payload. https://packetstorm.news/download/238681...

pfSense pfBlockerNG 2.1.4_27 Host Header Command Injection

pfSense pfBlockerNG through version 2.1.427 allows remote attackers to execute OS commands as root via a crafted HTTP Host header. The included proof of concept uses a benign marker-file payload. https://packetstorm.news/download/238682...

ClickHouse Server 26.10.2.103 Brotli Decoder out of Bounds Write

ClickHouse Server version 26.10.2.103 contains an unauthenticated out-of-bounds write in its bundled Brotli decoder that can permit arbitrary code execution under certain conditions. The proof of concept detects vulnerable servers and demonstrates denial of service...

Zyxel VMG4325-B10A Firmware 1.00(AAFR.4)C0_20170615 Insecure Default Credentials

Zyxel VMG4325-B10A firmware version 1.00AAFR.4C020170615 contains insecure default credentials for its Telnet function. The included proof of concept authenticates to a target service and invokes id after a successful login. https://packetstorm.news/download/238679...

WordPress Checkout Files Upload for WooCommerce 2.3.0 Shell Upload

WordPress Checkout Files Upload for WooCommerce versions before 2.4.0 contain an unauthenticated arbitrary file upload vulnerability that can lead to remote code execution when PHP is executable from the uploads directory. https://packetstorm.news/download/238668...

pgAdmin 4 9.18 Service Account Kerberos Authentication Bypass

pgAdmin 4 versions through 9.18 contain a service-account Kerberos credential leak that allows an authenticated web user to authenticate to a GSSAPI PostgreSQL server as the pgAdmin service principal. https://packetstorm.news/download/238653...

Roundcube Webmail 1.6.7 Cross Site Scripting

Roundcube Webmail version 1.6.7 and earlier contains a cross site scripting vulnerability in post-processing of sanitized HTML email, allowing crafted email content to execute JavaScript when viewed. https://packetstorm.news/download/238660...

WordPress IvyForms 1.5.1 Shell Upload

WordPress IvyForms plugin version 1.5.1 and earlier contains an arbitrary file upload vulnerability that allows a user with custom form-editing access to configure executable extensions and upload a PHP payload through a published form. https://packetstorm.news/download/238670...

Puwell IP Camera 4.x DebugShell Command Injection

Puwell IP Camera firmware versions 2.x through 4.x contain an unauthenticated command injection vulnerability in the DebugShell interface on TCP port 34567. The supplied proof of concept sends JSON commands to demonstrate execution. https://packetstorm.news/download/238662...

Apple Safari 27.1 LinkPresentation HEIC Out-Of-Bounds Write

Apple Safari versions before 27.2 contain an out-of-bounds write in LinkPresentation when processing a maliciously crafted HEIC image. The proof of concept generates and serves a two-frame HEIC trigger. https://packetstorm.news/download/238652...

Oracle E-Business Suite 12.2.15 SQL Injection

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain an unauthenticated SQL injection issue in the Thin Client Framework servlet. The supplied proof of concept sends crafted TCF requests to execute SQL as the APPS database user. https://packetstorm.news/download/238651...

Ubuntu 18.04 OverlayFS Privilege Escalation

Ubuntu version 18.04 Server OverlayFS contains a local privilege escalation vulnerability. This proof of concept demonstrates gaining root privileges through CVE-2021-3493. https://packetstorm.news/download/238658...

Apache ActiveMQ Classic 5.18.2 OpenWire Remote Code Execution

Apache ActiveMQ Classic version 5.18.2 is vulnerable to remote code execution through unsafe deserialization of OpenWire ExceptionResponse data. This proof of concept supplies a local Docker lab, version checker, and Spring XML generator for CVE-2023-46604. https://packetstorm.news/download/23867...

SUSE Rancher Manager 2.15.2 Local Cluster Shell Authorization Bypass

SUSE Rancher Manager versions 2.11.0 through 2.11.18, 2.12.0 through 2.12.14, 2.13.0 through 2.13.10, 2.14.0 through 2.14.6, and 2.15.0 through 2.15.2 contain an authorization bypass that allows an authenticated user without local-cluster access to obtain a shell pod on the management cluster. A...

Linear eMerge E3-Series 1.00-06 Command Injection

Linear eMerge E3-Series version 1.00-06 and earlier contain an unauthenticated command injection in cardscandecoder.php. This proof of concept uses the hard-coded root credentials tracked as CVE-2019-7261 to execute a benign marker command. https://packetstorm.news/download/238664...

NextGen Mirth Connect 4.3.0 Unauthenticated Remote Command Execution

NextGen Mirth Connect version 4.3.0 contains an unauthenticated remote command execution vulnerability through unsafe XStream deserialization. The proof of concept submits a crafted XML request to the API users endpoint. https://packetstorm.news/download/238663...

node-forge 1.4.0 Incomplete PKCS#7 Padding Validation

node-forge versions 1.4.0 and below contain incomplete PKCS7 padding validation in AES and DES CBC and ECB decryption. The supplied proof of concept demonstrates malformed ciphertext being accepted as valid padding. https://packetstorm.news/download/238666...

MikroTik RouterOS 7.24.1 TFTP Privilege Escalation

MikroTik RouterOS versions 6.0 through 6.49.20 and 7.1.5 through 7.24.1 contain an authenticated TFTP request overflow that can allow a read-group user to rewrite group policy and gain full privileges. https://packetstorm.news/download/238661...

Grafana 13.2.4 Alerting Contact Point Authorization Bypass

Grafana versions 12.4.0 through 12.4.13, 13.0.0 through 13.0.11, 13.1.0 through 13.1.8, and 13.2.0 through 13.2.4 contain an authorization bypass that allows contact point destination changes through a legacy schema downgrade. https://packetstorm.news/download/238646...

ASUSWRT 3.0.0.4.376_1071 Authentication Bypass / Command Execution

ASUSWRT version 3.0.0.4.3761071 and other versions contain an authentication bypass in infosvr that allows remote attackers to execute arbitrary commands with a crafted NETCMDIDMANUCMD packet sent to UDP port 9999. The proof of concept provides a local lab and packet generator...

Delinea Privilege Manager 13.0.1058 Unauthenticated Remote Code Execution

Delinea Privilege Manager agent versions 10.1.0 through 12.0.5796 and 13.0.0 through 13.0.1058 allow unauthenticated code execution as LocalSystem through an improperly validated callback endpoint. https://packetstorm.news/download/238674...

Traggo Server 0.8.3 GraphQL Alias Overloading Denial of Service

Traggo server version 0.8.3 contains an unauthenticated denial of service condition in its GraphQL endpoint due to alias overloading and missing request complexity and body-size limits. A proof of concept is provided. https://packetstorm.news/download/238544...

SUSE Rancher 2.15.1 Cross Site Scripting

SUSE Rancher versions 2.11 before 2.11.18, 2.12 before 2.12.14, 2.13 before 2.13.10, 2.14 before 2.14.6, and 2.15 before 2.15.2 contain an unauthenticated public UI settings update flaw that can lead to stored cross site scripting. The proof of concept submits an alert payload...

pac4j-jwt 6.3.2 JWE Authentication Bypass

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability when JwtAuthenticator processes encrypted JWTs. This proof of concept forges a JWE-wrapped unsigned JWT using the server public key. https://packetstorm.news/download/238529...

Microsoft Windows 11 23H2 Privilege Escalation

Microsoft Windows 11 version 23H2 contains a privilege escalation vulnerability. This proof of concept races Kernel Streaming clock event handling to modify SeDebugPrivilege and launch a command prompt as SYSTEM. https://packetstorm.news/download/238539...

WordPress Akismet 3.1.4 Cross Site Scripting

WordPress Akismet plugin versions 2.5.0 through 3.1.4 contain a stored cross site scripting vulnerability. This proof of concept submits a crafted payload that executes when viewed by an administrator. https://packetstorm.news/download/238548...

free5GC BSF 1754bde Missing Authentication

free5GC BSF version 1754bde and earlier exposes its SBI management endpoints without authentication. The proof of concept demonstrates unauthenticated creation, retrieval, modification, and deletion of PCF bindings. https://packetstorm.news/download/238558...

EditorConfig Core C 0.12.10 Stack Buffer Overflow

EditorConfig Core C versions through 0.12.10 contain a stack buffer overflow in ecglob. A proof of concept uses a crafted directory structure and .editorconfig glob pattern to crash an application using libeditorconfig. https://packetstorm.news/download/238549...

GeoServer 2.25.1 Remote Command Execution

GeoServer versions before 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain an unauthenticated remote code execution vulnerability in OGC request property-name expression evaluation. This proof of concept provides interactive command execution through WFS GetPropertyValue...

Apple LinkPresentation HEIC Out-Of-Bounds Write

Apple LinkPresentation contains an out-of-bounds write when processing a maliciously crafted image. The proof of concept generates mismatched HEIC frames and fetches the image through Open Graph link metadata. https://packetstorm.news/download/238556...

Apple AVEVideoEncoder iOS 26.0 Denial of Service

Apple AVEVideoEncoder in iOS version 26.0 contains an out-of-bounds write that may cause unexpected system termination. The supplied Swift proof of concept submits a 32768 x 16384 BGRA frame to a VideoToolbox H.264 compression session to reproduce the crash. https://packetstorm.news/download/2385...

Vivo S60 16.0.11.15.W10 POSIX Timer Local Privilege Escalation

Vivo S60 version 16.0.11.15.W10 with kernel 6.1.145-android14-11-maybe-dirty contains a POSIX CPU timer use-after-free vulnerability that can be exploited to obtain root privileges and load KernelSU. https://packetstorm.news/download/238551...

Spina CMS 2.21.0 Authenticated Cross Site Scripting

Spina CMS version 2.21.0 contains an authenticated stored cross site scripting issue in rich text embeds. A staff user can store a javascript: URL that is rendered on the public site. https://packetstorm.news/download/238546...

Apple LinkPresentation Out-Of-Bounds Write

Apple LinkPresentation contains an out-of-bounds write vulnerability. Processing a maliciously crafted HEIC image may result in memory corruption. https://packetstorm.news/download/238532...

GLPI 11.0.5 Server-Side Template Injection

GLPI versions 11.0.0 through 11.0.5 contain a server-side template injection issue in Forms dropdown values that can let an authenticated administrator execute code when the form editor renders the value. The included proof of concept documents the vulnerable render flow and the 11.0.6 fix...

Gitea 28.1.0 Draft Release Attachment Metadata Disclosure

Gitea versions 1.22.0 through 28.1.0 contain an information disclosure where creating a draft release can return metadata for unlinked attachments from private repositories. https://packetstorm.news/download/238569...

Joomla Content Editor 2.9.99.4 Unauthenticated Remote Code Execution

Joomla Content Editor versions through 2.9.99.4 contain an improper access control vulnerability in profile import functionality that allows unauthenticated attackers to upload PHP files and execute code. https://packetstorm.news/download/238566...