51049 matches found
...[ More ]
Apache BuildStream's tar source plugin extracts archives without safely resolving symbolic links link following. A malicious source tarball can include a symlink entry that points outside the staging directory and then a file entry that writes through it, so a crafted upstream source can create o...
H5P Nodejs Library 10.0.4 Cross Site Scripting
Lumi Education h5p-nodejs-library versions through 10.0.4 contain a cross site scripting vulnerability due to insufficient validation of files contained in uploaded H5P content. An attacker can upload content containing malicious JavaScript that executes in another user's browser when the affecte...
XMEye Sofia WFS Use-After-Free
XMEye Sofia contains a potential use-after-free vulnerability in its WFS block buffer cache due to unsynchronized reference count operations. Concurrent access can cause a buffer that is still referenced by one thread to be treated as free and repurposed for another block, resulting in a stale...
Intelbras RF 1200 / RG 1200 Authentication Bypass
Intelbras RF 1200 firmware 1.2.4 and RG 1200 firmware 2.1.9 contain an authentication bypass vulnerability in the GoAhead web server. An unauthenticated LAN attacker can manipulate the request URI to bypass authentication and access protected endpoints, including downloading the device...
SAP NetWeaver Extended Passport Remote Code Execution
SAP NetWeaver AS ABAP and Java and SAP Web Dispatcher contain a stack based buffer overflow vulnerability in Extended Passport processing. Missing bounds validation of attacker-supplied metadata allows an unauthenticated remote attacker to corrupt stack memory and execute arbitrary code through...
...[ More ]
Apache PDFBox version 3.0.8 is prone to a denial of service condition caused by a disproportionate heap allocation in the Flate decode PNG predictor path. When a stream is filtered with FlateDecode and a predictor is declared, PDFBox sizes an internal decoding buffer directly from the PDF-supplie...
...[ More ]
This Metasploit module exploits CVE-2026-85706, an unauthenticated arbitrary file read in the GitLab repository commits and files APIs. A path parsing discrepancy between GitLab Workhorse and Rails allows unsigned upload metadata to reach the Rails handler, where an attacker-controlled local path...
Langflow AI Custom Component Authenticated Remote Code Execution
Langflow versions 1.0.0 through 1.11.1 are susceptible to authenticated remote code execution due to improper enforcement of security restrictions of code generation on the /api/v1/customcomponent endpoint. The endpoint accepts attacker controlled code that is then passed to Pythons exec function...
iLEAPP 2026.4.0 Cross Site Scripting
iLEAPP version 2026.4.0 is vulnerable to persistent cross site scripting in the generated SMS/iMessage chat HTML report. https://packetstorm.news/download/231359...
Easy Media Replace 0.2.0 Cross Site Scripting
Easy Media Replace version 0.2.0 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231132...
...[ More ]
Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the...
WordPress Popup for CF7 with Sweet Alert 1.6.5 Cross Site Request Forgery
WordPress Popup for CF7 with Sweet Alert plugin versions 1.6.5 and below suffer from a cross site request forgery vulnerability. https://packetstorm.news/download/231122...
WordPress WP-Stats 2.5.6 Cross Site Scripting
WordPress WP-Stats plugin versions 2.5.6 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231119...
Next.js Unauthenticated Remote Code Execution
This Metasploit module exploits a remote code execution vulnerability in Next.js applications hosted on Windows servers. Specifically crafted requests can execute arbitrary code on the target server. The affected versions include releases from 13.4.0 up to 15.5.24, and 16.0.0 up to 16.3.3,...
...[ More ]
This Metasploit module exploits CVE-2026-20079, an authentication bypass in the web interface of Cisco Secure Firewall Management Center FMC. It upgrades a boot-created machine session, obtains its session-specific action token, writes a Makeself-compatible shell script, and executes the selected...
...[ More ]
This Metasploit module chains three issues in SonicWall SMA1000 appliances. An unauthenticated, absolute-form OPTIONS request makes the WorkPlace listener act as an unintended forward proxy CVE-2026-83548. The module uses this access and a vendor-installed CouchDB update handler to obtain read an...
...[ More ]
Tozed ZLT X300 5G CPE Router firmware version 6.01.3 contains an OS command injection vulnerability in the TR-069/CWMP client daemon netcwmpd. The IPPingDiagnostics Host parameter is passed unsanitized into sprintf, which constructs a shell command executed via systembyroot as root. An attacker...
Langflow AI Authenticated Remote Code Execution
Langflow versions 1.11.1 and below are susceptible to authenticated remote code execution. By saving a flow where data.type is empty, an authenticated user can bypass the flow guard and execute arbitrary Python code. https://packetstorm.news/download/231016...
1CMS 5.6 Cross Site Scripting
1CMS version 5.6 suffers from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231034...
SPIP Autosave Session Unauthenticated Remote Code Execution
This Metasploit module exploits an unauthenticated RCE in SPIP less than or equal to 4.4.21 via the forum autosave session handler. The action=session endpoint allows any visitor to store arbitrary data in a PHP session variable. By writing PHP code into an autosaveforum session key, the code is...
Zimbra Collaboration Suite 10.1.19 Command Injection
Zimbra Collaboration Suite versions 10.1.1 through 10.1.19 suffer from command injection via SMTP log poisoning. https://packetstorm.news/download/230686...
...[ More ]
Eclipse Paho MQTT C Client contains a heap use-after-free vulnerability in the synchronous MQTT client libpaho-mqtt3c when handling incoming PUBLISH messages with retry semantics. When a user-supplied messageArrived callback frees the received message and returns 0 indicating processing failure a...
Flextype CMS 1.0.0-alpha.3 Remote Code Execution
Flextype CMS version 1.0.0-alpha.3 contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes. The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content...
lighttpd 2.0.0 Out-Of-Bounds Access
A signedness vulnerability exists in the lichunkqueueappendmem function in lighttpd2, where a signed length parameter gssize len is not properly validated before being used in memory operations that expect an unsigned size. When a negative length value is supplied, it is implicitly converted to a...
...[ More ]
Arbitrary code execution is possible in the MQTTVersion utility of Paho version 1.3.15 due to unsafe loading and execution of untrusted shared libraries. When a user supplies a shared library path as a command-line argument, the application loads the library using dlopen and resolves an exported...
Flextype CMS 1.0.0-alpha.3 Path Traversal
Flextype CMS version 1.0.0-alpha.3 contains a path traversal vulnerability in the Entries copy functionality. An authenticated remote attacker can supply directory traversal sequences within both the source id and destination newid parameters submitted to /api/v1/entries/copy...
...[ More ]
Payara Server contains a vulnerability in its Server-Side Includes SSI implementation that allows arbitrary operating system command execution via the exec directive. The issue occurs because user-controlled SSI directives are passed directly to Runtime.exec without validation, sanitization, or...
Next.js 16.4.0-canary.13 Server-Side Request Forgery
Next.js version 16.4.0-canary.13 contains a DNS rebinding TOCTOU server-side request forgery vulnerability in the Image Optimizer's fetchExternalImage functionality. https://packetstorm.news/download/230572...
...[ More ]
A stack-based buffer overflow vulnerability exists in the redirect CGI program distributed with thttpd. The vulnerability is caused by unsafe string concatenation when constructing redirect URLs using attacker-controlled CGI environment variables. A remote, unauthenticated attacker can trigger th...
...[ More ]
A stack-based buffer overflow vulnerability exists in the htpasswd utility bundled with thttpd. The vulnerability occurs due to unsafe copying of a user-supplied command-line argument into a fixed-size stack buffer without proper bounds checking.Specifically, the program copies the username...
jdbhttpd 0.1.0 Path Traversal / File Disclosure
jdbhttpd version 0.1.0 suffers from path traversal and file disclosure vulnerabilities. https://packetstorm.news/download/230538...
Paho 1.3.15 Path Hijacking / Code Execution
Arbitrary code execution is possible in the MQTTVersion utility of Paho version 1.3.15 due to uncontrolled loading of shared libraries using non-absolute paths. The application invokes dlopen with relative library names and relies on the dynamic loader’s search path to resolve the target library...
Flextype CMS 1.0.0-alpha.3 Code Execution
Flextype CMS version 1.0.0-alpha.3 contains a stored code execution vulnerability caused by the interaction between globally processed entry expressions, the mutable registry object exposed to expressions, and the PHP entry directive. https://packetstorm.news/download/230567...
Lutece Core 7.1.7 Remote Code Execution
Lutece Core versions 7.1.7 and below suffer from an authenticated remote code execution vulnerability via XSLT injection. https://packetstorm.news/download/230543...
OpenCode Unauthenticated Remote Code Execution
OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability that can allow a remote attacker to obtain a session identifier and execute arbitrary commands through the session shell endpoint. This proof of concept retrieves an available session and demonstrate...
Flextype CMS 1.0.0-alpha.3 Authentication Bypass
Flextype CMS version 1.0.0-alpha.3 contains an authentication validation vulnerability in the API request-processing functionality. API endpoints may declare accesstoken as a required parameter, but the required-parameter validation only verifies that the corresponding key exists in the supplied...
...[ More ]
Flextype CMS version 1.0.0-alpha.3 contains a stored server-side request forgery SSRF vulnerability in its shortcode-processing functionality. Attacker-controlled entry fields can be automatically processed by Flextype's shortcode parser. The built-in fetch shortcode accepts an attacker-controlle...
Flextype CMS 1.0.0-alpha.3 Expression Injection
Flextype CMS version 1.0.0-alpha.3 contains a stored arbitrary expression injection vulnerability in the Entries ExpressionsDirective. An authenticated remote attacker with sufficient privileges to create or modify entries can persist arbitrary expression syntax within an entry field...
O-CMS 1.0.0 Command Injection
O-CMS version 1.0.0 contains an authenticated OS command injection vulnerability in the AI CLI configuration functionality. An authenticated attacker with sufficient privileges can supply shell metacharacters and additional commands through the aicliscript parameter of /admin/settings/save...
Flextype CMS 1.0.0-alpha.3 Server-Side Request Forgery
lextype CMS version 1.0.0-alpha.3 contains a server-side request forgery SSRF vulnerability in the expression-processing functionality exposed through the /api/v1/query endpoint. An authenticated remote attacker can supply an arbitrary URL to the exposed fetch function, causing the Flextype serve...
Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation
Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that rely on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. These endpoints allow remote clients to perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB...
Flextype CMS 1.0.0-alpha.3 Arbitrary File Read
Flextype CMS version 1.0.0-alpha.3 contains an arbitrary file-read vulnerability in its stored shortcode processing functionality. Attacker-controlled entry fields are automatically processed by the shortcode parser when global shortcode processing is enabled...
Tenda HG21 Hardcoded Root Credentials
Firmware analysis of the Tenda HG21 XPON fiber modem revealed a hardcoded administrative account baked into the shipped firmware image. The account is granted full root privileges UID 0 and its credentials are static across devices, meaning any attacker who can reach an exposed management service...
...[ More ]
ILIAS versions prior to 9.22, versions 10.0 through 10.9, and versions 11.0 through 11.2 contain an unauthenticated PHP object injection vulnerability in the Shibboleth logout functionality. An unauthenticated attacker can manipulate stored session data that is subsequently deserialized without...
Fullhan FH8626V100 Command Injection / Secret Disclosure
Fullhan FH8626V100 suffers from command injection, secret disclosure, and multiple other vulnerabilities. Exploit Title: Fullhan FH8626V100 - Multiple Vulnerabilities Date: 31-03-2026 Exploit Author: Amir Aliu Vendor Homepage: https://www.fullhan.com/ Software Link: N/A - OEM/whitelabel IP camera...
...[ More ]
EVerest version 2025.9.0 suffers from an integer overflow in SdpPacket::parseheader that allows an attacker to trigger either an infinite loop TCP or stack buffer overflow TLS by sending a malformed SDP packet with a specially crafted length field. The vulnerability exists because the length fiel...
PodcastGenerator 3.2.9 Cross Site Scripting
PodcastGenerator version 3.2.9 contains a persistent cross site scripting vulnerability in the Live Items functionality. Exploit Title: PodcastGenerator 3.2.9 - Stored XSS Date: 2026-08-08 Exploit Author: Sahil Arya Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator Software...
...[ More ]
This Metasploit module exploits an unauthenticated command execution vulnerability in MCPJam Inspector. The /api/mcp/connect endpoint accepts a JSON serverConfig object containing a command and argument list used to start an MCP server. A remote attacker can abuse this endpoint to execute arbitra...
Bludit CMS 3.20.0 Cross Site Scripting
Bludit CMS version 3.20.0 suffers from a cross site scripting vulnerability in the search plugin. Exploit Title: Bludit CMS 3.20.0 - Reflected Cross-Site Scripting Date: 2026-08-11 Exploit Author: Ranjit Kumar Singh Vendor Homepage: https://www.bludit.com/ Software Link:...
Metabase 0.61.0 Remote Code Execution
Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned by native H2 queries in result columns of type OTHER without validation. An authenticated user with permission to execute native queries against an accessible H2...