ASUS RT-AX55 3.0.0.4.386.51598 Command Injection

ASUS RT-AX55 firmware version 3.0.0.4.386.51598 contains an authenticated command injection vulnerability in its token-refresh module. The included proof of concept submits a benign marker payload. https://packetstorm.news/download/238681...

Samba 3.0.20 Username Map Script Command Injection

Samba version 3.0.20 through 3.0.25rc3 with username map script enabled contains a command injection vulnerability that allows unauthenticated remote command execution. This proof of concept delivers a reverse shell payload through a crafted SMB username. https://packetstorm.news/download/238684...

Guangzhou 1GE ONU formPing Command Injection

Guangzhou 1GE ONU V2801RW and V2804RGW devices contain an unauthenticated command injection vulnerability in the formPing targetaddr parameter. The included proof of concept demonstrates the issue. https://packetstorm.news/download/238683...

pfSense pfBlockerNG 2.1.4_27 Host Header Command Injection

pfSense pfBlockerNG through version 2.1.427 allows remote attackers to execute OS commands as root via a crafted HTTP Host header. The included proof of concept uses a benign marker-file payload. https://packetstorm.news/download/238682...

Oracle E-Business Suite 12.2.15 SQL Injection

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain an unauthenticated SQL injection issue in the Thin Client Framework servlet. The supplied proof of concept sends crafted TCF requests to execute SQL as the APPS database user. https://packetstorm.news/download/238651...

Grafana 13.2.4 Alerting Contact Point Authorization Bypass

Grafana versions 12.4.0 through 12.4.13, 13.0.0 through 13.0.11, 13.1.0 through 13.1.8, and 13.2.0 through 13.2.4 contain an authorization bypass that allows contact point destination changes through a legacy schema downgrade. https://packetstorm.news/download/238646...

SUSE Rancher Manager 2.15.2 Local Cluster Shell Authorization Bypass

SUSE Rancher Manager versions 2.11.0 through 2.11.18, 2.12.0 through 2.12.14, 2.13.0 through 2.13.10, 2.14.0 through 2.14.6, and 2.15.0 through 2.15.2 contain an authorization bypass that allows an authenticated user without local-cluster access to obtain a shell pod on the management cluster. A...

WordPress IvyForms 1.5.1 Shell Upload

WordPress IvyForms plugin version 1.5.1 and earlier contains an arbitrary file upload vulnerability that allows a user with custom form-editing access to configure executable extensions and upload a PHP payload through a published form. https://packetstorm.news/download/238670...

Zyxel VMG4325-B10A Firmware 1.00(AAFR.4)C0_20170615 Insecure Default Credentials

Zyxel VMG4325-B10A firmware version 1.00AAFR.4C020170615 contains insecure default credentials for its Telnet function. The included proof of concept authenticates to a target service and invokes id after a successful login. https://packetstorm.news/download/238679...

Anyscale Ray 2.8.0 Job Submission API Code Execution

Anyscale Ray versions 2.6.3 and 2.8.0 allow remote attackers to execute arbitrary code via the unauthenticated job submission API. https://packetstorm.news/download/238680...

Apache ActiveMQ Classic 5.18.2 OpenWire Remote Code Execution

Apache ActiveMQ Classic version 5.18.2 is vulnerable to remote code execution through unsafe deserialization of OpenWire ExceptionResponse data. This proof of concept supplies a local Docker lab, version checker, and Spring XML generator for CVE-2023-46604. https://packetstorm.news/download/23867...

WordPress Checkout Files Upload for WooCommerce 2.3.0 Shell Upload

WordPress Checkout Files Upload for WooCommerce versions before 2.4.0 contain an unauthenticated arbitrary file upload vulnerability that can lead to remote code execution when PHP is executable from the uploads directory. https://packetstorm.news/download/238668...

Gogs 0.13.3 Symlink Arbitrary File Write

Gogs version 0.13.3 and prior contain a symlink handling flaw in the PutContents API that allows an authenticated user to overwrite files writable by the Gogs process. The supplied proof of concept demonstrates the issue. https://packetstorm.news/download/238685...

Roundcube Webmail 1.6.7 Cross Site Scripting

Roundcube Webmail version 1.6.7 and earlier contains a cross site scripting vulnerability in post-processing of sanitized HTML email, allowing crafted email content to execute JavaScript when viewed. https://packetstorm.news/download/238660...

MikroTik RouterOS 7.24.1 TFTP Privilege Escalation

MikroTik RouterOS versions 6.0 through 6.49.20 and 7.1.5 through 7.24.1 contain an authenticated TFTP request overflow that can allow a read-group user to rewrite group policy and gain full privileges. https://packetstorm.news/download/238661...

pgAdmin 4 9.18 Service Account Kerberos Authentication Bypass

pgAdmin 4 versions through 9.18 contain a service-account Kerberos credential leak that allows an authenticated web user to authenticate to a GSSAPI PostgreSQL server as the pgAdmin service principal. https://packetstorm.news/download/238653...

Apple Safari 27.1 LinkPresentation HEIC Out-Of-Bounds Write

Apple Safari versions before 27.2 contain an out-of-bounds write in LinkPresentation when processing a maliciously crafted HEIC image. The proof of concept generates and serves a two-frame HEIC trigger. https://packetstorm.news/download/238652...

node-forge 1.4.0 Incomplete PKCS#7 Padding Validation

node-forge versions 1.4.0 and below contain incomplete PKCS7 padding validation in AES and DES CBC and ECB decryption. The supplied proof of concept demonstrates malformed ciphertext being accepted as valid padding. https://packetstorm.news/download/238666...

NextGen Mirth Connect 4.3.0 Unauthenticated Remote Command Execution

NextGen Mirth Connect version 4.3.0 contains an unauthenticated remote command execution vulnerability through unsafe XStream deserialization. The proof of concept submits a crafted XML request to the API users endpoint. https://packetstorm.news/download/238663...

Puwell IP Camera 4.x DebugShell Command Injection

Puwell IP Camera firmware versions 2.x through 4.x contain an unauthenticated command injection vulnerability in the DebugShell interface on TCP port 34567. The supplied proof of concept sends JSON commands to demonstrate execution. https://packetstorm.news/download/238662...

ClickHouse Server 26.10.2.103 Brotli Decoder out of Bounds Write

ClickHouse Server version 26.10.2.103 contains an unauthenticated out-of-bounds write in its bundled Brotli decoder that can permit arbitrary code execution under certain conditions. The proof of concept detects vulnerable servers and demonstrates denial of service...

FreePBX Endpoint Manager 17.0.2 SQL Injection / Remote Code Execution

FreePBX Endpoint Manager versions before 15.0.66, 16.0.89, and 17.0.3 contain an unauthenticated SQL injection vulnerability that allows database manipulation and remote code execution. Included proof of concept inserts a cron job to execute commands as asterisk...

React 19.2.0 React Server Components Remote Code Execution

React Server Components version 19.2.0 and earlier affected releases contain an unsafe deserialization issue that permits unauthenticated remote code execution. This proof of concept sends a crafted Flight payload to execute a supplied command. https://packetstorm.news/download/238687...

Filament 5.6.4 Unauthenticated Temporary File Upload

Filament versions 3.0.0 through 3.3.51, 4.0.0 through 4.11.4, and 5.0.0 through 5.6.4 contain an unauthenticated temporary-file upload issue on authentication pages. The proof of concept uploads test files and checks retrieval paths. https://packetstorm.news/download/238694...

Realtek SDK miniigd Command Injection

Realtek SDK miniigd contains an unauthenticated OS command injection vulnerability in UPnP WANIPConnection AddPortMapping handling. The proof of concept submits a controlled NewInternalClient value. https://packetstorm.news/download/238692...

OpenSTAManager 2.10 Shell Upload

OpenSTAManager versions 2.10 and earlier contain an arbitrary file upload vulnerability in the module update functionality. The included proof of concept authenticates, creates a malicious module containing a PHP shell, and uploads it. https://packetstorm.news/download/238693...

ASUS RT-AX55 3.0.0.4.386.51598 Command Injection

ASUS RT-AX55 firmware version 3.0.0.4.386.51598 contains an authenticated OS command injection vulnerability in the qosbwrulelist parameter of /startapply.htm. A proof of concept and local laboratory model are included. https://packetstorm.news/download/238691...

Flowise 3.0.5 Account Takeover

Flowise version 3.0.5 and earlier return a valid password-reset tempToken from the unauthenticated forgot-password endpoint, allowing an attacker to reset an arbitrary account password and take over the account. The proof of concept demonstrates the reset flow...

TOTOLINK A810R Firmware 4.1.2cu.5182_B20201026 Pre-Authentication Remote Command Execution

TOTOLINK A810R firmware version 4.1.2cu.5182B20201026 contains a pre-authentication remote command execution vulnerability in setNoticeCfg through the NoticeUrl parameter. The proof of concept demonstrates the issue against a local lab model or a user-supplied device...

Cacti 1.2.28 Authenticated Arbitrary File Creation / Remote Code Execution

Cacti version 1.2.28 and prior contain an authenticated arbitrary file creation vulnerability in graph template handling that can lead to remote code execution. This proof of concept writes and triggers a PHP payload through crafted rrdtool graph options. https://packetstorm.news/download/238686...

ASUSWRT 3.0.0.4.376_1071 Authentication Bypass / Command Execution

ASUSWRT version 3.0.0.4.3761071 and other versions contain an authentication bypass in infosvr that allows remote attackers to execute arbitrary commands with a crafted NETCMDIDMANUCMD packet sent to UDP port 9999. The proof of concept provides a local lab and packet generator...

Delinea Privilege Manager 13.0.1058 Unauthenticated Remote Code Execution

Delinea Privilege Manager agent versions 10.1.0 through 12.0.5796 and 13.0.0 through 13.0.1058 allow unauthenticated code execution as LocalSystem through an improperly validated callback endpoint. https://packetstorm.news/download/238674...

Linear eMerge E3-Series 1.00-06 Command Injection

Linear eMerge E3-Series version 1.00-06 and earlier contain an unauthenticated command injection in cardscandecoder.php. This proof of concept uses the hard-coded root credentials tracked as CVE-2019-7261 to execute a benign marker command. https://packetstorm.news/download/238664...

Ubuntu 18.04 OverlayFS Privilege Escalation

Ubuntu version 18.04 Server OverlayFS contains a local privilege escalation vulnerability. This proof of concept demonstrates gaining root privileges through CVE-2021-3493. https://packetstorm.news/download/238658...

EPSON Printer Controller Installer 1.0.0 Local Privilege Escalation

EPSON Printer Controller Installer version 1.0.0 contains improper authorization handling in its privileged helper, allowing local low-privileged users to invoke privileged XPC operations and execute commands as root. The included proof of concept documents the issue...

Gitea 28.1.0 Draft Release Attachment Metadata Disclosure

Gitea versions 1.22.0 through 28.1.0 contain an information disclosure where creating a draft release can return metadata for unlinked attachments from private repositories. https://packetstorm.news/download/238569...

GLPI 11.0.5 Server-Side Template Injection

GLPI versions 11.0.0 through 11.0.5 contain a server-side template injection issue in Forms dropdown values that can let an authenticated administrator execute code when the form editor renders the value. The included proof of concept documents the vulnerable render flow and the 11.0.6 fix...

Google Chrome 70.0.3538.0 V8 Type Confusion

A proof of concept for a V8 TurboFan Object.create type confusion in Google Chrome version 70.0.3538.0 that achieves arbitrary memory read/write and executes calculator shellcode through a WebAssembly RWX page. https://packetstorm.news/download/238565...

WordPress Content Egg Cross Site Scripting

WordPress Content Egg versions before 11.9.0 contain a stored cross site scripting vulnerability that lets Contributor-level users enqueue unescaped content through an administrator-owned import preset. https://packetstorm.news/download/238560...

free5gc v4.2.3+ Root CA Private Key Exposure

free5gc versions v1.0.0 through v4.2.3+ contain a publicly committed Root CA private key that can be used to forge trusted network function certificates in deployments using its shipped TLS trust anchor. A proof of concept is provided. https://packetstorm.news/download/238561...

Spina CMS 2.21.0 Authenticated Cross Site Scripting

Spina CMS version 2.21.0 contains an authenticated stored cross site scripting issue in rich text embeds. A staff user can store a javascript: URL that is rendered on the public site. https://packetstorm.news/download/238546...

EditorConfig Core C 0.12.10 Stack Buffer Overflow

EditorConfig Core C versions through 0.12.10 contain a stack buffer overflow in ecglob. A proof of concept uses a crafted directory structure and .editorconfig glob pattern to crash an application using libeditorconfig. https://packetstorm.news/download/238549...

Traggo Server 0.8.3 GraphQL Alias Overloading Denial of Service

Traggo server version 0.8.3 contains an unauthenticated denial of service condition in its GraphQL endpoint due to alias overloading and missing request complexity and body-size limits. A proof of concept is provided. https://packetstorm.news/download/238544...

astro-notion-blog 0.13.0 Path Traversal / Remote Code Execution

astro-notion-blog version 0.13.0 allows Notion database editors to supply an encoded FeaturedImage filename that escapes the image directory during site builds, overwrites an Astro page, and enables code execution as the build user. https://packetstorm.news/download/238545...

Redmi K90 HyperOS 4.0.5.0 Temporary Root Research

Redmi K90 HyperOS versions 4.0.0.27, 4.0.0.34, and 4.0.5.0 are documented in experimental temporary-root compatibility research related to CVE-2026-64560. The material contains testing criteria and firmware observations but no exploit code or executable payloads...

Vivo S60 16.0.11.15.W10 POSIX Timer Local Privilege Escalation

Vivo S60 version 16.0.11.15.W10 with kernel 6.1.145-android14-11-maybe-dirty contains a POSIX CPU timer use-after-free vulnerability that can be exploited to obtain root privileges and load KernelSU. https://packetstorm.news/download/238551...

WordPress Akismet 3.1.4 Cross Site Scripting

WordPress Akismet plugin versions 2.5.0 through 3.1.4 contain a stored cross site scripting vulnerability. This proof of concept submits a crafted payload that executes when viewed by an administrator. https://packetstorm.news/download/238548...

Apple AVEVideoEncoder iOS 26.0 Denial of Service

Apple AVEVideoEncoder in iOS version 26.0 contains an out-of-bounds write that may cause unexpected system termination. The supplied Swift proof of concept submits a 32768 x 16384 BGRA frame to a VideoToolbox H.264 compression session to reproduce the crash. https://packetstorm.news/download/2385...

free5GC BSF 1754bde Missing Authentication

free5GC BSF version 1754bde and earlier exposes its SBI management endpoints without authentication. The proof of concept demonstrates unauthenticated creation, retrieval, modification, and deletion of PCF bindings. https://packetstorm.news/download/238558...

SUSE Rancher 2.15.1 Cross Site Scripting

SUSE Rancher versions 2.11 before 2.11.18, 2.12 before 2.12.14, 2.13 before 2.13.10, 2.14 before 2.14.6, and 2.15 before 2.15.2 contain an unauthenticated public UI settings update flaw that can lead to stored cross site scripting. The proof of concept submits an alert payload...