PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 and prior affected versions contain use-after-free vulnerabilities that can lead to unauthenticated remote code execution. This proof of concept targets PHP 8.4.26 with Apache modphp prefork. https://packetstorm.news/download/237019...

Apache AsterixDB 0.9.9 Missing Authentication

Apache AsterixDB version 0.9.9 contains a missing authentication vulnerability in its Cluster Controller HTTP API, allowing unauthenticated SQL++ queries and cluster shutdown requests. !/usr/bin/env perl Apache AsterixDB 0.9.9 Missing Authentication Vendor: The Apache Software Foundation Product...

Dokploy 0.29.12 Compose Branch Command Injection

Dokploy versions 0.29.3 through 0.29.12 contain a command injection in compose branch fields. The proof of concept stores a crafted branch value, triggers deployment, and confirms execution from deployment logs. https://packetstorm.news/download/236744...

FUEL CMS 1.4.1 Remote Code Execution

FUEL CMS version 1.4.1 contains a PHP code-evaluation vulnerability in the pages/select filter parameter. The proof of concept executes supplied system commands. https://packetstorm.news/download/236747...

Apache Camel 4.22.0 gRPC Consumer Exception Disclosure

Apache Camel version 4.22.0 contains an error-message disclosure flaw in its gRPC consumer. A remote caller that provokes a route failure can receive the route exception message in the gRPC status description. The proof of concept reproduces affected and fixed behavior...

Fortinet FortiSIEM 7.5 gRPC File Write / Remote Code Execution

Fortinet FortiSIEM version 7.5 contains an unauthenticated gRPC path traversal and NUL-byte injection vulnerability that allows arbitrary file write and remote command execution. https://packetstorm.news/download/236742...

Apache Camel 4.22.0 OAuth2 Token Cache Confusion

Apache Camel camel-http versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an OAuth2 token-cache flaw that can reuse a token across endpoints differing by scope, resource indicator, or token endpoint. The supplied proof of concept demonstrates the behavior...

TYPO3 Shop 6.2.0 PayPal Callback Forgery

TYPO3 Shop by coding.ms versions before 4.9.4, 5.0.0 through 5.21.0, and 6.0.0 through 6.2.0 allow unauthenticated attackers to overwrite stored PayPal callback data for prepared orders. https://packetstorm.news/download/236752...

Apache Camel 4.22.0 XML External Entity Injection

Apache Camel camel-smooks versions from 4.7.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an XML external entity issue. The proof of concept demonstrates resolution of a self-created temporary marker file during XML unmarshalling. https://packetstorm.news/download/236738...

MCPJam Inspector 1.4.2 Remote Command Execution

MCPJam Inspector version 1.4.2 and earlier contains a remote command execution vulnerability. The proof of concept sends a crafted server configuration to the MCP connection endpoint. https://packetstorm.news/download/236732...

Fleet 4.64.1 SAML Authentication Bypass

Fleet versions before 4.53.2 and versions 4.54.0 through 4.64.1 contain an improper SAML response validation vulnerability that allows attackers to forge authentication assertions and impersonate SSO-enabled users or provision administrative accounts when JIT provisioning is enabled...

Apache Camel 4.22.0 Platform HTTP Proxy Mode

Apache Camel version 4.22.0 camel-platform-http contains an unintended proxy-mode issue where endpoint paths beginning with proxy are treated as catch-all forwarding proxies. https://packetstorm.news/download/236741...

WordPress 7.0.2 Login Screen Cross Site Scripting

WordPress versions prior to version 7.0.3 contain a pre-authentication reflected cross site scripting vulnerability in the login screen. This proof of concept delivers a crafted login request. https://packetstorm.news/download/236754...

TYPO3 Shop by coding.ms 6.2.0 Unauthenticated Order Cancellation

TYPO3 Shop by coding.ms versions before 4.9.4, 5.0.0 through 5.21.0, and 6.0.0 through 6.2.0 contain missing authorization in cancelAction, allowing an unauthenticated visitor to cancel a prepared order by supplying its UID. https://packetstorm.news/download/236753...

Gogs 0.13.3 Symlink Remote Code Execution

Gogs version 0.13.3 and earlier contain improper symbolic link handling in the PutContents API. This proof of concept uses a repository symlink to overwrite server-side files and trigger code execution. https://packetstorm.news/download/236748...

PHP 8.5.x PHP2Shell Detection

PHP versions 5.4 through 8.5.x may contain PHP2Shell remote code execution vulnerabilities. This tool performs non-exploiting HTTP checks for PHP version and session upload progress indicators. https://packetstorm.news/download/236726...

PHP 8.4 session.upload_progress Remote Code Execution

PHP version 8.4 and earlier versions are claimed to contain session.uploadprogress use-after-free flaws that may allow remote code execution. Proof of concept code is included. https://packetstorm.news/download/236734...

Apache NiFi MiNiFi C++ 1.0.0 Uncontrolled Memory Allocation

Apache NiFi MiNiFi C++ versions 1.0.0 and 0.99.2 contain an uncontrolled memory allocation issue in the InputStream reader. A length field from a site-to-site or C2 stream can cause an oversized allocation and crash the agent. // // // Apache NiFi MiNiFi C++ 1.0.0 Uncontrolled Memory Allocation /...

Apache Camel 4.22.0 Cross-Origin Credential Exposure

Apache Camel version 4.22.0 camel-jetty contains a cross-origin credential exposure when an endpoint uses enableCORS. The proof of concept demonstrates arbitrary-origin credentialed CORS access and the fixed behavior. https://packetstorm.news/download/236760...

Apache Camel 4.22.0 MimeMultipart Mail Header Injection

Apache Camel version 4.22.0 contains a MIME multipart header injection vulnerability in camel-mail that permits attacker-controlled mail.smtp and mail.smtps properties to reach a downstream mail producer. https://packetstorm.news/download/236759...

Apache Camel 4.22.0 Saga Header Hijacking

Apache Camel version 4.22.0 contains an improper input validation issue in SagaProcessor where an externally supplied Long-Running-Action header can select the saga coordinator for an exchange. This proof of concept demonstrates affected and fixed behavior. https://packetstorm.news/download/23676...

TP-Link Tapo C320WS V2 1.5.3 Stack Overflow

TP-Link Tapo C320WS V2 firmware version 1.5.3 Build 260304 contains an authenticated stack-based buffer overflow in the local Wi-Fi onboarding path. The proof of concept sends a crafted encrypted password to execute a command as root. https://packetstorm.news/download/236751...

Python 3.11.3 URL Parsing Blocklist Bypass

Python version 3.11.3 and earlier affected branches contain a URL parsing discrepancy that can allow leading whitespace to bypass scheme and hostname blocklists. The supplied proof of concept shows urlparse and urlopen interpreting that input differently. https://packetstorm.news/download/236757...

Metasploit Framework iOS Image Gather Path Traversal

Metasploit Framework contains a path traversal in the iOS image gather module that allows a hostile Meterpreter agent to write files on the operator workstation and execute code when msfconsole is started. https://packetstorm.news/download/236750...

Dokploy 0.29.12 Compose Branch Command Injection

Dokploy versions 0.29.3 through 0.29.12 contain a command injection vulnerability in compose branch fields. This proof of concept demonstrates authenticated arbitrary command execution through compose deployment. https://packetstorm.news/download/236749...

PHP 8.5.11 Session Upload Progress Use-After-Free / Remote Code Execution

PHP session.uploadprogress contains use-after-free flaws that can permit remote code execution. This proof of concept crafts multipart upload requests for both affected variants. https://packetstorm.news/download/236736...

Apache Camel camel-fop 4.22.0 XML External Entity

Apache Camel camel-fop version 4.22.0 contains an XML external entity issue when a third-party TransformerFactory is present. The proof of concept demonstrates external DTD resolution through an in-process localhost callback. https://packetstorm.news/download/236737...

Apache Camel 4.22.0 JGroups Unsafe Java Deserialization

Apache Camel version 4.22.0 camel-jgroups contains an unsafe Java deserialization issue in cluster message processing. The proof of concept demonstrates attacker-controlled object deserialization using a benign marker class. https://packetstorm.news/download/236735...

WordPress Ninja Forms 3.15.5 Cross Site Scripting

WordPress Ninja Forms plugin versions through 3.15.5 contain a stored cross site scripting vulnerability. The proof of concept submits crafted form data that executes when an administrator views the associated submission. https://packetstorm.news/download/236727...

Exasol Database 7.1.30 Default Credential Python UDF Command Execution

Exasol Database version 7.1.30 docker-db deployments use the documented SYS default credential, which can create a PYTHON3 UDF invoking os.popen and return command output through SELECT. https://packetstorm.news/download/236507...

Edimax BR-6478AC 2.20 Command Injection

Edimax BR-6478AC firmware version 2.20 contains an authenticated command injection vulnerability in the formWlanMP manufacturing-test handler that permits command execution as root. https://packetstorm.news/download/236505...

PCMan FTP Server 2.0 PWD Command Buffer Overflow

PCMan FTP Server version 2.0 contains a buffer overflow in the PWD command that allows remote attackers to execute arbitrary code. This Metasploit module sends a crafted FTP PWD request to demonstrate the issue. https://packetstorm.news/download/236498...

Apache Camel 4.22.0 SOAP Fault Information Disclosure

Apache Camel versions 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1 contain a SOAP fault information disclosure in camel-cxf. The proof of concept triggers an undeclared route failure and reads its exception detail from the returned SOAP fault. https://packetstorm.news/download/236493...

Apache Camel MLLP 4.22.0 Protected Health Information Logging

Apache Camel MLLP versions before 4.18.5 and from 4.19.0 before 4.22.1 log HL7 payload data by default when DEBUG logging is enabled. The supplied proof of concept demonstrates protected health information exposure in application logs. https://packetstorm.news/download/236484...

Apache Camel 4.22.0 Request Header Echo Suppression Bypass

Apache Camel version 4.22.0 contains a case-sensitive request-header suppression check in camel-platform-http. A proof of concept demonstrates that a lowercased Authorization header can be reflected in the response. https://packetstorm.news/download/236496...

Vivo X100 Ultra Kernel 6.1.145 Privilege Escalation

Vivo X100 Ultra version PD236616.2.19.0.W10 with kernel 6.1.145-android14-11 contains a PI-futex race condition that can be used to obtain root privileges. Proof of concept code is included. https://packetstorm.news/download/236490...

WordPress 7.0.1 Pre-Authentication Remote Code Execution

WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2 contain a REST API batch-route confusion and SQL injection chain that can lead to pre-authentication remote code execution. This proof of concept performs auditing, blind SQL extraction, and exploitation...

Apache Camel 4.22.0 XPath XML External Entity Processing

Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an XML external entity processing issue in camel-xpath when documentType is set to InputSource. The supplied proof of concept demonstrates local file disclosure through an external entity...

Apache Camel 4.22.0 PQC Signature Verification Bypass

Apache Camel version 4.22.0 camel-pqc contains a race condition in concurrent Signature use that can cause signature verification results to apply to incorrect message data. The proof of concept demonstrates the issue using concurrent local sign and verify operations...

Ollama 0.34.x Manifest Digest Path Traversal / Remote Code Execution

Ollama versions 0.34.2 through 0.34.x contain an unauthenticated manifest-digest path traversal that can plant a shared library outside the model store. This proof of concept demonstrates code execution when the MLX loader loads the planted library. https://packetstorm.news/download/236487...

Microsoft Windows Kernel-Mode Driver 10.0.22631 Privilege Escalation

Microsoft Windows Kernel-Mode Driver version 10.0.22631 contains an untrusted pointer dereference vulnerability that allows local privilege escalation. A proof of concept is available. https://packetstorm.news/download/236495...

Apache Camel 4.22.0 HTTP Credential Disclosure

Apache Camel camel-http versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 can disclose OAuth2 bearer tokens or configured credentials to a redirect-selected authority when redirects are followed. The included proof of concept demonstrates the issue with local servers...

Apache Camel 4.22.0 Tika Metadata Header Injection

Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an input validation flaw in camel-tika that allows parsed document metadata to set Camel-internal message headers. https://packetstorm.news/download/236502...

Apache Camel 4.22.0 camel-pqc Private Key Permissions

Apache Camel camel-pqc versions from 4.12.0 before 4.18.5 and from 4.19.0 before 4.22.1 write unencrypted private keys using default file permissions, allowing local accounts to read them under a permissive umask. A proof of concept is included. https://packetstorm.news/download/236481...

Apache jclouds 2.7.0 XML External Entity Injection

Apache jclouds version 2.7.0 contains an XML External Entity injection vulnerability in provider-response parsing that may allow local file disclosure or server-side request forgery when a parsed endpoint is attacker controlled. !/usr/bin/env bash Apache jclouds 2.7.0 XML External Entity XXE...

Android 16 APV Decoder Leak-Assisted ROP

Android version 16 contains an APV decoder heap overflow. This proof of concept uses a leak-assisted ROP chain on a rooted Pixel 9 reference build to demonstrate a controlled native call in media.swcodec. https://packetstorm.news/download/236491...

Polkit pkexec Local Privilege Escalation

Polkit pkexec contains a local privilege-escalation vulnerability. This proof of concept uses a malicious gconv module to obtain a root shell on vulnerable systems. https://packetstorm.news/download/236494...

Mercury 3.2.5 Unauthenticated Remote Code Execution

Mercury versions 3.0.0 through 3.2.5 contain unauthenticated remote code execution through Jupyter kernel execution. Versions through 3.2.3 additionally expose unauthenticated terminal access. This proof of concept demonstrates both issues. https://packetstorm.news/download/236488...

FreeFloat FTP Server 1.0 NOOP Command Buffer Overflow

FreeFloat FTP Server version 1.0 contains a buffer overflow in its NOOP command handler. The supplied proof of concept documents analysis, fuzzing, offset discovery, and return-address control. https://packetstorm.news/download/236480...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Apache Paimon versions 2.1.0 and 2.0.0 MySQL CDC synchronization actions allow user-supplied JDBC properties that can enable a rogue MySQL server to request arbitrary local files from the CDC process. !/usr/bin/env bash Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read Vendor: The Apache Software...