Keycloak 26.7.1 Unauthenticated Account Takeover

Keycloak versions 26.0.0 through 26.4.14, 26.5.0 through 26.6.5, and 26.7.0 through 26.7.1 contain a reset-credentials flow bypass that can allow an unauthenticated attacker to set a user password. Exploit Title: Keycloak 26.7.2 - Unauthenticated Account Takeover Date: 2026-10-15 Exploit Author:...

Apache AsterixDB 0.9.9 Missing Authentication

Apache AsterixDB version 0.9.9 contains a missing authentication vulnerability in its Cluster Controller HTTP API, allowing unauthenticated SQL++ queries and cluster shutdown requests. !/usr/bin/env perl Apache AsterixDB 0.9.9 Missing Authentication Vendor: The Apache Software Foundation Product...

Python 3.11.3 URL Parsing Blocklist Bypass

Python version 3.11.3 and earlier affected branches contain a URL parsing discrepancy that can allow leading whitespace to bypass scheme and hostname blocklists. The supplied proof of concept shows urlparse and urlopen interpreting that input differently. https://packetstorm.news/download/236757...

TYPO3 Shop by coding.ms 6.2.0 Unauthenticated Order Cancellation

TYPO3 Shop by coding.ms versions before 4.9.4, 5.0.0 through 5.21.0, and 6.0.0 through 6.2.0 contain missing authorization in cancelAction, allowing an unauthenticated visitor to cancel a prepared order by supplying its UID. https://packetstorm.news/download/236753...

WordPress 7.0.2 Login Screen Cross Site Scripting

WordPress versions prior to version 7.0.3 contain a pre-authentication reflected cross site scripting vulnerability in the login screen. This proof of concept delivers a crafted login request. https://packetstorm.news/download/236754...

Apache Camel 4.22.0 Saga Header Hijacking

Apache Camel version 4.22.0 contains an improper input validation issue in SagaProcessor where an externally supplied Long-Running-Action header can select the saga coordinator for an exchange. This proof of concept demonstrates affected and fixed behavior. https://packetstorm.news/download/23676...

Apache Camel 4.22.0 Cross-Origin Credential Exposure

Apache Camel version 4.22.0 camel-jetty contains a cross-origin credential exposure when an endpoint uses enableCORS. The proof of concept demonstrates arbitrary-origin credentialed CORS access and the fixed behavior. https://packetstorm.news/download/236760...

Metasploit Framework iOS Image Gather Path Traversal

Metasploit Framework contains a path traversal in the iOS image gather module that allows a hostile Meterpreter agent to write files on the operator workstation and execute code when msfconsole is started. https://packetstorm.news/download/236750...

Apache Camel camel-fop 4.22.0 XML External Entity

Apache Camel camel-fop version 4.22.0 contains an XML external entity issue when a third-party TransformerFactory is present. The proof of concept demonstrates external DTD resolution through an in-process localhost callback. https://packetstorm.news/download/236737...

TYPO3 Shop 6.2.0 PayPal Callback Forgery

TYPO3 Shop by coding.ms versions before 4.9.4, 5.0.0 through 5.21.0, and 6.0.0 through 6.2.0 allow unauthenticated attackers to overwrite stored PayPal callback data for prepared orders. https://packetstorm.news/download/236752...

Apache Camel 4.22.0 gRPC Consumer Exception Disclosure

Apache Camel version 4.22.0 contains an error-message disclosure flaw in its gRPC consumer. A remote caller that provokes a route failure can receive the route exception message in the gRPC status description. The proof of concept reproduces affected and fixed behavior...

Dokploy 0.29.12 Compose Branch Command Injection

Dokploy versions 0.29.3 through 0.29.12 contain a command injection in compose branch fields. The proof of concept stores a crafted branch value, triggers deployment, and confirms execution from deployment logs. https://packetstorm.news/download/236744...

Apache Camel 4.22.0 Platform HTTP Proxy Mode

Apache Camel version 4.22.0 camel-platform-http contains an unintended proxy-mode issue where endpoint paths beginning with proxy are treated as catch-all forwarding proxies. https://packetstorm.news/download/236741...

Fortinet FortiSIEM 7.5 gRPC File Write / Remote Code Execution

Fortinet FortiSIEM version 7.5 contains an unauthenticated gRPC path traversal and NUL-byte injection vulnerability that allows arbitrary file write and remote command execution. https://packetstorm.news/download/236742...

Apache Camel 4.22.0 XML External Entity Injection

Apache Camel camel-smooks versions from 4.7.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an XML external entity issue. The proof of concept demonstrates resolution of a self-created temporary marker file during XML unmarshalling. https://packetstorm.news/download/236738...

Apache Camel 4.22.0 MimeMultipart Mail Header Injection

Apache Camel version 4.22.0 contains a MIME multipart header injection vulnerability in camel-mail that permits attacker-controlled mail.smtp and mail.smtps properties to reach a downstream mail producer. https://packetstorm.news/download/236759...

Apache Camel 4.22.0 OAuth2 Token Cache Confusion

Apache Camel camel-http versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an OAuth2 token-cache flaw that can reuse a token across endpoints differing by scope, resource indicator, or token endpoint. The supplied proof of concept demonstrates the behavior...

TP-Link Tapo C320WS V2 1.5.3 Stack Overflow

TP-Link Tapo C320WS V2 firmware version 1.5.3 Build 260304 contains an authenticated stack-based buffer overflow in the local Wi-Fi onboarding path. The proof of concept sends a crafted encrypted password to execute a command as root. https://packetstorm.news/download/236751...

PHP 8.5.11 Session Upload Progress Use-After-Free / Remote Code Execution

PHP session.uploadprogress contains use-after-free flaws that can permit remote code execution. This proof of concept crafts multipart upload requests for both affected variants. https://packetstorm.news/download/236736...

Apache Camel 4.22.0 JGroups Unsafe Java Deserialization

Apache Camel version 4.22.0 camel-jgroups contains an unsafe Java deserialization issue in cluster message processing. The proof of concept demonstrates attacker-controlled object deserialization using a benign marker class. https://packetstorm.news/download/236735...

PHP 8.4 session.upload_progress Remote Code Execution

PHP version 8.4 and earlier versions are claimed to contain session.uploadprogress use-after-free flaws that may allow remote code execution. Proof of concept code is included. https://packetstorm.news/download/236734...

Gogs 0.13.3 Symlink Remote Code Execution

Gogs version 0.13.3 and earlier contain improper symbolic link handling in the PutContents API. This proof of concept uses a repository symlink to overwrite server-side files and trigger code execution. https://packetstorm.news/download/236748...

Apache NiFi MiNiFi C++ 1.0.0 Uncontrolled Memory Allocation

Apache NiFi MiNiFi C++ versions 1.0.0 and 0.99.2 contain an uncontrolled memory allocation issue in the InputStream reader. A length field from a site-to-site or C2 stream can cause an oversized allocation and crash the agent. // // // Apache NiFi MiNiFi C++ 1.0.0 Uncontrolled Memory Allocation /...

Dokploy 0.29.12 Compose Branch Command Injection

Dokploy versions 0.29.3 through 0.29.12 contain a command injection vulnerability in compose branch fields. This proof of concept demonstrates authenticated arbitrary command execution through compose deployment. https://packetstorm.news/download/236749...

FUEL CMS 1.4.1 Remote Code Execution

FUEL CMS version 1.4.1 contains a PHP code-evaluation vulnerability in the pages/select filter parameter. The proof of concept executes supplied system commands. https://packetstorm.news/download/236747...

MCPJam Inspector 1.4.2 Remote Command Execution

MCPJam Inspector version 1.4.2 and earlier contains a remote command execution vulnerability. The proof of concept sends a crafted server configuration to the MCP connection endpoint. https://packetstorm.news/download/236732...

PHP 8.5.x PHP2Shell Detection

PHP versions 5.4 through 8.5.x may contain PHP2Shell remote code execution vulnerabilities. This tool performs non-exploiting HTTP checks for PHP version and session upload progress indicators. https://packetstorm.news/download/236726...

WordPress Ninja Forms 3.15.5 Cross Site Scripting

WordPress Ninja Forms plugin versions through 3.15.5 contain a stored cross site scripting vulnerability. The proof of concept submits crafted form data that executes when an administrator views the associated submission. https://packetstorm.news/download/236727...

Fleet 4.64.1 SAML Authentication Bypass

Fleet versions before 4.53.2 and versions 4.54.0 through 4.64.1 contain an improper SAML response validation vulnerability that allows attackers to forge authentication assertions and impersonate SSO-enabled users or provision administrative accounts when JIT provisioning is enabled...

Apache Camel 4.22.0 camel-pqc Private Key Permissions

Apache Camel camel-pqc versions from 4.12.0 before 4.18.5 and from 4.19.0 before 4.22.1 write unencrypted private keys using default file permissions, allowing local accounts to read them under a permissive umask. A proof of concept is included. https://packetstorm.news/download/236481...

Android 16 APV Decoder Leak-Assisted ROP

Android version 16 contains an APV decoder heap overflow. This proof of concept uses a leak-assisted ROP chain on a rooted Pixel 9 reference build to demonstrate a controlled native call in media.swcodec. https://packetstorm.news/download/236491...

Exasol Database 7.1.30 Default Credential Python UDF Command Execution

Exasol Database version 7.1.30 docker-db deployments use the documented SYS default credential, which can create a PYTHON3 UDF invoking os.popen and return command output through SELECT. https://packetstorm.news/download/236507...

Edimax BR-6478AC 2.20 Command Injection

Edimax BR-6478AC firmware version 2.20 contains an authenticated command injection vulnerability in the formWlanMP manufacturing-test handler that permits command execution as root. https://packetstorm.news/download/236505...

Polkit pkexec Local Privilege Escalation

Polkit pkexec contains a local privilege-escalation vulnerability. This proof of concept uses a malicious gconv module to obtain a root shell on vulnerable systems. https://packetstorm.news/download/236494...

Apache Camel 4.22.0 Request Header Echo Suppression Bypass

Apache Camel version 4.22.0 contains a case-sensitive request-header suppression check in camel-platform-http. A proof of concept demonstrates that a lowercased Authorization header can be reflected in the response. https://packetstorm.news/download/236496...

Microsoft Windows Kernel-Mode Driver 10.0.22631 Privilege Escalation

Microsoft Windows Kernel-Mode Driver version 10.0.22631 contains an untrusted pointer dereference vulnerability that allows local privilege escalation. A proof of concept is available. https://packetstorm.news/download/236495...

Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT Unauthenticated Remote Code Execution

Parasoft Continuous Testing Platform version 10.7.5-SNAPSHOT contains an unfiltered Java deserialization issue in its database restore path that, with documented license and authentication gate failures, enables unauthenticated JSP command execution. https://packetstorm.news/download/236508...

Apache Camel MLLP 4.22.0 Protected Health Information Logging

Apache Camel MLLP versions before 4.18.5 and from 4.19.0 before 4.22.1 log HL7 payload data by default when DEBUG logging is enabled. The supplied proof of concept demonstrates protected health information exposure in application logs. https://packetstorm.news/download/236484...

WordPress 7.0.1 Pre-Authentication Remote Code Execution

WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2 contain a REST API batch-route confusion and SQL injection chain that can lead to pre-authentication remote code execution. This proof of concept performs auditing, blind SQL extraction, and exploitation...

FreeFloat FTP Server 1.0 NOOP Command Buffer Overflow

FreeFloat FTP Server version 1.0 contains a buffer overflow in its NOOP command handler. The supplied proof of concept documents analysis, fuzzing, offset discovery, and return-address control. https://packetstorm.news/download/236480...

Apache Camel 4.22.0 XPath XML External Entity Processing

Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an XML external entity processing issue in camel-xpath when documentType is set to InputSource. The supplied proof of concept demonstrates local file disclosure through an external entity...

Apache Camel 4.22.0 Tika Metadata Header Injection

Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an input validation flaw in camel-tika that allows parsed document metadata to set Camel-internal message headers. https://packetstorm.news/download/236502...

Mercury 3.2.5 Unauthenticated Remote Code Execution

Mercury versions 3.0.0 through 3.2.5 contain unauthenticated remote code execution through Jupyter kernel execution. Versions through 3.2.3 additionally expose unauthenticated terminal access. This proof of concept demonstrates both issues. https://packetstorm.news/download/236488...

Vivo X100 Ultra Kernel 6.1.145 Privilege Escalation

Vivo X100 Ultra version PD236616.2.19.0.W10 with kernel 6.1.145-android14-11 contains a PI-futex race condition that can be used to obtain root privileges. Proof of concept code is included. https://packetstorm.news/download/236490...

Ollama 0.34.x Manifest Digest Path Traversal / Remote Code Execution

Ollama versions 0.34.2 through 0.34.x contain an unauthenticated manifest-digest path traversal that can plant a shared library outside the model store. This proof of concept demonstrates code execution when the MLX loader loads the planted library. https://packetstorm.news/download/236487...

Apache Camel 4.22.0 HTTP Credential Disclosure

Apache Camel camel-http versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 can disclose OAuth2 bearer tokens or configured credentials to a redirect-selected authority when redirects are followed. The included proof of concept demonstrates the issue with local servers...

Apache jclouds 2.7.0 XML External Entity Injection

Apache jclouds version 2.7.0 contains an XML External Entity injection vulnerability in provider-response parsing that may allow local file disclosure or server-side request forgery when a parsed endpoint is attacker controlled. !/usr/bin/env bash Apache jclouds 2.7.0 XML External Entity XXE...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Apache Paimon versions 2.1.0 and 2.0.0 MySQL CDC synchronization actions allow user-supplied JDBC properties that can enable a rogue MySQL server to request arbitrary local files from the CDC process. !/usr/bin/env bash Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read Vendor: The Apache Software...

Apache Camel camel-knative 4.22.0 Improper Certificate Validation

Apache Camel camel-knative version 4.22.0 contains an improper certificate validation issue that causes the Knative HTTP client to trust all certificates when SSL is enabled without a truststore. The supplied proof of concept demonstrates acceptance of a self-signed local server certificate...

ProSoft RLX-IFH24E version 2.2.44 Unsigned Upgrade Package Root Command Execution

ProSoft RLX-IFH24E version 2.2.44 firmware upgrades do not verify package authenticity, allowing an authenticated attacker to upload a crafted package that executes commands as root on the appliance. https://packetstorm.news/download/236509...