TRENDnet TV-IP302PI 1.02.38 NTP Command Injection

TRENDnet TV-IP302PI version 1.02.38 contains an authenticated command injection vulnerability in the NTP server address that reaches a root shell-form system call. https://packetstorm.news/download/236511...

Apache Camel 4.22.0 SOAP Fault Information Disclosure

Apache Camel versions 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1 contain a SOAP fault information disclosure in camel-cxf. The proof of concept triggers an undeclared route failure and reads its exception detail from the returned SOAP fault. https://packetstorm.news/download/236493...

Edimax BR-6478AC 2.20 Command Injection

Edimax BR-6478AC version 2.20 contains an authenticated command injection vulnerability in the setWAN WAN-configuration handler that can lead to root command execution. https://packetstorm.news/download/236506...

PCMan FTP Server 2.0 PWD Command Buffer Overflow

PCMan FTP Server version 2.0 contains a buffer overflow in the PWD command that allows remote attackers to execute arbitrary code. This Metasploit module sends a crafted FTP PWD request to demonstrate the issue. https://packetstorm.news/download/236498...

Apache Camel 4.22.0 PQC Signature Verification Bypass

Apache Camel version 4.22.0 camel-pqc contains a race condition in concurrent Signature use that can cause signature verification results to apply to incorrect message data. The proof of concept demonstrates the issue using concurrent local sign and verify operations...

Apache Camel 4.22.0 AS2 MDN Signing Key Confusion

Apache Camel version 4.22.0 AS2 component contains a race condition that can cause Message Disposition Notifications in multi-partner deployments using dynamic keys to be signed with a different partner's private key. https://packetstorm.news/download/236482...

Wails 2.12.0 Origin Validator Wildcard Bypass

Wails versions 2.0.0 through 2.12.0 contain an origin-validation wildcard bypass. This proof of concept compares vulnerable and fixed OriginValidator behavior using crafted allowed-origin patterns. https://packetstorm.news/download/236362...

Amasty Order Attributes 3.16.0 Arbitrary File Upload

Amasty Order Attributes versions through version 3.16.0 contain an unauthenticated arbitrary file upload vulnerability. This proof of concept uploads supplied HTML content or, in full mode, PHP web shells. https://packetstorm.news/download/236358...

Apache Camel 4.22.0 Shiro Authentication Bypass

Apache Camel version 4.22.0 camel-shiro contains an authentication bypass when a thread-bound Shiro subject has the same principal as a later exchange, allowing its presented credentials to evade verification. This proof of concept demonstrates the issue. https://packetstorm.news/download/236339...

Apache Camel 4.22.0 OAuth Login Cross Site Request Forgery

Apache Camel version 4.22.0 camel-oauth contains a login cross site request forgery vulnerability in its OAuth authorization-code callback due to missing state validation. The supplied proof of concept reproduces the issue using a local stub identity provider...

Proxmox VE 8.0.3 Authentication Bypass

Proxmox VE versions 7.0 through 8.0.3 contain an authentication bypass in libpve-access-control. The supplied proof of concept submits an arbitrary tfa-challenge value to the access ticket API and reports issued authentication tickets. https://packetstorm.news/download/236347...

Apache HTTP Server 2.4.63 TLS Upgrade Session Hijacking

Apache HTTP Server version 2.4.63 with modssl configured with SSLEngine optional contains an HTTP desynchronization flaw that allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. https://packetstorm.news/download/236361...

WordPress LearnPress 4.4.10 PHP Object Injection

WordPress LearnPress plugin versions through 4.4.10 contain an unauthenticated PHP object injection issue in the checkout-email parameter. The proof of concept fingerprints targets, submits a serialized payload through the checkout AJAX action, and triggers session reads...

Drupal Core 11.4.9 Field UI Remote Code Execution

Drupal Core version 11.4.9 Field UI contains a remote code execution vulnerability when contributed or custom code permits HTTP control of a table row's region callback. This research pack provides a loopback Docker proof of concept with a synthetic writer and documents an upload-staged execution...

Langflow 1.2.0 Code Injection

Langflow versions prior to 1.3.0 contain an unauthenticated code injection vulnerability in the /api/v1/validate/code endpoint. The supplied CTF lab recreates the vulnerable validation logic, and its proof of concept executes commands against the target to retrieve its flag...

Apache Camel 4.22.0 Knative HTTP Consumer Information Disclosure

Apache Camel version 4.22.0 camel-knative HTTP consumers disclose exception class names, messages, and stack traces to remote callers after a route failure. The supplied proof of concept demonstrates affected and fixed behavior. https://packetstorm.news/download/236341...

React Server Components 19.2.0 Remote Code Execution

React Server Components version 19.2.0 contains an unsafe deserialization vulnerability that allows unauthenticated remote code execution via crafted requests. This proof of concept demonstrates server-side command execution. https://packetstorm.news/download/236351...

Apache Camel camel-thrift 4.22.0 Cross-Exchange Data Disclosure

Apache Camel camel-thrift versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a cross-exchange data disclosure issue. The proof of concept demonstrates a later Thrift message inheriting an omitted field from an earlier message. https://packetstorm.news/download/236333...

Apache Camel 4.22.0 Platform HTTP CORS Credential Exposure

Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a CORS flaw in camel-platform-http-vertx that reflects arbitrary Origin values and permits credentials when CORS is enabled without configured origins. The included proof of concept demonstrates the issue...

Apache Camel 4.22.0 AS2 Asynchronous MDN SSRF

Apache Camel version 4.22.0 camel-as2 contains a server-side request forgery and MDN-delivery credential disclosure flaw through a sender-supplied asynchronous MDN address. The proof of concept reproduces the issue using a local internal sink. https://packetstorm.news/download/236350...

MariaDB 13.0.1 Multiple Vulnerabilities

MariaDB version 13.0.1 contains a table-name encoding/cache collision, an STAsText out-of-bounds write, and a SYSREFCURSOR use-after-free. Included proof of concept code demonstrates the issues using low-privilege SQL. https://packetstorm.news/download/236357...

Apache Camel 4.22.0 PGP Integrity Verification Downgrade

Apache Camel version 4.22.0 contains an integrity-verification downgrade in camel-crypto-pgp. The proof of concept generates a legacy OpenPGP message without modification detection data and demonstrates that the affected decryptor accepts it. https://packetstorm.news/download/236335...

Apache Qpid Dispatch Router 1.19.0 Remote Stack Overflow

Apache Qpid Dispatch Router version 1.19.0 contains an unbounded recursion denial-of-service vulnerability in its AMQP field parser. A mutually authenticated remote peer can supply deeply nested message annotations to exhaust the stack and crash the router. / Apache Qpid Dispatch Router 1.19.0...

Apache Camel 4.22.0 Dynamic Router Expression Language Injection

Apache Camel version 4.22.0 camel-dynamic-router contains an expression language injection issue in the dynamic-router-control endpoint. The proof of concept demonstrates an attacker-supplied subscription predicate being evaluated by the Camel process. https://packetstorm.news/download/236349...

Automotive Shop Management System 1.0 SQL Injection

Automotive Shop Management System version 1.0 suffers from a remote SQL injection vulnerability. Titles: Automotive Shop Management System 1.0 Multiple SQLi Author: nu11secur1ty Date: 10/19/26 Vendor: https://github.com/oretnom23 Software:...

WordPress Bricks Builder 1.9.6 Remote Code Execution

WordPress Bricks Builder versions 1.9.6 and earlier contain an unauthenticated remote code execution vulnerability in the renderelement REST endpoint. A proof of concept extracts a nonce, confirms exposure, and provides interactive command execution. https://packetstorm.news/download/236356...

Apache Camel 4.22.0 Mina Consumer Information Disclosure

Apache Camel version 4.22.0 camel-mina consumers disclose route exception details to remote peers when processing fails. The supplied proof of concept demonstrates disclosure of an exception class and simulated internal message over a synchronous textline TCP connection...

Jenkins 2.426.2 LTS CLI Arbitrary File Read

Jenkins version 2.426.2 LTS contains an arbitrary file read vulnerability in CLI argument processing that can expose files readable by the Jenkins process. The supplied proof of concept retrieves CTF credentials through this issue. https://packetstorm.news/download/236352...

vsftpd 2.3.4 Backdoor

vsftpd version 2.3.4 from a compromised 2011 distribution contains a backdoor that can be triggered through an FTP username to expose a command shell on TCP port 6200. https://packetstorm.news/download/236340...

Teable 1.10.0 Attachment Write Path Traversal

Teable versions 1.10.0 and earlier contain an attachment signature path traversal vulnerability that allows an authenticated user to write or overwrite files outside the local storage directory with backend-process privileges. https://packetstorm.news/download/236363...

Samba 4.24.4 LDB Special DN Modification

Samba AD DC versions through 4.24.4 contain an authenticated LDAP access flaw that allows low-privilege domain users to modify internal LDB special DNs, potentially bypassing directory ACL enforcement. https://packetstorm.news/download/236142...

Magento Open Source 2.4.9-2026-sep Block Directive Injection

Magento Open Source version 2.4.9-2026-sep and earlier contains a template directive-injection vulnerability. This lab provides proof of concept A/B validation for an unauthenticated block-directive primitive and bounded file side effect, with a separately labeled synthetic fixed-command gadget...

Joomla JCE 2.9.99.4 Unauthenticated Remote Code Execution

Joomla JCE versions through 2.9.99.4 contain an unauthenticated arbitrary file upload vulnerability in profile import functionality that can lead to remote code execution. The included proof of concept uploads and verifies a PHP shell on affected targets. https://packetstorm.news/download/236154...

django-import-export 4.4.1 Integer Conversion Denial of Service

django-import-export versions 2.7.0 through 4.4.1 contain an uncontrolled resource consumption issue in IntegerWidget.clean. A staff user able to import data can submit scientific-notation integer input that consumes CPU time during conversion. https://packetstorm.news/download/236158...

WordPress Login with Phone Number 1.7.16 Password Reset

WordPress Login With Phone Number plugin versions 1.7.16 and prior contain an unauthorized account password change vulnerability that may allow privilege escalation. Included is a proof of concept. https://packetstorm.news/download/236159...

Vite 6.2.3 Arbitrary File Read

Vite versions before 4.5.11, 5.4.16, 6.0.13, 6.1.3, and 6.2.4 contain server.fs.deny bypasses that may expose arbitrary files through the development server. This proof of concept identifies exposed Vite servers and validates filesystem reads. https://packetstorm.news/download/236143...

WordPress Gravity SMTP 2.1.4 Sensitive Information Exposure

WordPress Gravity SMTP plugin versions through 2.1.4 contain an unauthenticated sensitive information exposure vulnerability in a REST API endpoint. The supplied proof of concept scanners request the exposed report and identify leaked configuration data. https://packetstorm.news/download/236149...

...[ More ]

OpenBSD 7.9 contains kernel vulnerabilities involving a signed 16-bit System V shared memory attachment counter overflow, a use-after-free race condition, and an out-of-bounds write. These issues can be chained to allow a local attacker to escalate privileges to root, bypassing kernel protections...

Akai MPC Sample 1.3.0.12 Path Traversal

Akai MPC Sample version 1.3.0.12 contains a path traversal vulnerability in its built-in web server that allows unauthenticated file reads outside the webroot through the USB-C virtual Ethernet interface. https://packetstorm.news/download/236153...

WordPress WooCommerce Designer Pro 1.9.26 Arbitrary File Upload

WordPress WooCommerce Designer Pro versions 1.9.26 and prior contain an unauthenticated arbitrary file upload vulnerability in the wcdpsavecanvasdesignajax handler that may allow remote code execution. https://packetstorm.news/download/236146...

Apache Camel camel-netty-http 4.22.0 Security Constraint Bypass

Apache Camel camel-netty-http version 4.22.0 contains a security constraint bypass vulnerability. A proof of concept demonstrates that altering a request context-path case can bypass configured authentication and reach a protected route. https://packetstorm.news/download/236141...

go-git 5.19.1 Reference Name Path Traversal

go-git version 5.19.1 contains a path traversal issue in filesystem-backed loose-reference storage. This proof of concept safely demonstrates a crafted reference name overwriting a temporary .git/config file. https://packetstorm.news/download/236148...

MLflow 3.17.1 and Prior StartTrace Path Traversal

MLflow version 3.17.1 and prior versions using the FileStore tracking backend contain a path traversal vulnerability in the StartTraceV3 API. The proof of concept submits a traversal trace ID and demonstrates trace files written outside the intended trace directory...

Apache Tomcat 11.0.22 Examples Cross Site Scripting

Apache Tomcat versions through 11.0.22 contain a cross site scripting issue in the Number Guess example. The supplied proof of concept scanner tests this issue and CVE-2022-34305 in the Examples web application. https://packetstorm.news/download/236150...

Apache SystemDS 3.5.0-SNAPSHOT Unauthenticated Java Deserialization

Apache SystemDS versions 3.4.0 and 3.5.0-SNAPSHOT federated worker contains an unauthenticated Java deserialization vulnerability that may allow remote code execution when a suitable gadget class is present. !/usr/bin/env bash Apache SystemDS 3.4.0 Unauthenticated Java Deserialization Vendor: The...

Roundcube Webmail 1.6.10 PHP Object Deserialization

Roundcube Webmail version 1.6.10 contains a post-authentication PHP object deserialization vulnerability that can allow arbitrary command execution. Included are a CTF environment and proof of concept exploit. https://packetstorm.news/download/236152...

Apache Camel camel-oauth 4.22.0 Authentication Bypass

Apache Camel camel-oauth versions from 4.11.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an authentication bypass vulnerability. The supplied proof of concept demonstrates unauthenticated access to a protected route when OAuth authentication fails open...

Krayin CRM 2.2.x Remote Code Execution

Krayin CRM version 2.2.x contains an authenticated arbitrary file upload vulnerability in its TinyMCE upload endpoint that allows remote code execution by uploading a crafted PHP file. This proof of concept authenticates, uploads a PHP command shell, and invokes a supplied command...

Apache Camel FTP 4.22.0 Path Traversal

Apache Camel FTP versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a path traversal vulnerability. This proof of concept uses a malicious directory listing to demonstrate access to a file outside the configured polling directory. https://packetstorm.news/download/236116...

Apache Log4j 1.2.17 JDBCAppender SQL Injection

Apache Log4j version 1.2.17 JDBCAppender contains an SQL injection vulnerability when an unescaped logging message is embedded in a JDBCAppender SQL pattern. This package provides an isolated H2 proof of concept and whitebox data-flow report. https://packetstorm.news/download/236092...