Apache Camel 4.22.0 SFTP Consumer Path Traversal

Apache Camel versions from 4.18.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a path traversal issue in the mina-sftp consumer. A malicious SFTP server can supply crafted directory-entry names that cause the consumer to access files outside its configured polling directory. Included proof...

GNU InetUtils 2.7 Telnetd Authentication Bypass

GNU InetUtils versions through 2.7 contain an authentication bypass in telnetd through the Telnet NEW-ENVIRON USER variable. The included proof of concept establishes an interactive session. https://packetstorm.news/download/236118...

SLiMS 9.8.0 Admin Bibliography SQL Injection

SLiMS version 9.8.0 contains an SQL injection vulnerability in its admin bibliography module via unquoted opachide and promoted GET parameters, allowing authenticated staff users to extract database information. https://packetstorm.news/download/236103...

Langflow 1.8.1 Unauthenticated Remote Code Execution

Langflow version 1.8.1 and earlier contains an unauthenticated remote code execution vulnerability in the public flow build endpoint. A proof of concept is provided. https://packetstorm.news/download/236110...

ExifTool 12.23 Arbitrary Code Execution

ExifTool versions 7.44 through 12.23 contain an arbitrary code execution vulnerability in DjVu processing. This proof of concept creates a JPEG embedding a crafted DjVu payload that executes a specified command when processed. https://packetstorm.news/download/236124...

Microsoft SharePoint Server Privilege Escalation

Microsoft SharePoint Server is susceptible to an elevation of privilege vulnerability. This incident response report provides indicators of compromise, timeline information, and MITRE ATT&CK mappings for attempted exploitation. https://packetstorm.news/download/236094...

CKEditor Open Link 1.0.4 Cross Site Scripting

CKEditor Open Link versions before 1.0.5 contain a cross site scripting vulnerability that allows JavaScript execution through a crafted link href attribute. https://packetstorm.news/download/236113...

WordPress Theme My Login 7.2.1 Unauthenticated Account Takeover

WordPress Theme My Login plugin versions through 7.2.1 on multisite installations with tmluserpasswords enabled contain an unauthenticated password overwrite vulnerability. A proof of concept is included. https://packetstorm.news/download/236111...

SLiMS 9.8.0 Cross Site Request Forgery

SLiMS version 9.8.0 contains a cross site request forgery issue in loan history maintenance that lets an authenticated administrator with circulation write access trigger destructive GET actions, including truncation of loan history records. https://packetstorm.news/download/236101...

React Server Components 19.2.0 Remote Code Execution

React Server Components version 19.2.0 contains a remote code execution vulnerability. The proof of concept sends a crafted multipart request to execute a supplied command on a vulnerable server. https://packetstorm.news/download/236108...

Keycloak Versions Email Username Validation

Keycloak versions prior to 24.0.1 allow an attacker to register a username matching another user's email address, preventing that user from resetting or logging in using email. https://packetstorm.news/download/236114...

GNU Bash 4.3 Remote Command Execution

GNU Bash versions through 4.3 contain a flaw that allows crafted environment variables passed to CGI scripts to execute commands. This proof of concept sends a malicious User-Agent header to demonstrate the issue. https://packetstorm.news/download/236107...

Apache Lounge Windows 2.4.68 DLL Hijacking

Apache Lounge Windows versions before 2.4.68-260920 contain insecure installation directory permissions. The supplied proof of concept demonstrates local privilege escalation by planting a proxy VCRUNTIME140.dll that executes when the Apache service restarts. https://packetstorm.news/download/236...

CrushFTP 11.3.7_56 HTML Injection

CrushFTP versions before 11.3.757 contain a persistent HTML injection vulnerability in the Admin Panel Reports “Who Created Folder” view. An authenticated user permitted to create folders can inject HTML that is rendered when an administrator runs the report. https://packetstorm.news/download/236...

Mage AI 0.9.80 OAuth Authentication Bypass

Mage AI versions through 0.9.80 contain an OAuth authentication bypass in the session-creation endpoint that accepts an unknown provider and issues a session for an attacker-supplied email. The proof of concept requests a session and verifies authenticated API access...

SLiMS 9.8.0 SQL Injection

SLiMS version 9.8.0 contains SQL injection vulnerabilities in the serial control subscription and reporting detail administration modules. The supplied proof of concept demonstrates authenticated error-based database version disclosure through unquoted numeric parameters...

Apache Airflow SSH and SFTP Providers 6.0.1 Host Key Verification

Apache Airflow SSH and SFTP providers through version 6.0.1 disable SSH host key verification by default, allowing a man-in-the-middle attacker to impersonate an SSH server. This proof of concept demonstrates acceptance of an untrusted server key. https://packetstorm.news/download/236119...

Tandoor Recipes 2.6.9 Server-Side Request Forgery

Tandoor Recipes versions before 2.6.10 contain a server-side request forgery issue in authenticated AI provider actions. The supplied proof of concept authenticates to a target and invokes the affected AI import and step-sort endpoints. https://packetstorm.news/download/236098...

Apache Doris 4.1.5 JDBC Catalog Arbitrary File Read

Apache Doris version 4.1.5 JDBC catalog handling permits an attacker-controlled MySQL server to request arbitrary local files from the Frontend host through the MySQL driver's LOCAL INFILE support. The proof of concept demonstrates the issue. !/usr/bin/env python Apache Doris 4.1.5 JDBC Catalog...

Wheels 4.1.2 SQL Injection

Wheels versions through 4.1.2 contain a SQL injection issue on MySQL and MariaDB when request data reaches inline-literal query paths. This proof of concept verifies the issue and can extract scalar query results. https://packetstorm.news/download/236047...

WAVLINK WN530HG4B M30HG4B_V260724 Remote Code Execution

WAVLINK WN530HG4B firmware version M30HG4BV260724 contains a pre-authentication heap overflow in api.cgi that can result in remote code execution. A proof of concept is provided. https://packetstorm.news/download/236050...

Apache HTTP Server 2.4.49 Path Traversal / Remote Code Execution

Apache HTTP Server version 2.4.49 contains a path traversal vulnerability that can read arbitrary files and, when modcgi is enabled with permissive access controls, execute commands. This proof of concept demonstrates both conditions. https://packetstorm.news/download/236046...

Apache Camel Spring Redis 4.22.0 Unsafe Deserialization

Apache Camel Spring Redis versions from 2.11.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an unsafe Java deserialization issue. The proof of concept shows a Redis publisher triggering a consumer's default serializer without an ObjectInputFilter. https://packetstorm.news/download/236038...

Floci VTL Template Injection Remote Code Execution

Floci versions 1.1.0 and later before version 2.2.0 contain a code injection vulnerability in VtlTemplateEngine that allows unauthenticated command execution through unrestricted Velocity mapping templates. https://packetstorm.news/download/236045...

Apache Camel 4.22.0 Hazelcast Deserialization Remote Code Execution

Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an unsafe Java deserialization issue in camel-hazelcast. The proof of concept demonstrates deserialization through a ReplicatedHazelcastAggregationRepository. https://packetstorm.news/download/236042...

Frappe HRMS 16.x Authenticated Blind SQL Injection

Frappe HRMS versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contain an authenticated blind SQL injection vulnerability that permits extraction of sensitive database information. https://packetstorm.news/download/236048...

Next.js 16.4.0 Image Optimization Remote Code Execution

Next.js versions through 15.5.27 and 16.0.1 through 16.4.0 contain an unauthenticated remote code execution vulnerability in Image Optimization when crafted SVG content is processed by vulnerable sharp and librsvg builds. https://packetstorm.news/download/236044...

WordPress Bricksforge 3.1.8.9 Unauthenticated Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability via the temporaryFileUploads parameter. The proof of concept uploads a GIF/PHP polyglot and verifies PHP execution. https://packetstorm.news/download/236057...

Ollama 0.31.1 Bash Approval Bypass

Ollama version 0.31.1 experimental Agent Mode contains an incorrect authorization flaw that permits appended shell commands to reuse an approved command prefix. The proof of concept exercises the vulnerable approval logic without executing commands. https://packetstorm.news/download/236043...

DragonFly BSD 6.4.2 ARP Memory Disclosure

DragonFly BSD versions through 6.4.2 contain an out-of-bounds read in ARP packet handling. A proof of concept sends a malformed ARP request with oversized address-length fields and captures memory exposed in the response. https://packetstorm.news/download/236054...

cifs-utils 7.6 Credentials File Option Injection

cifs-utils versions 7.0 through 7.6 contain a credentials-file option injection vulnerability that allows an unprivileged local user who controls a credentials file used by a privileged mount to inject mount options and execute files with root privileges. https://packetstorm.news/download/236052...

Apache Camel 4.22.0 Docling SSRF / Local File Disclosure

Apache Camel version 4.22.0 camel-docling contains an input-source confusion flaw that lets attacker-controlled String bodies cause server-side URL fetches or local file reads. The proof of concept demonstrates SSRF and local file disclosure. https://packetstorm.news/download/236040...

Apache MINA Vysper 0.7 Unbounded XML Buffer Denial of Service

Apache MINA Vysper version 0.7 contains a pre-authentication denial-of-service vulnerability due to unbounded XML buffering that can exhaust JVM heap memory. Apache MINA Vysper 0.7 Unbounded XML Buffer Pre-Auth DoS Vendor: The Apache Software Foundation Product web page: https://mina.apache.org...

Apache Camel 4.22.0 HTTP Producer Property Placeholder Information Disclosure

Apache Camel version 4.22.0 HTTP producers resolve property placeholders in message-supplied CamelHttpUri and CamelRestHttpUri override headers. An unauthenticated sender able to influence these headers can cause configuration values or vault secrets to be expanded into outbound requests. The...

Neterbit NW-431F 20250715 SMS Information Disclosure

Neterbit NW-431F version 20250715 contains an unauthenticated information disclosure in /sms.json that exposes stored SMS records. The proof of concept retrieves and analyzes the response. https://packetstorm.news/download/236053...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload flaw that can result in PHP code execution. The included proof of concept demonstrates the issue with a GIF/PHP marker polyglot. https://packetstorm.news/download/235859...

MaxKB 2.10.3-lts Prompt Injection Command Execution

MaxKB version 2.10.3-lts and earlier exposes an ungated shell execute tool to capable agents, allowing prompt injection through chat or ingested documents to trigger command execution. The included proof of concept demonstrates the missing approval gate and a sandbox-wrapper metacharacter escape...

...[ More ]

Vesta Control Panel VestaCP versions up to and including 0.9.8-26 contain an OS command injection vulnerability in the configuration parsing functionality. The shared shell library uses unsafe eval operations to process user-controlled configuration values, allowing an authenticated hosting accou...

...[ More ]

Android's CALLPHONE permission allows applications to execute carrier MMI/USSD codes without user confirmation. ACR Phone / Cube ACR exposes a browser-accessible intent handler that can be abused to execute these codes when the application has CALLPHONE permission and is configured as the default...

...[ More ]

SmarterMail contains multiple vulnerabilities that can be chained to achieve remote code execution with NT AUTHORITY\SYSTEM privileges. The issues include a mutation-based cross site scripting vulnerability involving iCalendar attachments, improper session token invalidation that allows...

DragonFly BSD 6.4.2 ARP Kernel Memory Disclosure

DragonFly BSD versions through 6.4.2 contain an ARP address-length validation flaw that permits unauthenticated same-network disclosure of kernel heap and stack memory. A proof of concept is included. https://packetstorm.news/download/235846...

pac4j-jwt 6.3.2 Authentication Bypass

pac4j-jwt version 6.3.2 and earlier affected release lines contain an authentication bypass in JwtAuthenticator when processing encrypted JWTs. The proof of concept creates a JWE-wrapped unsigned JWT with arbitrary claims. https://packetstorm.news/download/235858...

curl/libcurl 8.22.0 HTTP/2 Upload Use-After-Free

curl/libcurl versions 8.12.0 through 8.22.0 contain an HTTP/2 upload use-after-free when processing RSTSTREAM frames. The supplied proof of concept provides local assessment and an opt-in loopback protocol probe. https://packetstorm.news/download/235856...

Telegram Desktop 7.2.8 IPC Injection Account Takeover

Telegram Desktop version 7.2.8 and earlier contains an IPC record-separator injection issue that can expose local session files through the internal interpret URI handler. The proof of concept generates instruction files and serves a redirect to demonstrate account takeover...

Microsoft Edge Copilot Chat Information Disclosure

Microsoft Copilot Chat in Edge contains an information disclosure vulnerability that allows a crafted attachment to inject instructions and exfiltrate tab content through a rendered email image. https://packetstorm.news/download/235850...

Keycloak 26.7.1 Reset Credentials Authentication Bypass

Keycloak versions 26.0.0 through 26.7.1 contain an authentication bypass in the reset-credentials flow that can permit an unauthenticated attacker to set a user's password. https://packetstorm.news/download/235836...

WordPress WP File Manager 6.8 Unauthenticated Remote Code Execution

WordPress WP File Manager versions 6.0 through 6.8 expose an elFinder connector that permits unauthenticated arbitrary file upload, enabling remote code execution. This proof of concept checks exposure, uploads a file, or temporarily uploads a shell to run a command...

Koha Library Software OS Command Injection

Koha Library Software versions before 23.05.10 contain an OS command injection in cover-image ZIP processing. The proof of concept demonstrates command execution through a crafted uploaded ZIP filename. https://packetstorm.news/download/235863...

SLiMS 9.8.0 Authenticated SQL Injection

SLiMS version 9.8.0 contains an authenticated SQL injection vulnerability in admin AJAX endpoints due to unvalidated table and field identifiers. A proof of concept demonstrates disclosure of data from arbitrary tables. https://packetstorm.news/download/235855...

NiceGUI 3.3.1 Path Traversal

NiceGUI version 3.3.1 contains a path traversal vulnerability in App.addmediafiles that allows unauthenticated remote attackers to read arbitrary files. Included proof of concept demonstrates retrieval of a protected lab flag. https://packetstorm.news/download/235842...