Adobe Commerce and Magento Open Source 2.4.9-alpha2 Improper Input Validation

Adobe Commerce and Magento Open Source versions through 2.4.9-alpha2 contain an improper input validation vulnerability in the REST API. The proof of concept uploads a crafted session file, redirects the session save path through nested deserialization, and triggers execution of a supplied PHP...

VirtualBox 7.2.97 IDispatch COM Object Interop Process Hardening Bypass

VirtualBox version 7.2.97 on Windows contains an IDispatch COM object interop process hardening bypass that can allow arbitrary COM object creation in a protected VirtualBox process. The proof of concept displays a message box from the protected process. https://packetstorm.news/download/235878...

dcm4che 5.35.0 HL7Rcv Path Traversal

dcm4che version 5.35.0 contains a path traversal vulnerability in the HL7Rcv command-line tool. Remote attackers able to send HL7 MLLP messages can write arbitrary files outside the configured storage directory. Advisory ID: SYSS-2026-078 Product: dcm4che Manufacturer: J4Care Affected Versions:...

dcm4che 5.35.0 Agfa2Dcm Path Traversal

dcm4che version 5.35.0 Agfa2Dcm contains a path traversal vulnerability that allows an attacker supplying an Agfa ARCHIVE-BLOB DICOM file to write extracted data outside the configured output directory. Advisory ID: SYSS-2026-079 Product: dcm4che Manufacturer: J4Care Affected Versions: 5.35.0...

dcm4che 5.35.0 Agfa2SR Path Traversal

dcm4che version 5.35.0 Agfa2SR contains a path traversal vulnerability that allows an attacker-supplied Agfa XML Structured Report to write files outside the configured output directory. Advisory ID: SYSS-2026-080 Product: dcm4che Manufacturer: J4Care Affected Versions: 5.35.0 Tested Versions:...

VirtualBox 7.2.97 .NET FlatImageLayout Process Hardening Bypass

VirtualBox version 7.2.97 contains a .NET FlatImageLayout process-hardening bypass. The included proof of concept uses a per-user COM registration hijack to load an AnyCPU .NET assembly into a hardened VirtualBox VM process. https://packetstorm.news/download/235874...

VirtualBox 7.2.97 COM RPC Interface Code Injection / Privilege Escalation

VirtualBox version 7.2.97 on Windows contains an insufficient fix for a COM RPC interface code injection elevation of privilege issue. The proof of concept invokes GetCurrentProcessId in a hardened VirtualBox process. https://packetstorm.news/download/235875...

Apache Bigtop Manager 1.1.0 TarballExtractor Arbitrary File Write

Apache Bigtop Manager version 1.1.0 TarballExtractor contains a path traversal vulnerability that allows a malicious service tarball to write files outside the intended extraction directory. !/usr/bin/env python Apache Bigtop Manager 1.1.0 TarballExtractor Arbitrary File Write Vendor: The Apache...

Langflow 1.8.2 Remote Code Execution

Langflow version 1.8.2 contains an unauthenticated remote code execution vulnerability in its public flow build endpoint. A proof of concept is included. https://packetstorm.news/download/235866...

Hikvision IP Camera Authentication Bypass

Hikvision IP cameras affected by CVE-2017-7921 allow unauthenticated retrieval of an encrypted configuration file. This proof of concept retrieves and decrypts the file to recover administrator credentials. https://packetstorm.news/download/235867...

WordPress SimpleForm 3.10.0 Unauthenticated Privilege Escalation

WordPress SimpleForm plugin versions through 3.10.0 contain an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts through an insecure registration AJAX action. https://packetstorm.news/download/235862...

dcm4che 5.35.0 StoreSCP Path Traversal

dcm4che version 5.35.0 StoreSCP contains a path traversal vulnerability that allows unauthenticated remote attackers to write DICOM files outside the configured storage directory via attacker-controlled DICOM attribute values. Advisory ID: SYSS-2026-077 Product: dcm4che Manufacturer: J4Care...

Gitea 1.26.2 Reverse Proxy Authentication Bypass

Gitea version 1.26.2 Docker images trust reverse proxy authentication headers from any source, allowing unauthenticated impersonation through X-WEBAUTH-USER. This Docker-based proof of concept provides a CTF environment demonstrating access to a private repository...

Weblate 5.15.2 SSH Keyscan Argument Injection

Weblate versions prior to 5.16.0 contain an argument injection in the SSH management console. An authenticated administrator can use the supplied proof of concept to cause ssh-keyscan to read a server-local file and reflect its contents in error output. https://packetstorm.news/download/235840...

Polkit Local Privilege Escalation

Polkit contains a local privilege escalation vulnerability in pkexec. This proof of concept uses a malicious GCONVPATH environment setup to execute an embedded shared object and launch a root shell. https://packetstorm.news/download/235857...

GLPI 10.0.17 Authenticated Remote Code Execution

GLPI versions through 10.0.17 contain an authenticated remote code execution vulnerability that can force execution of PHP files on the server. A proof of concept helper demonstrates updating the vulnerable PDF-font preference and triggering PDF export. https://packetstorm.news/download/235864...

Microsoft Windows Kernel-Mode Drivers Use-After-Free / Privilege Escalation

Microsoft Windows Kernel-Mode Drivers contain a use-after-free in Frame Server stream handling that allows an authorized local attacker to elevate privileges. The proof of concept races stream publishing and closure to obtain SeDebugPrivilege and launch a command shell...

TP-Link Wi-Fi Range Extenders Improper Authentication

Multiple TP-Link Wi-Fi range extenders contain an improper authentication issue in the HTTP web-management login flow. The included proof of concept passively captures login traffic and derives alternative credential values that authenticate to the affected device...

VirtualBox 7.2.97 COM Object Interop Process Hardening Bypass

VirtualBox version 7.2.97 contains a TOCTOU flaw in serial-port COM handling that permits an out-of-bounds write in a hardened process. The proof of concept demonstrates elevation of privilege by modifying a Console state value. https://packetstorm.news/download/235877...

VirtualBox 7.2.97 WDDM VidPnSourceId Kernel Memory Corruption

VirtualBox version 7.2.97 Windows Guest Additions WDDM driver contains an unvalidated VidPnSourceId field that can cause out-of-bounds memory access and guest elevation of privilege. The proof of concept triggers the vulnerable driver escape path. https://packetstorm.news/download/235876...

Kirby CMS 5.5.3 Dynamic Field Option Authorization Bypass

Kirby CMS versions 4.9.0 through 4.9.5 and 5.5.0 through 5.5.3 contain an authorization bypass in query-backed Panel field options that may disclose metadata for restricted models to a limited authenticated user. Included proof of concept uses synthetic in-memory content...

TP-Link Tapo C500 2.0 TDP Denial of Service

TP-Link Tapo C500 v2.0 firmware versions before 1.3.5 Build 260810 contain an out-of-bounds function-pointer dispatch in the TDP daemon. The proof of concept sends one unauthenticated UDP datagram that crashes the main service, causing denial of service. https://packetstorm.news/download/235635...

Google Chrome 142.0.7444.174 V8 Type Confusion

Google Chrome versions prior to 142.0.7444.175 contain a V8 type confusion vulnerability. The proof of concept uses super property access with a primitive receiver to trigger a crash. https://packetstorm.news/download/235609...

Apache IoTDB 2.0.11 Authenticated Server-Side Request Forgery

Apache IoTDB version 2.0.11 contains an authenticated server-side request forgery vulnerability in the user-defined function mechanism. Apache IoTDB 2.0.11 Authenticated Server-Side Request Forgery Vendor: The Apache Software Foundation Product web page: https://iotdb.apache.org Affected version:...

JavaScriptCore Concurrent JIT Type Confusion

JavaScriptCore contains a TOCTOU type confusion in DFG concurrent compilation that can allow garbage collection of a constant-property cell. The supplied proof of concept exercises the condition against a vulnerable WebKit tree. https://packetstorm.news/download/235613...

V8 11.2.214.13 Type Confusion

V8 version 11.2.214.13 contains a type confusion issue in lazy Error stack trace formatting that can leak TheHole. The supplied proof of concept demonstrates the leak. https://packetstorm.news/download/235615...

Windows 11 29617.1000 WHESVC Privilege Escalation

Windows 11 versions 26200.8457 and 29617.1000 contain a privilege-boundary issue in the Windows Health and Optimized Experiences service. The supplied proof of concept emits a Windows Diagnostics Lua ETW workflow that causes an attacker-controlled Lua module to execute as LocalSystem and writes a...

V8 12.5.227.12 Type Confusion

V8 version 12.5.227.12 contains a type confusion vulnerability involving class static block parsing. A proof of concept demonstrates stale closure slot handling after bytecode flushing. https://packetstorm.news/download/235611...

WordPress Abandoned Cart Pro for WooCommerce 10.8.0 Authentication Bypass

WordPress Abandoned Cart Pro for WooCommerce versions through 10.8.0 contain an authentication bypass through forged cart recovery tokens. The supplied proof of concept checks exposed versions and forges or uses recovery links. https://packetstorm.news/download/235604...

WordPress SimpleForm 3.10.0 Unauthenticated Privilege Escalation

WordPress SimpleForm plugin versions through 3.10.0 contain an unauthenticated privilege escalation vulnerability that allows creation of an Administrator account through a registration AJAX endpoint. https://packetstorm.news/download/235620...

Danfoss AK-SM 8xxA Authentication Bypass

Danfoss AK-SM 8xxA series versions prior to version 4.2 contain an improper authentication vulnerability that permits a code-of-the-day authentication bypass. This proof of concept obtains the device date, derives the daily code, and exercises the alternate authentication path...

TP-Link Tapo C500 v2.0 ONVIF PTZ Stack Write Denial of Service

TP-Link Tapo C500 version 2.0 firmware versions before 1.3.5 Build 260810 contain an authenticated ONVIF PTZ out-of-bounds stack write vulnerability. The proof of concept sends excessive RemovePreset elements to crash the main service. https://packetstorm.news/download/235636...

Samsung libsubextractor.so One UI 8.5 Heap Buffer Overflow

Samsung libsubextractor.so in One UI version 8.5 contains a heap buffer overflow in subtitle charset conversion. The supplied proof of concept uses a crafted ShiftJIS SRT sidecar subtitle to trigger the overflow through Samsung Video Player. https://packetstorm.news/download/235649...

Samsung libimagecodec.quram.so One UI 8.5 Out-of-Bounds Write

Samsung libimagecodec.quram.so in One UI version 8.5 contains an out-of-bounds write in progressive JPEG inverse-DCT processing caused by a scan and frame component-index mismatch. Included proof of concept JPEG files trigger heap-buffer-overflow and uninitialized-pointer write conditions...

Formwork CMS 2.3.12 Cross Site Scripting

Formwork CMS versions 2.0.0 through 2.3.12 contain a stored cross site scripting vulnerability in the URI sanitizer. An authenticated page editor can use an unsanitized formaction JavaScript URI in raw Markdown HTML to execute script when a visitor activates the crafted control...

ChakraCore 1.11.4 JIT Type Confusion

ChakraCore version 1.11.4 contains a JIT optimization flaw that can cause property writes to use a stale object layout. Included JavaScript proof of concept demonstrates the issue and provides DataView arbitrary read/write and addrof primitives. https://packetstorm.news/download/235618...

Safari 11.0.1 JavaScriptCore Type Confusion

Safari version 11.0.1 JavaScriptCore contains type confusion issues that can lead to arbitrary code execution. Proof of concept code is provided for four related triggering expressions. https://packetstorm.news/download/235619...

Splunk Enterprise 10.4.2 Patroni REST API Remote Command Execution

Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 contain a missing authentication flaw in the Patroni REST API that permits unauthenticated network users to execute operating-system commands on search head cluster members. https://packetstorm.news/download/235638...

Concrete CMS 9.5.2 Calendar Event Name Cross Site Scripting

Concrete CMS versions 8.3.0 through 9.5.2 contain a stored cross site scripting vulnerability in calendar event names that executes when an administrator views a workflow approval notification. https://packetstorm.news/download/235625...

FortiClient EMS 7.4.6 Authentication Bypass

Fortinet FortiClient EMS versions 7.4.5 through 7.4.6 contain an improper access control issue that allows unauthenticated access to protected API endpoints. This proof of concept demonstrates the authentication bypass using crafted client-certificate headers...

MariaDB 13.1.0 .frm Out-Of-Bounds Read / Remote Code Execution

MariaDB version 13.1.0 and earlier versions contain an out-of-bounds read when opening crafted .frm data that can be leveraged for remote code execution by an authenticated user with required file privileges. https://packetstorm.news/download/235628...

MikroTik RouterOS Before 7.24 WebFig Integer Underflow

MikroTik RouterOS versions before 7.24 contain an unauthenticated integer underflow in WebFig HTTP request body handling. The included proof of concept demonstrates denial of service against the web management service. https://packetstorm.news/download/235629...

Google V8 Array Sort Type Confusion

Google V8 versions prior to 15.3.48 contain a type confusion vulnerability involving Array.prototype.sort. The proof of concept demonstrates array element-kind corruption caused by a comparator that mutates its receiver. https://packetstorm.news/download/235608...

GitLab 19.4.1 CI Lint Remote Code Execution

GitLab version 19.4.1 and other affected versions contain an integer overflow in the CI/CD regular expression compiler that can allow remote code execution. This proof of concept deploys a crafted CI configuration and repository path, then triggers CI lint processing...

Mozilla Firefox 157 IonMonkey Out-Of-Bounds Read

Mozilla Firefox version 157 contains an IonMonkey JIT constant-folding flaw that can eliminate typed-array bounds checks and allow out-of-bounds memory reads. The proof of concept details a shift-count mismatch fixed in Firefox 158. https://packetstorm.news/download/235630...

War Thunder 2.57.1.140 Cleartext JWT Transmission

War Thunder version 2.57.1.140 transmits the authjwt bearer token in cleartext during its initial matching-server handshake. A passive observer can decompress the packet and recover the token, allowing temporary authenticated impersonation and access to game services and readable user data...

...[ More ]

This Metasploit module exploits an authenticated command injection vulnerability in Grafana's experimental SQL Expressions feature. Affected Grafana releases are 11.0.0 through 11.0.6, 11.1.0 through 11.1.7, and 11.2.0 through 11.2.2. They pass attacker-controlled SQL expressions to DuckDB withou...

Google Chrome 123.0.6312.85 WebAssembly Type Confusion

Google Chrome version 123.0.6312.85 contains a type confusion vulnerability in WebAssembly. A proof of concept is provided. https://packetstorm.news/download/235612...

phpwcms 1.12.3 Shell Upload

phpwcms version 1.12.3 and prior affected releases contain an unauthenticated unrestricted upload issue in public Form content. A proof of concept demonstrates uploading a .phtml marker that executes when the server maps that extension to PHP. https://packetstorm.news/download/235633...

Google Chrome V8 Out-Of-Bounds Memory Access

Google Chrome versions prior to 142.0.7444.59 contain an inappropriate V8 implementation that allows out-of-bounds memory access via crafted JavaScript. This proof of concept demonstrates the issue in d8 and includes arbitrary read/write primitives. https://packetstorm.news/download/235610...