GLPI 10.0.17 Authenticated Remote Code Execution

GLPI versions through 10.0.17 contain an authenticated remote code execution vulnerability that can force execution of PHP files on the server. A proof of concept helper demonstrates updating the vulnerable PDF-font preference and triggering PDF export. https://packetstorm.news/download/235864...

MaxKB 2.10.3-lts Prompt Injection Command Execution

MaxKB version 2.10.3-lts and earlier exposes an ungated shell execute tool to capable agents, allowing prompt injection through chat or ingested documents to trigger command execution. The included proof of concept demonstrates the missing approval gate and a sandbox-wrapper metacharacter escape...

TP-Link Wi-Fi Range Extenders Improper Authentication

Multiple TP-Link Wi-Fi range extenders contain an improper authentication issue in the HTTP web-management login flow. The included proof of concept passively captures login traffic and derives alternative credential values that authenticate to the affected device...

pac4j-jwt 6.3.2 Authentication Bypass

pac4j-jwt version 6.3.2 and earlier affected release lines contain an authentication bypass in JwtAuthenticator when processing encrypted JWTs. The proof of concept creates a JWE-wrapped unsigned JWT with arbitrary claims. https://packetstorm.news/download/235858...

Kirby CMS 5.5.3 Dynamic Field Option Authorization Bypass

Kirby CMS versions 4.9.0 through 4.9.5 and 5.5.0 through 5.5.3 contain an authorization bypass in query-backed Panel field options that may disclose metadata for restricted models to a limited authenticated user. Included proof of concept uses synthetic in-memory content...

TP-Link Tapo C500 2.0 TDP Denial of Service

TP-Link Tapo C500 v2.0 firmware versions before 1.3.5 Build 260810 contain an out-of-bounds function-pointer dispatch in the TDP daemon. The proof of concept sends one unauthenticated UDP datagram that crashes the main service, causing denial of service. https://packetstorm.news/download/235635...

Apache IoTDB 2.0.11 Authenticated Server-Side Request Forgery

Apache IoTDB version 2.0.11 contains an authenticated server-side request forgery vulnerability in the user-defined function mechanism. Apache IoTDB 2.0.11 Authenticated Server-Side Request Forgery Vendor: The Apache Software Foundation Product web page: https://iotdb.apache.org Affected version:...

JavaScriptCore Concurrent JIT Type Confusion

JavaScriptCore contains a TOCTOU type confusion in DFG concurrent compilation that can allow garbage collection of a constant-property cell. The supplied proof of concept exercises the condition against a vulnerable WebKit tree. https://packetstorm.news/download/235613...

V8 11.2.214.13 Type Confusion

V8 version 11.2.214.13 contains a type confusion issue in lazy Error stack trace formatting that can leak TheHole. The supplied proof of concept demonstrates the leak. https://packetstorm.news/download/235615...

V8 12.5.227.12 Type Confusion

V8 version 12.5.227.12 contains a type confusion vulnerability involving class static block parsing. A proof of concept demonstrates stale closure slot handling after bytecode flushing. https://packetstorm.news/download/235611...

WordPress SimpleForm 3.10.0 Unauthenticated Privilege Escalation

WordPress SimpleForm plugin versions through 3.10.0 contain an unauthenticated privilege escalation vulnerability that allows creation of an Administrator account through a registration AJAX endpoint. https://packetstorm.news/download/235620...

Samsung libimagecodec.quram.so One UI 8.5 Out-of-Bounds Write

Samsung libimagecodec.quram.so in One UI version 8.5 contains an out-of-bounds write in progressive JPEG inverse-DCT processing caused by a scan and frame component-index mismatch. Included proof of concept JPEG files trigger heap-buffer-overflow and uninitialized-pointer write conditions...

Samsung libsubextractor.so One UI 8.5 Heap Buffer Overflow

Samsung libsubextractor.so in One UI version 8.5 contains a heap buffer overflow in subtitle charset conversion. The supplied proof of concept uses a crafted ShiftJIS SRT sidecar subtitle to trigger the overflow through Samsung Video Player. https://packetstorm.news/download/235649...

Google V8 Array Sort Type Confusion

Google V8 versions prior to 15.3.48 contain a type confusion vulnerability involving Array.prototype.sort. The proof of concept demonstrates array element-kind corruption caused by a comparator that mutates its receiver. https://packetstorm.news/download/235608...

Google Chrome 142.0.7444.174 V8 Type Confusion

Google Chrome versions prior to 142.0.7444.175 contain a V8 type confusion vulnerability. The proof of concept uses super property access with a primitive receiver to trigger a crash. https://packetstorm.news/download/235609...

GitLab 19.4.1 CI Lint Remote Code Execution

GitLab version 19.4.1 and other affected versions contain an integer overflow in the CI/CD regular expression compiler that can allow remote code execution. This proof of concept deploys a crafted CI configuration and repository path, then triggers CI lint processing...

Windows 11 29617.1000 WHESVC Privilege Escalation

Windows 11 versions 26200.8457 and 29617.1000 contain a privilege-boundary issue in the Windows Health and Optimized Experiences service. The supplied proof of concept emits a Windows Diagnostics Lua ETW workflow that causes an attacker-controlled Lua module to execute as LocalSystem and writes a...

WordPress Abandoned Cart Pro for WooCommerce 10.8.0 Authentication Bypass

WordPress Abandoned Cart Pro for WooCommerce versions through 10.8.0 contain an authentication bypass through forged cart recovery tokens. The supplied proof of concept checks exposed versions and forges or uses recovery links. https://packetstorm.news/download/235604...

...[ More ]

This Metasploit module exploits an authenticated command injection vulnerability in Grafana's experimental SQL Expressions feature. Affected Grafana releases are 11.0.0 through 11.0.6, 11.1.0 through 11.1.7, and 11.2.0 through 11.2.2. They pass attacker-controlled SQL expressions to DuckDB withou...

TP-Link Tapo C500 v2.0 ONVIF PTZ Stack Write Denial of Service

TP-Link Tapo C500 version 2.0 firmware versions before 1.3.5 Build 260810 contain an authenticated ONVIF PTZ out-of-bounds stack write vulnerability. The proof of concept sends excessive RemovePreset elements to crash the main service. https://packetstorm.news/download/235636...

Formwork CMS 2.3.12 Cross Site Scripting

Formwork CMS versions 2.0.0 through 2.3.12 contain a stored cross site scripting vulnerability in the URI sanitizer. An authenticated page editor can use an unsanitized formaction JavaScript URI in raw Markdown HTML to execute script when a visitor activates the crafted control...

ChakraCore 1.11.4 JIT Type Confusion

ChakraCore version 1.11.4 contains a JIT optimization flaw that can cause property writes to use a stale object layout. Included JavaScript proof of concept demonstrates the issue and provides DataView arbitrary read/write and addrof primitives. https://packetstorm.news/download/235618...

Safari 11.0.1 JavaScriptCore Type Confusion

Safari version 11.0.1 JavaScriptCore contains type confusion issues that can lead to arbitrary code execution. Proof of concept code is provided for four related triggering expressions. https://packetstorm.news/download/235619...

Splunk Enterprise 10.4.2 Patroni REST API Remote Command Execution

Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 contain a missing authentication flaw in the Patroni REST API that permits unauthenticated network users to execute operating-system commands on search head cluster members. https://packetstorm.news/download/235638...

Concrete CMS 9.5.2 Calendar Event Name Cross Site Scripting

Concrete CMS versions 8.3.0 through 9.5.2 contain a stored cross site scripting vulnerability in calendar event names that executes when an administrator views a workflow approval notification. https://packetstorm.news/download/235625...

FortiClient EMS 7.4.6 Authentication Bypass

Fortinet FortiClient EMS versions 7.4.5 through 7.4.6 contain an improper access control issue that allows unauthenticated access to protected API endpoints. This proof of concept demonstrates the authentication bypass using crafted client-certificate headers...

MariaDB 13.1.0 .frm Out-Of-Bounds Read / Remote Code Execution

MariaDB version 13.1.0 and earlier versions contain an out-of-bounds read when opening crafted .frm data that can be leveraged for remote code execution by an authenticated user with required file privileges. https://packetstorm.news/download/235628...

MikroTik RouterOS Before 7.24 WebFig Integer Underflow

MikroTik RouterOS versions before 7.24 contain an unauthenticated integer underflow in WebFig HTTP request body handling. The included proof of concept demonstrates denial of service against the web management service. https://packetstorm.news/download/235629...

Mozilla Firefox 157 IonMonkey Out-Of-Bounds Read

Mozilla Firefox version 157 contains an IonMonkey JIT constant-folding flaw that can eliminate typed-array bounds checks and allow out-of-bounds memory reads. The proof of concept details a shift-count mismatch fixed in Firefox 158. https://packetstorm.news/download/235630...

War Thunder 2.57.1.140 Cleartext JWT Transmission

War Thunder version 2.57.1.140 transmits the authjwt bearer token in cleartext during its initial matching-server handshake. A passive observer can decompress the packet and recover the token, allowing temporary authenticated impersonation and access to game services and readable user data...

Google Chrome 123.0.6312.85 WebAssembly Type Confusion

Google Chrome version 123.0.6312.85 contains a type confusion vulnerability in WebAssembly. A proof of concept is provided. https://packetstorm.news/download/235612...

Danfoss AK-SM 8xxA Authentication Bypass

Danfoss AK-SM 8xxA series versions prior to version 4.2 contain an improper authentication vulnerability that permits a code-of-the-day authentication bypass. This proof of concept obtains the device date, derives the daily code, and exercises the alternate authentication path...

phpwcms 1.12.3 Shell Upload

phpwcms version 1.12.3 and prior affected releases contain an unauthenticated unrestricted upload issue in public Form content. A proof of concept demonstrates uploading a .phtml marker that executes when the server maps that extension to PHP. https://packetstorm.news/download/235633...

Google Chrome V8 Out-Of-Bounds Memory Access

Google Chrome versions prior to 142.0.7444.59 contain an inappropriate V8 implementation that allows out-of-bounds memory access via crafted JavaScript. This proof of concept demonstrates the issue in d8 and includes arbitrary read/write primitives. https://packetstorm.news/download/235610...

isolated-vm 3.1.2 Sandbox Escape

isolated-vm versions before 4.0.0 allow guest code with a live Reference to escape the sandbox and execute arbitrary code in the Node.js host process. https://packetstorm.news/download/235626...

V8 SuperIC Type Confusion

V8 contains a SuperIC receiver confusion issue. Included proof of concept and exploitation snippets demonstrate object address disclosure, fake objects, arbitrary memory access, and WebAssembly RWX memory access. https://packetstorm.news/download/235617...

WordPress Bricksforge 3.1.8.9 Arbitrary File Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability that allows remote code execution. The included proof of concept uploads a GIF/PHP polyglot and abuses temporaryFileUploads to select a PHP filename...

V8 9.7 JSON.stringify TheHole Disclosure

V8 version 9.7 contains a JSON.stringify exception-handling flaw that exposes the internal TheHole value to JavaScript. The proof of concept triggers the leak and includes a partial Map corruption amplification demonstration. https://packetstorm.news/download/235616...

Hyperledger FireFly Core 1.5.0 Server-Side Request Forgery

Hyperledger FireFly Core version 1.5.0 and prior versions with the webhooks event transport contain a server-side request forgery vulnerability. The proof of concept creates a webhook subscription with a supplied URL and broadcasts a message to trigger the FireFly node request...

WebKitGTK 2.42.0 JavaScriptCore Arbitrary Code Execution

WebKitGTK and WPE WebKit versions before 2.42.1 contain an improper check that may allow arbitrary code execution when processing malicious web content. This proof of concept triggers a JavaScriptCore DFG CSE property-access optimization error. https://packetstorm.news/download/235614...

Samsung One UI 8.5 DNG Heap Buffer Overflow

Samsung One UI version 8.5 contains a heap buffer overflow in libimagecodec.quram.so when decoding a crafted uncompressed tiled DNG image. The supplied proof of concept triggers the vulnerable Transparency Mask decoding path. https://packetstorm.news/download/235647...

Synametrics Syncrify 6.2 Build 1178 PublicLink Path Traversal / Root Command Execution

Synametrics Syncrify version 6.2 build 1178 contains a path traversal issue in the PublicLink chunk-upload handler. An authenticated backup user can write a cron fragment outside the intended upload directory, resulting in root command execution when the service runs as root and cron is active...

RainbowFish PacsOne Server 7.3.9 STOW-RS Path Traversal / Remote Code Execution

RainbowFish PacsOne Server version 7.3.9 contains an authenticated path traversal flaw in the DICOMweb STOW-RS store path that can write a DICOM object to a served PHP directory and execute it as the web server user. https://packetstorm.news/download/235397...

IC Realtime ICIP-P2012T 2.420 Unauthenticated Video Stream

IC Realtime ICIP-P2012T version 2.420 exposes an unauthenticated HTTP channel that permits access to an MJPEG video stream. The proof of concept provides the affected endpoint path. https://packetstorm.news/download/235387...

CloudPanel 2.5.4-3+clp-bookworm Nginx Virtual Host Configuration Injection

CloudPanel Community Edition version 2.5.4-3+clp-bookworm contains an nginx virtual-host configuration injection in the site-settings rootDirectory field. A proof of concept demonstrates authenticated injection of nginx directives leading to root command execution...

SmartBear Collaborator Server 15.1.15101 DOORS Upload Path Traversal

SmartBear Collaborator Server version 15.1.15101 contains a post-authentication ZIP path traversal in DOORS review-file uploads that can write a Groovy Server Page into the webroot, leading to command execution. https://packetstorm.news/download/235398...

Gogs 0.13.3 Remote Code Execution

Gogs versions through 0.13.3 contain an improper symbolic link handling issue in the PutContents API. The proof of concept uses an authenticated account to create a repository, commit a .git/config symlink, and overwrite it with an sshCommand configuration to obtain code execution...

Snapd 2.74.1 Local Privilege Escalation

Snapd version 2.74.1 and prior versions contain a local privilege escalation vulnerability involving snap-confine and systemd-tmpfiles cleanup of snap private temporary directories. The proof of concept demonstrates root access on affected configurations. https://packetstorm.news/download/235385...

Dataedo Portal 26.2.8 and Agent 26.2.8 Scheduler Job Remote Code Execution

Dataedo Portal version 26.2.8 discloses a repository connection string encrypted with a static key to an authorized repository-management user. Recovered database credentials can queue a scheduler job that Dataedo Agent version 26.2.8 resolves without a type restriction, resulting in command...

South River Titan MFT Server 26.0.0 First-Run Command Injection

South River Titan MFT Server version 26.0.0 contains a first-run administrator setup exposure that permits an unauthenticated reachable client to create the initial administrator. The proof of concept uses the resulting access to configure a job post-transfer command that executes as the service...