Zammad 6.5.4 WebSocket Session Disclosure Remote Code Execution

Zammad version 6.5.4 and earlier contain an unauthenticated WebSocket session disclosure vulnerability that can expose active session cookies. An administrator session can be hijacked to upload a malicious addon and execute commands as the zammad user. https://packetstorm.news/download/235219...

Metabase 0.63.2 Unauthenticated SQL Injection

Metabase versions through 0.63.2 contain an unauthenticated SQL injection in the password-reset endpoint that can provide administrator access. The supplied proof of concept demonstrates the issue against a lab instance. https://packetstorm.news/download/235216...

Honor Magic6 Pro Kernel 6.1.157 Local Privilege Escalation

Honor Magic6 Pro with kernel version 6.1.157 contains a rtmutex stack use-after-free vulnerability. The supplied proof of concept demonstrates local privilege escalation. https://packetstorm.news/download/235221...

Apache Celix 2.4.0 EDEF XML Parser Heap Buffer Overflow

Apache Celix version 2.4.0 contains a heap-based buffer overflow in its remote-services Endpoint Description Extender XML parser. The supplied proof of concept generates a crafted endpoint descriptor that triggers the overflow. !/usr/bin/env python Apache Celix 2.4.0 EDEF XML Parser Heap-Based...

OrdaSoft Joomla CCK 8.3.15 SQL Injection

OrdaSoft Joomla CCK versions through 8.3.15 contain an unauthenticated SQL injection in record sorting. The supplied proof of concept discovers public listing routes and demonstrates error-based extraction through user-controlled order parameters. https://packetstorm.news/download/235115...

IBM Langflow OSS 1.12.2 Authenticated Code Execution

IBM Langflow OSS versions 1.0.0 through 1.12.2 allow a remote authenticated attacker to execute arbitrary code due to improper access control. This proof of concept submits a malicious custom component and verifies target-side shell deployment. https://packetstorm.news/download/235110...

FreePBX Endpoint Manager 17.0.2 Unauthenticated SQL Injection

FreePBX Endpoint Manager versions prior to 15.0.66, 16.0.89, and 17.0.3 contain an unauthenticated SQL injection that allows database modification and remote command execution through scheduled jobs. https://packetstorm.news/download/235109...

Apple macOS Tahoe 26.4 autofs Path Traversal

Apple macOS Tahoe version 26.4 autofs contains a path traversal issue that allows an attacker controlling a network directory server to execute arbitrary code with root privileges. The supplied proof of concept uses LDAP/OD map entries and NFS delivery to demonstrate vulnerable helper dispatch...

ServiceNow AI Platform Pre-Authentication Remote Code Execution

ServiceNow AI Platform versions prior to Brazil EA/GA, Australia Patch 2, Zurich Patch 7b/9, and Yokohama Patch 12 Hot Fix 1b/13 contain an unauthenticated sandbox escape that may allow remote code execution. Included is a proof of concept. https://packetstorm.news/download/235116...

Lenovo Power Management Driver Null Pointer Dereference

Lenovo Power Management Driver versions earlier than 1.69.70.0 contain a null pointer dereference that allows a local authenticated user to cause a Windows blue screen. This proof of concept sends the affected IOCTL. https://packetstorm.news/download/235118...

RuoYi 4.8.3 SQL Injection

RuoYi versions 4.8.2 through 4.8.3 contain an SQL injection vulnerability in the code-generation createTable endpoint. The supplied proof of concept authenticates as an administrator and abuses a keyword-filter bypass to execute crafted CREATE TABLE AS SELECT statements...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability in the temporaryFileUploads parameter. The proof of concept uploads a GIF/PHP polyglot, writes it with a .php extension, and verifies command execution...

nginx-ui 2.4.x Authenticated Remote Code Execution

nginx-ui versions 2.3.8 through 2.4.x contain an authenticated remote code execution issue in backup restore that lets an administrator overwrite TestConfigCmd and trigger it through the nginx test endpoint. https://packetstorm.news/download/235079...

vsftpd 2.3.4 Backdoor Command Execution

vsftpd version 2.3.4 contains a backdoor that opens a shell on TCP port 6200 after a specially crafted FTP USER command. This proof of concept triggers the backdoor and connects to the resulting shell. https://packetstorm.news/download/235094...

OrdaSoft Joomla CCK 8.3.15 SQL Injection

OrdaSoft Joomla CCK versions 1.0.0 through 8.3.15 contain an unauthenticated SQL injection vulnerability in record sorting. A proof of concept is included. https://packetstorm.news/download/235077...

GFI Kerio Control 9.4.5 Unsigned Firmware Update Remote Code Execution

GFI Kerio Control version 9.4.5 accepts unsigned firmware images, allowing an authenticated attacker to execute arbitrary code as root. This proof of concept creates and uploads a modified upgrade image. https://packetstorm.news/download/235083...

HTMLy 3.1.1 Authenticated Server-Side Request Forgery

HTMLy version 3.1.1 contains an authenticated server-side request forgery vulnerability in its feed-import function. A user-controlled URL reaches filegetcontents without scheme validation, allowing requests to internal services and local-file disclosure through PHP stream wrappers and error...

Atlassian Data Center Products Arbitrary File Access

Atlassian Data Center products contain an unauthenticated arbitrary file access vulnerability. The proof of concept uses crafted resource-download paths to retrieve known web application files from Jira, Confluence, and Bitbucket instances. https://packetstorm.news/download/235088...

Apache Log4j Log4Shell Detection

This Zeek package detects Apache Log4j JNDI exploitation attempts in HTTP headers, LDAP traffic, and second-stage Java class downloads. https://packetstorm.news/download/235086...

reNgine 2.2.0 OS Command Injection

reNgine versions through 2.2.0 contain an OS command injection in customheaders scan-engine configuration. A crafted header can break shell quoting in scan tasks and execute a command in the Celery worker container. https://packetstorm.news/download/235093...

Monstra CMS 3.0.4 Remote Code Execution

Monstra CMS version 3.0.4 contains an authenticated arbitrary PHP file upload vulnerability in the theme chunk editor that allows remote code execution. This proof of concept logs in, retrieves a CSRF token, and creates a PHP theme chunk shell. https://packetstorm.news/download/235095...

Handlebars 4.7.9 JavaScript Injection

Handlebars version 4.7.9 and prior versions through 3.0.0 contain a JavaScript injection issue where an own-property check can expose the Function constructor during controlled template rendering with allowProtoMethodsByDefault enabled, leading to server-side code execution...

AppleFDEKeyStore macOS Before 27 Buffer Overflow

AppleFDEKeyStore in macOS versions before Golden Gate 27 contains a buffer overflow that may allow a local attacker to cause unexpected system termination or corrupt kernel memory. The supplied proof of concept uses an oversized marker to trigger the issue. https://packetstorm.news/download/23508...

Telegram Desktop 7.2.8 IPC Record Injection

Telegram Desktop version 7.2.8 and earlier contains an IPC record separator injection issue that lets crafted tg:// links invoke interpret: to send local files to an attacker-controlled channel. This proof of concept creates lure HTML and instruction files. https://packetstorm.news/download/23508...

PHP 5.4.1 CGI Query String Argument Injection

PHP version 5.4.1 running in CGI mode improperly parses query strings as command-line arguments, allowing source disclosure and PHP code execution. This proof of concept provides an isolated vulnerable environment and exploitation details. https://packetstorm.news/download/234989...

ImageMagick 6.9.2-10 Command Injection

ImageMagick version 6.9.2-10 contains command injection through unescaped URLs passed to delegates. The included proof of concept provides a PHP image-upload interface that invokes ImageMagick on supplied files. https://packetstorm.news/download/235008...

uWSGI 2.0.16 PHP Plugin Path Traversal

uWSGI version 2.0.16 PHP plugin contains a path traversal vulnerability that permits reading files outside the configured document root through URL-encoded ../ sequences. This proof of concept provides a vulnerable Docker environment and request example. https://packetstorm.news/download/234966...

React Server Components 19.2.0 Remote Code Execution

React Server Components versions 19.0.0 through 19.2.0 contain an unauthenticated remote code execution vulnerability. The supplied proof of concept sends a crafted multipart request to execute a specified command on a vulnerable target. https://packetstorm.news/download/235037...

Red Hat JBoss Application Server 6.1.0 Deserialization Remote Code Execution

Red Hat JBoss Application Server versions 5.x and 6.x contain an unsafe deserialization flaw in the HTTP Invoker ReadOnlyAccessFilter. The supplied Docker lab and proof of concept instructions demonstrate remote command execution through /invoker/readonly. https://packetstorm.news/download/235006...

Apache CXF 4.0.3 Aegis DataBinding Server-Side Request Forgery

Apache CXF versions before 4.0.4, 3.6.3, and 3.5.8 using Aegis DataBinding contain a server-side request forgery vulnerability. The included proof of concept demonstrates processing an XOP Include URL, which can expose local or internal resources. https://packetstorm.news/download/235030...

Spring Cloud Gateway 3.1.0 Actuator Code Injection

Spring Cloud Gateway version 3.1.0 with an exposed, unauthenticated Gateway Actuator endpoint contains a code injection vulnerability. The included proof of concept demonstrates adding a route filter whose SpEL expression is evaluated when the gateway is refreshed...

Apache Solr 8.11.0 Log4j JNDI Injection

Apache Solr version 8.11.0 uses Log4j 2.14.1 and is vulnerable to JNDI lookup injection. The proof of concept environment demonstrates a crafted admin request triggering a remote JNDI lookup and possible code execution. https://packetstorm.news/download/235000...

Webmin 1.920 Pre-Authentication Remote Command Execution

Webmin versions through 1.920 contain a pre-authentication command injection vulnerability in passwordchange.cgi. The supplied proof of concept details a request that executes commands through the old parameter. https://packetstorm.news/download/234964...

Apache Flink 1.11.2 JobManager Directory Traversal

Apache Flink version 1.11.2 contains a directory traversal vulnerability in the JobManager REST interface that allows attackers to read files accessible to the JobManager process. A proof of concept is included. https://packetstorm.news/download/235016...

Spring WebMVC 5.3.17 Data Binding Remote Code Execution

Spring WebMVC version 5.3.17 on JDK 9+ and Tomcat is vulnerable to data binding remote code execution. The proof of concept rewrites Tomcat access logging to create a JSP command shell. https://packetstorm.news/download/234972...

Ruby on Rails 5.0.7 Sprockets Path Traversal

Ruby on Rails version 5.0.7 with Sprockets 3.7.1 contains a path traversal vulnerability that permits reading files outside allowed asset paths. The proof of concept demonstrates the issue. https://packetstorm.news/download/234984...

Apache ActiveMQ 5.11.1 Arbitrary File Write

Apache ActiveMQ version 5.11.1 contains an arbitrary file write vulnerability in the fileserver application. The included proof of concept environment documents anonymous PUT uploads followed by MOVE requests to place files at arbitrary paths. https://packetstorm.news/download/235032...

OpenTSDB 2.4.0 Gnuplot Command Injection

OpenTSDB versions through 2.4.0 contain a command injection vulnerability in the graph endpoint yrange parameter, allowing Gnuplot system execution. A proof of concept is included. https://packetstorm.news/download/234990...

MySQL 5.5.23 Authentication Bypass

MySQL version 5.5.23 contains an authentication bypass caused by an incorrect cast of the memcmp result, allowing an incorrect password to be accepted intermittently. The supplied proof of concept provides a vulnerable container environment and documents repeated authentication attempts...

mongo-express 0.53.0 Remote Code Execution

mongo-express version 0.53.0 contains a remote code execution vulnerability in the checkValid endpoint's handling of the document parameter. A proof of concept and isolated vulnerable environment are included. https://packetstorm.news/download/234999...

Elasticsearch 1.1.1 Dynamic Script Remote Code Execution

Elasticsearch version 1.1.1 enables dynamic MVEL scripting by default, allowing unauthenticated remote command execution through a crafted search request. This archive provides a vulnerable environment and proof of concept. https://packetstorm.news/download/235018...

Cacti 1.2.22 Pre-Authentication Command Injection

Cacti versions 1.2.17 through 1.2.22 contain an unauthenticated command injection in remoteagent.php. A proof of concept demonstrates spoofing the client address and injecting a command through the pollerid parameter. https://packetstorm.news/download/235025...

libssh 0.8.1 Server Authentication Bypass

libssh version 0.8.1 contains a server-side authentication bypass that accepts a client-sent SSH2MSGUSERAUTHSUCCESS message before authentication, allowing unauthenticated command execution. https://packetstorm.news/download/235001...

Apache HTTP Server 2.4.49 Path Traversal

Apache HTTP Server version 2.4.49 contains a path traversal flaw that can disclose files outside the document root and, with CGI enabled, allow command execution. This proof of concept provides a vulnerable container and reproduction commands. https://packetstorm.news/download/235010...

Nacos 1.4.0 User-Agent Authentication Bypass

Nacos version 1.4.0 contains an authentication bypass where a spoofed Nacos-Server User-Agent permits access to protected user-management API endpoints. The proof of concept checks the condition and adds a user. https://packetstorm.news/download/234997...

Kibana 6.5.4 Timelion Prototype Pollution

Kibana version 6.5.4 contains a Timelion prototype pollution flaw that may allow command execution. This proof of concept provides a vulnerable Docker environment and reproduction details. https://packetstorm.news/download/235002...

Nginx 1.5.6 Filename Logic

Nginx versions 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 contain a filename parsing flaw that can bypass intended file restrictions. This proof of concept provides an isolated Nginx 1.4.2 and PHP-FPM upload environment demonstrating the issue. https://packetstorm.news/download/234996...

Node.js 8.5.0 Path Traversal

Node.js version 8.5.0 contains a path traversal vulnerability in path normalization that allows an Express static-file server to disclose files outside its static directory. https://packetstorm.news/download/234994...

Elasticsearch 1.4.2 Groovy Sandbox Bypass

Elasticsearch version 1.4.2 contains a Groovy sandbox bypass that permits arbitrary command execution through crafted search requests. Includes a proof of concept vulnerable environment and reproduction details. https://packetstorm.news/download/235017...

Spring Data Commons 2.0.5 SpEL Injection

Spring Data Commons version 2.0.5 contains a SpEL injection issue in web data binding that can allow crafted request parameter names to execute commands. This proof of concept provides a vulnerable containerized application and demonstration. https://packetstorm.news/download/234975...