Ghostscript 9.23 -dSAFER Sandbox Bypass

Ghostscript version 9.23 contains a -dSAFER sandbox bypass that allows a crafted PostScript file submitted through an ImageMagick upload page to execute a command on the target server. The included proof of concept writes the target container's identity to /tmp/success...

Langflow Unauthenticated File Upload

Langflow versions prior to version 1.9.1 contain an unauthenticated file upload issue that permits server disk exhaustion and discloses absolute file paths. Included proof of concept sends upload requests to detect the issue. https://packetstorm.news/download/235038...

ImageMagick 7.1.0-49 PNG Text Chunk Arbitrary File Read

ImageMagick version 7.1.0-49 contains an arbitrary file disclosure vulnerability through a crafted PNG tEXt chunk. This proof of concept generates a PNG that requests a target file and parses the resulting image to recover its contents. https://packetstorm.news/download/235007...

Apache OFBiz 18.12.10 Authentication Bypass Remote Code Execution

Apache OFBiz version 18.12.10 contains an authentication bypass involving requirePasswordChange that exposes the WebTools ProgramExport Groovy runner to unauthenticated users, allowing command execution. A proof of concept vulnerable environment and request are included...

GlassFish 4.1 Admin Console Arbitrary File Read

GlassFish version 4.1 contains an arbitrary file read vulnerability in its admin console due to overlong UTF-8 decoding. The supplied proof of concept uses crafted traversal sequences to read files without authentication. https://packetstorm.news/download/235013...

SaltStack 2019.2.3 Master Authentication Bypass

SaltStack version 2019.2.3 contains an authentication bypass in its ZeroMQ request server that permits unauthenticated ClearFuncs calls, disclosure of the root key, and command execution on the master. https://packetstorm.news/download/234981...

Apache APISIX 2.11.0 Default Admin Token Remote Command Execution

Apache APISIX version 2.11.0 uses a default administrative API token that permits route creation. A route script can execute commands, resulting in remote command execution. https://packetstorm.news/download/235028...

Supervisord 3.3.2 XML-RPC Remote Command Execution

Supervisord version 3.3.2 contains an XML-RPC method-resolution flaw that allows remote command execution through crafted requests. The included proof of concept executes a supplied command and retrieves its output from the Supervisord log. https://packetstorm.news/download/234970...

Nexus Repository Manager 3.14.0 JEXL Injection Remote Code Execution

Nexus Repository Manager version 3.14.0 contains an unauthenticated JEXL expression injection issue in component search that can allow arbitrary command execution. The archive provides a vulnerable environment and proof of concept request. https://packetstorm.news/download/234961...

Apache Tomcat 9.0.30 AJP File Read

Apache Tomcat version 9.0.30 exposes an AJP connector that permits an unauthenticated client to use crafted request attributes to read files within deployed web applications. https://packetstorm.news/download/234968...

Apache Solr 7.0.1 RunExecutableListener Remote Command Execution

Apache Solr version 7.0.1 contains a flaw where an unauthenticated Config API request can add a RunExecutableListener that executes a command when a core update is committed. The supplied proof of concept provides a containerized vulnerable lab and HTTP request sequence...

Openfire 4.7.4 Admin Console Authentication Bypass

Openfire version 4.7.4 contains an administrative console authentication bypass via path traversal in setup pages. The supplied proof of concept details creating an administrator without authentication. https://packetstorm.news/download/234992...

PHP-FPM 7.3.10 Remote Code Execution

PHP-FPM versions through 7.3.10 contain a buffer-overflow condition in certain Nginx FastCGI PATHINFO configurations that can lead to remote code execution. This proof of concept provides a deliberately vulnerable PHP-FPM 7.2.10 lab environment and exploitation details...

phpMyAdmin 4.8.1 Local File Inclusion

phpMyAdmin version 4.8.1 contains a local file inclusion vulnerability in index.php target handling. A proof of concept demonstrates bypassing the page whitelist through double URL encoding to include local files. https://packetstorm.news/download/234987...

Drupal 7.31 SQL Injection

Drupal version 7.31 contains an unauthenticated SQL injection vulnerability in array-placeholder construction. The supplied proof of concept sends a crafted login field to demonstrate SQL injection. https://packetstorm.news/download/235021...

Drupal 8.5.0 Form API Remote Code Execution

Drupal version 8.5.0 contains a Form API render array injection vulnerability that allows unauthenticated remote code execution. This proof of concept supplies a vulnerable Docker environment and an HTTP request that demonstrates the issue. https://packetstorm.news/download/235020...

NukeViet 4.6.01 Image Upload Remote Code Execution

NukeViet version 4.6.01 contains an image-upload chain that may allow remote code execution when PHP short tags are enabled and the applicable Apache PHP handler executes an uploaded GIF/PHP polyglot. https://packetstorm.news/download/235036...

Django 4.0.5 Trunc SQL Injection

Django version 4.0.5 contains a SQL injection vulnerability in the Trunc and Extract database functions when user-controlled date units are inserted into generated SQL without escaping. Includes a proof of concept vulnerable environment. https://packetstorm.news/download/235022...

Apache Log4j 2.14.1 JNDI Remote Code Execution

Apache Log4j version 2.14.1 contains a JNDI lookup vulnerability that can permit remote code execution. This proof of concept provides an isolated lab application, a harmless canary payload, and patch-validation evidence. https://packetstorm.news/download/234959...

Spring Security OAuth 2.0.8 Remote Command Execution

Spring Security OAuth version 2.0.8 allows authenticated remote command execution when its whitelabel error view evaluates a malicious responsetype parameter as a Spring Expression Language expression. Included proof of concept generates the expression. https://packetstorm.news/download/234976...

PostgreSQL 10.7 COPY from Program Command Execution

PostgreSQL version 10.7 with default superuser credentials demonstrates COPY FROM PROGRAM execution of an operating-system command as the database server user. https://packetstorm.news/download/234985...

WordPress miniOrange OTP Verification 5.5.7 Account Takeover

WordPress miniOrange OTP Verification plugin versions through 5.5.7 contain an unauthenticated account takeover vulnerability that permits OTP rerouting to an attacker-controlled phone number. A proof of concept is included. https://packetstorm.news/download/235041...

crawl4ai 0.9.2 Arbitrary File Write

crawl4ai versions 0.9.0 through 0.9.2 contain an arbitrary file write in PDFContentScrapingStrategy through untrusted configuration fields. The proof of concept writes a crafted PDF image stream to an attacker-chosen service-account-writable directory. https://packetstorm.news/download/235040...

Apache JMeter 3.3 RMI Deserialization Remote Code Execution

Apache JMeter version 3.3 running in distributed server mode permits unauthenticated deserialization through its RMI registry. This proof of concept provides a Docker-based vulnerable environment and a ysoserial BeanShell1 exploitation example. https://packetstorm.news/download/235004...

Apache Druid 0.20.0 Embedded JavaScript Remote Code Execution

Apache Druid versions 0.20.0 and earlier contain an embedded JavaScript execution issue that a crafted ingestion specification can use to execute commands on the server. A proof of concept is included. https://packetstorm.news/download/235029...

Apache HTTP Server 2.4.50 Path Traversal

Apache HTTP Server version 2.4.50 contains a path traversal vulnerability that may disclose files outside the document root and, with CGI enabled, permit command execution. This archive provides a deliberately vulnerable Docker environment and proof of concept requests...

Apache Solr 8.3.1 Velocity Template Remote Code Execution

Apache Solr versions 5.0.0 through 8.3.1 contain a VelocityResponseWriter issue that permits command execution when an attacker can use the configuration API to enable parameter-provided templates. https://packetstorm.news/download/234977...

PHPUnit 5.6.2 Remote Code Execution

PHPUnit version 5.6.2 exposes Util/PHP/eval-stdin.php, which evaluates HTTP POST input and permits remote code execution when its vendor directory is web-accessible. https://packetstorm.news/download/234986...

Zabbix 3.0.3 SQL Injection

Zabbix version 3.0.3 contains SQL injection vulnerabilities in latest.php and jsrpc.php. The supplied proof of concept demonstrates error-based SQL injection through the toggleids parameter. https://packetstorm.news/download/234963...

Apache Superset 2.0.1 Session Forgery

Apache Superset version 2.0.1 using a known default SECRETKEY allows session-cookie forgery and authentication as another user. This proof of concept verifies default keys, forges a selected user session, and can validate it. https://packetstorm.news/download/234971...

Apache Dubbo 2.7.3 HTTP Protocol Deserialization

Apache Dubbo version 2.7.3 HTTP protocol providers deserialize POST bodies with Java serialization, allowing a suitable gadget chain to execute commands. This submission supplies a vulnerable lab and proof of concept exploitation details. https://packetstorm.news/download/235019...

Apache ActiveMQ 5.18.1 OpenWire Deserialization Remote Code Execution

Apache ActiveMQ versions prior to 5.18.2 contain an OpenWire deserialization vulnerability that permits remote class instantiation and command execution. This proof of concept demonstrates the issue against version 5.17.3. https://packetstorm.news/download/235031...

Grafana 8.2.6 Plugin Path Traversal

Grafana version 8.2.6 contains an unauthenticated plugin asset path traversal vulnerability. A proof of concept request demonstrates reading files accessible to the Grafana server. https://packetstorm.news/download/235012...

H2 Database 2.1.209 Web Console JDBC URL Remote Code Execution

H2 Database versions 1.4.198 through 2.1.209 contain a web console JDBC URL restriction bypass that permits an INIT script to execute Java code. This submission provides a vulnerable H2 2.0.206 lab and proof of concept. https://packetstorm.news/download/235011...

Oracle WebLogic Server 12.2.1.3 Remote Command Execution

Oracle WebLogic Server version 12.2.1.3 contains an authentication bypass that can be chained with a console command-execution issue. A proof of concept environment and exploitation details are provided. https://packetstorm.news/download/234965...

GitLab Community Edition 13.10.1 Remote Command Execution

GitLab Community Edition version 13.10.1 allows unauthenticated remote command execution when a crafted image is processed by ExifTool's DjVu parser. https://packetstorm.news/download/235014...

Apache CouchDB 2.1.0 Privilege Escalation

Apache CouchDB version 2.1.0 contains an access-control bypass caused by duplicate JSON roles fields, allowing creation of an administrative user. A proof of concept environment and exploitation details are provided. https://packetstorm.news/download/235023...

Spring Cloud Function 3.2.2 SpEL Injection

Spring Cloud Function version 3.2.2 evaluates the spring.cloud.function.routing-expression request header as a SpEL expression. The supplied proof of concept demonstrates target-side command execution. https://packetstorm.news/download/234973...

Veeam Backup & Replication 12.3.2.4465 Remote Code Execution

Veeam Backup & Replication version 12.3.2.4465 and earlier version 12 builds contain a remote code execution vulnerability exploitable by an authenticated domain user. https://packetstorm.news/download/235039...

Eclipse Jetty 9.4.37 Ambiguous Path Information Disclosure

Eclipse Jetty version 9.4.37 contains an ambiguous path handling issue that permits retrieval of protected WEB-INF resources using an encoded dot segment. This proof of concept provides a vulnerable lab and demonstration. https://packetstorm.news/download/235005...

Nginx 1.13.2 Cache Information Disclosure

Nginx version 1.13.2 contains an integer overflow in the range filter that can disclose cache file headers and cached response data. Included proof of concept sends a crafted Range header to demonstrate the disclosure. https://packetstorm.news/download/234995...

Spring Framework 6.2.10 Generic Method Authorization Bypass

Spring Framework versions through 5.3.44, 6.1.22, and 6.2.10 may fail to resolve method-security annotations on overridden generic methods, permitting an authorization bypass. This proof of concept reproduces the behavior using @PreAuthorize. https://packetstorm.news/download/235034...

Laravel 8.4.2 Ignition Remote Code Execution

Laravel version 8.4.2 with Ignition version 2.5.1 contains an insecure solution endpoint that can allow unauthenticated remote code execution when debug mode is enabled. A proof of concept environment and reproduction steps are included. https://packetstorm.news/download/234962...

Ruby on Rails 5.2.2 Accept Header Arbitrary File Read

Ruby on Rails version 5.2.2 contains an Accept header path traversal vulnerability in controller render file handling that allows remote attackers to read arbitrary files. https://packetstorm.news/download/234983...

Apache Tomcat 8.5.19 Arbitrary File Write

Apache Tomcat version 8.5.19 with the Default Servlet readonly setting disabled allows HTTP PUT requests with crafted filenames to write JSP files to the web root. https://packetstorm.news/download/234969...

Apache Shiro 1.2.4 RememberMe Deserialization

Apache Shiro version 1.2.4 uses a hard-coded AES key for RememberMe cookies, allowing crafted serialized objects to trigger arbitrary command execution. This proof of concept supplies a vulnerable lab and reproduction details. https://packetstorm.news/download/234979...

Adobe ColdFusion 9.0.1 Directory Traversal

Adobe ColdFusion versions 9.0.1 and earlier contain a directory traversal vulnerability in administrator pages that allows remote file reads through the locale parameter. The supplied Docker environment and proof of concept demonstrate CVE-2010-2861. https://packetstorm.news/download/235024...

Joomla 4.2.7 Webservice Improper Access Check

Joomla version 4.2.7 contains an improper access check in webservice endpoints that permits unauthenticated access to application configuration and user information when public=true is supplied. https://packetstorm.news/download/235003...

Apache Unomi 1.5.1 MVEL/OGNL Injection Remote Code Execution

Apache Unomi version 1.5.1 contains an MVEL and OGNL expression injection vulnerability that allows unauthenticated remote code execution through crafted context requests. Proof of concept included. https://packetstorm.news/download/234967...

GNU Bash 4.3.0 Shellshock Remote Command Injection

GNU Bash version 4.3.0 contains the Shellshock remote command injection vulnerability when Apache CGI exposes attacker-controlled request headers as environment variables. This proof of concept supplies a Docker-based Apache CGI lab with vulnerable and unaffected scripts...