Linux 4.10 __do_semtimedop() Use-After-Free

Linux versions from 4.10 suffers from a use-after-free condition in dosemtimedop due to a lockless check outside RCU section...

adsprpc Refcount Leak / Use-After-Free

adsprpc suffers from a refcount leak that leads to a use-after-free condition in fastrpcgetprocessgids...

Linux LSM POSIX Lock Use-After-Free

An LSM can prevent the fcntl/close race cleanup path in fcntlsetlk from working, leading to use-after-free read in lockgetstatus when reading /proc/locks...

Linux FUSE Use-After-Free

FUSE in Linux allows use-after reads of write buffers, allowing theft of partial /etc/shadow hashes...

Creating Scripts to Identify Vulnerable Oracle Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of Oracle servers. It also covers methods to mitigate the public visibility of banners and version information on Oracle servers. Written in Portuguese...

Creating Scripts to Identify Vulnerable Telnet Services

This whitepaper covers how to create Nmap scripts to identify banners and versions of Telnet servers. It also covers methods to mitigate the public visibility of banners and version information on Telnet servers. Written in Portuguese...

Linux 6.5 Kernel Pointer Leak

The Linux cachestat syscall introduced in 6.5 has a read-after-type-change of folio that leads to a kernel pointer leak...

Linux munmap() Race Condition / Use-After-Free

Linux munmap has a race condition with pagemapread that leads to a page use-after-free condition...

PowerVR DevmemIntChangeSparse2() Use-After-Free

PowerVR suffers from a DevmemIntChangeSparse2 use-after-free condition on a PMRGetUID call...

Linux DCCP Binary Information Leak

Linux suffers from a small remote binary information leak in DCCP that requires a victim's machine to have established connections...

Linux FUSE Uninitialized Memory Read

FUSE on Linux has an issue where a page is marked uptodate while actually containing uninitialized data beyond EOF, so uninitialized memory can be read via mmap on systems without init-on-alloc...

Creating Scripts to Identify Vulnerable POP Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of POP servers. It also covers methods to mitigate the public visibility of banners and version information on POP servers. Written in Portuguese...

Linux 3.19 anon_vma Use-After-Free

Linux 3.19 suffers from a use-after-free vulnerability via anonvma...

Linux 4.20 ktls Write Issue

When splice is called with a ktls socket as destination, the ktls code fails to update the internal "curr"/"copybreak" accounting that tracks which parts of the plaintext scatter-gather buffer struct skmsgsg are unused writable memory. This can cause subsequent writes to the socket to overwrite t...

Linux Stale TLB Use-After-Free

Linux stable versions 5.4 and 5.10 suffer from a page use-after-free condition via a stale TLB entry caused by rmap lock not being held during PUD move...

Apache Tomcat Remote Code Execution

Apache Tomcat proof of concept remote code execution exploit that affects versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, and 9.0.0.M1 through 9.0.98...

Penetration Testing Steps and Tools

This whitepaper goes over reconnaissance of a target, various types of attacks leveraged during penetration testing, and provides examples of the commands used in the process...

WordPress Elementor Pro Animation Addon 1.6 Missing Authorization

The Animation Addons for Elementor Pro plugin versions 1.6 and below on WordPress suffers from a missing capability check allowing for arbitrary plugin installation...

Creating Scripts to Identify Vulnerable SMTP Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of SMTP servers. It also covers methods to mitigate the public visibility of banners and version information on SMTP servers. Written in Portuguese...

WordPress Th Shop Mania Theme 1.4.9 Missing Authorization

WordPress Th Shop Mania theme versions 1.4.9 and below missing capability check proof of concept exploit allowing for arbitrary plugin installation...

WordPress Finale Lite 2.18.0 Missing Authorization

WordPress Finale Lite plugin versions 2.18.0 and below missing authorization proof of concept exploit that allows an attacker to install and activate arbitrary plugins...

WordPress NextMove Lite 2.17.0 Missing Authorization

WordPress NextMove Lite plugin version 2.17.0 missing authorization proof of concept exploit that allows an attacker to install and activate arbitrary plugins...

Creating Scripts to Identify Vulnerable SSH Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of SSH servers. It also covers methods to mitigate the public visibility of banners and version information on SSH servers. Written in Portuguese...

WordPress WooCommerce 2.4.1 Arbitrary File Upload

This exploit leverages an unauthorized limited arbitrary file upload vulnerability in the Order Attachments for WooCommerce plugin versions 2.0 to 2.4.1 for WordPress. The vulnerability allows authenticated users Subscriber+ to upload restricted file types without proper authorization...

Pexels Free Stock Photos 1.2.2 Shell Upload

Pexels Free Stock Photos versions 1.2.2 and below suffer from a remote shell upload vulnerability...

WordPress ThemeEgg ToolKit 1.2.9 Shell Upload

WordPress ThemeEgg ToolKit plugin versions 1.2.9 and below suffer from a remote shell upload vulnerability...

WordPress Top Store Theme 1.5.4 Privilege Escalation

This script exploits CVE-2024-10673, a critical vulnerability found in the Top Store WordPress Theme versions 1.5.4 and below. The flaw allows authenticated users with subscriber-level access or higher to install and activate arbitrary plugins via unprotected AJAX requests. This can lead to...

Creating Scripts to Identify Vulnerable FTPs

This whitepaper covers how to create Nmap scripts to identify banners and versions of FTP servers. It also covers methods to mitigate the public visibility of banners and version information on FTP servers. Written in Portuguese...

WordPress GPX Viewer 2.2.8 Arbitrary File Creation

WordPress GPX Viewer plugin versions 2.2.8 and below suffer from an arbitrary file creation vulnerability...

A Practical Memory Injection Attack against LLM Agents

In this whitepaper, the authors propose a novel Memory INJection Attack, MINJA, that enables the injection of malicious records into the memory bank by only interacting with the agent via queries and output observations...

Creating Scripts to Identify Vulnerable IMAP

This whitepaper covers how to create Nmap scripts to identify banners and versions of IMAP servers. It also covers methods to mitigate the public visibility of banners and version information on IMAP servers. Written in Portuguese...

How to Create a Scan for Server-Side Request Forgery

This whitepaper covers how to create a scan in Perl to identify server-side request forgery in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid SSRF problems at the cod...

How to Create a Scan to Identify Remote Command Execution

This whitepaper covers how to create a scan in Perl to identify remote command execution in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid RCE problems at the code...

How to Create a Scan to Identify Remote File Inclusion

This whitepaper covers how to create a scan in Perl to identify remote file inclusion in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid remote file inclusion problems...

How to Create a Scan to Identify Command Injection

This whitepaper covers how to create a scan in Perl to identify remote code injection in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid remote code injection problems...

cvp Incorrect Bailout Use-After-Free

In the function msmcvpmapbufwncc reachable from the EVAKMDREGISTERBUFFER ioctl, after cbuf is created and fully initialized, it is unconditionally added to the linked list inst-cvpwnccbufs.list. msmcvpmapbufwncc then tries to add an entry for the buffer to inst-cvpwnccbufstable. This can fail if...

Firefox txMozillaXSLTProcessor Use-After-Free

There is a use-after-free vulnerability in Firefox in txMozillaXSLTProcessor. The vulnerability was reproduced with an ASAN build from the latest source code...

Proxyrack Global Cybercrime Report 2025

This report delves into the key trends, statistical insights, and geographical impacts of cybercrime, while exploring attack vectors and the industries and regions most affected...

How to Create a Scan for Open Redirects

This whitepaper covers how to create a scan in Perl to identify open redirection in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid open redirect problems at the code...

How to Create a Scan for Path Traversal

This whitepaper covers how to create a scan in Perl to identify path traversal in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid path traversal problems at the code...

How to Create a Scan for Local File Inclusion

This whitepaper covers how to create a scan in Perl to identify different types of local file inclusion in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid local file...

How to Create a Scan for SQL Injection

This whitepaper covers how to create a scan in Perl to identify different types of SQL injection in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid SQL injection...

Linux FUSE Use-After-Free

There is a use-after-free read in FUSE, basically hittable without racing, that copies freed kernel memory read through an outdated dname pointer to userspace...

How to Create a Scan to Identify Reflected XSS

This whitepaper covers how to create a scan in Perl to identify reflected cross site scripting in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid reflective cross site...

Packet Storm New Exploits for February, 2025

This archive contains all of the 79 exploits added to Packet Storm in February, 2025...

JSONPath-plus Remote Code Execution

JSONpath-plus versions prior to 10.3.0 are vulnerable to a remote code execution vulnerability due to improper input sanitization. This is due to an incomplete fix for CVE-2024-21534...

WordPress ACF City Selector 1.14.0 Shell Upload

WordPress ACF City Selector plugin versions 1.14.0 and below suffer from a remote shell upload vulnerability...

WordPress WP Load Gallery 2.1.6 Shell Upload

NgocCode WP Load Gallery plugin version 2.1.6 suffers from a remote shell upload vulnerability...

F5 BIG-IP TMSH CLI Command Injection

A command injection vulnerability exists in the F5 tmsh restricted CLI which allows an authenticated attacker to leverage the commands accessible by a low privilege user in order to bypass restrictions, inject arbitrary commands and obtain remote code execution as the root user on the target syst...

XOne Web Monitor 02.10.2024.530 SQL Injection

An unauthenticated SQL injection vulnerability has been discovered in the login functionality of XOne Web Monitor version 02.10.2024.530 framework 1.0.4.9. This flaw allows attackers to exploit improper handling of user input during the authentication process to extract all stored usernames and...