Publicly Disclosed
PoC Exploits

The image-size library through version 2.0.2 contains a vulnerability that allows a remote attacker to induce a denial of service by sending a specially crafted image buffer with a zero-valued size field. This input can manipulate the Node.js event loop, resulting in an infinite loop during the i...

A vulnerability exists in the Windows Event Logging Service due to a failure in its protection mechanisms, allowing an authorized attacker to potentially disclose sensitive information across a network. This could lead to unauthorized access to sensitive data or system information, emphasizing th...

The Joomla Content Editor (JCE) prior to version 2.20.2 is affected by an improper input validation vulnerability. This flaw permits authenticated users with file management permissions to rename files, even to invalid names, which can lead to the creation of hidden files. Additionally, this flaw...

The Sucuri Security WordPress plugin, up to version 2.7.3, suffers from a path traversal vulnerability within the pageIntegritySubmission() method in src/integrity.lib.php. This flaw enables authenticated administrators to delete arbitrary files by inserting directory traversal sequences into the...

A path traversal flaw exists in Unearth version 0.18.2, specifically within the is_within_directory function. This vulnerability arises because the application does not properly normalize file paths before validating them, allowing attackers to exploit this oversight. They can create malicious ta...

The SQLBot dashboard component is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of user-provided content rendered through TinyMCE. This flaw allows attackers with access to modify the dashboard text widgets to inject malicious HTML and JavaScript. Consequently, any ...

Cachet versions up to 2.4.1 are vulnerable to server-side template injection, allowing authenticated users to exploit incident templates. By crafting malicious incident templates using Blade directives or Twig filters, attackers can execute arbitrary PHP code and potentially gain control of the w...

In FlyEnv versions before 4.18.0, the application does not adequately sanitize HTML content generated from markdown and AI chat inputs before rendering it into the DOM using Vue's v-html directive. This flaw allows attackers to inject and execute malicious scripts within the Electron renderer pro...

The Spacebar Server prior to commit 8d126f4 exhibits a vulnerability allowing authenticated users with MANAGE_MESSAGES permission to delete messages across different channels. This flaw arises from the inadequate scoping of message deletion requests, enabling malicious actors to exploit the delet...

The Spacebar Server prior to commit 8d126f4 exhibits a vulnerability allowing authenticated users with MANAGE_MESSAGES permission to delete messages across different channels. This flaw arises from the inadequate scoping of message deletion requests, enabling malicious actors to exploit the delet...

Hugging Face Accelerate versions up to 1.14.0 are susceptible to a path traversal vulnerability found in the load_checkpoint_in_model and load_checkpoint_and_dispatch functions. This issue arises from improper sanitization of weight_map entries that are sourced from sharded checkpoint indexes. An...

CyberPanel version 2.4.3 is susceptible to an authenticated command injection vulnerability associated with its remote backup transfer functionality. This flaw enables authenticated attackers to execute arbitrary OS commands by manipulating the API response from a remote server. By crafting a mal...

Flowise versions 2.2.4 through 3.1.4 are vulnerable to a missing authorization issue in the POST /api/v1/openai-assistants-file/download endpoint. This flaw permits unauthenticated attackers to access private files by taking advantage of the endpoint's improper handling of session and API key ver...

MCPJam Inspector, designed for local-first development on MCP servers, has a vulnerability allowing remote code execution (RCE) due to improper binding settings. In versions 1.4.2 and earlier, the platform listens on 0.0.0.0 by default, enabling attackers to exploit this configuration through cra...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

Postiz, an open-source social media scheduling tool developed by Gitroom, has a vulnerability that allows unauthenticated remote attackers to exploit the file handling mechanism. The application's upload route improperly manages URL paths, permitting attackers to access any file the application p...

tar-rs versions 0.4.11 to 0.4.46 possess a vulnerability in the Builder::append_dir_all() function, allowing attackers to exploit symlink behavior. This flaw enables unauthorized file access by allowing symlinks to bypass the designated source root directory. When an archived process is conducted...

NVIDIA GeForce Now for Android includes a flaw within its game launcher component, where a malicious application on the same device can intercept and process implicit intents designed for the streamer component. This vulnerability can be manipulated to enable unauthorized information disclosure, ...

The vulnerability in Spring Retry allows an attacker to send numerous unique requests that overwhelm the application’s stateful retry cache. Once this cache reaches its limit, it prevents any further updates, leading to a failure in all subsequent stateful retries and circuit breaker operations. ...

A path handling issue in Apple Private Cloud Compute may allow attackers positioned within a privileged network to exploit the vulnerability and leak sensitive information. This potential security weakness has been addressed with improved validation in PCC Release 5E290.3, enhancing the overall p...

A vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) handling arises when processing Address Configuration (ASCONF) chunks. Specifically, the system allows for a potential memory corruption scenario by failing to protect the transport cached in the ASCONF structure. A...

A vulnerability exists in the Sina Weibo Android SDK 4.2.7 where an intent redirection issue allows unexported Activities to be launched unexpectedly by the WbShareTransActivity. This could lead to unauthorized access and potential compromise of application security, making it crucial for develop...

Bitwarden Server prior to version 2026.7.2 contains a vulnerability that allows any authenticated user to send a POST request to the /collect endpoint without verifying their membership in the respective organization. This flaw enables users to forge audit log entries, potentially leading to sign...

The vulnerability CVE-2024-29943 affects Firefox, allowing attackers to perform an out-of-bounds read or write on a JavaScript object, enabling remote code execution and sandbox escape. The flaw was exploited during the Pwn2Own Vancouver 2024 hacking competition and affected Firefox versions befo...

The Duplicate Post plugin for WordPress, prior to version 1.5.5, has a significant security flaw where it fails to enforce proper authorization checks during its bulk copy and delete functionalities. This oversight allows any user with access granted by an administrator to delete posts across the...

The WooCommerce WordPress plugin prior to version 2.0.2 is susceptible to a file upload vulnerability due to its failure to validate the types of files that can be uploaded when its accepted-types setting is left empty. This lack of validation opens the door for unauthenticated attackers to uploa...

The CheckView WordPress plugin contains a vulnerability that allows unauthenticated attackers to exploit the REST API due to improper handling of authentication filters. This flaw leads to the potential bypass of security mechanisms, allowing attackers to perform various actions typically reserve...

The s2Member WordPress plugin prior to version 260805 contains a vulnerability that fails to properly escape certain shortcode attributes. This oversight allows users with contributor-level access to execute arbitrary JavaScript within an inline script context. When a post containing the affected...

The All-in-One Video Gallery plugin for WordPress is vulnerable to an unauthenticated file download exploit. This occurs through a public file-download handler that can be triggered by accessing a specific URL pattern (`?vdl=<post_id>`). When this endpoint is accessed, it allows any user to initi...

The FoodBoxBooker plugin for WordPress prior to version 1.0.8 is susceptible to an improper authorization vulnerability. This flaw enables authenticated users with Subscriber-level access or higher to update profile details of any user on the system, including those with administrative privileges...

The Advanced Classifieds & Directory Pro plugin for WordPress prior to version 3.4.3 is susceptible to an unauthenticated sensitive information exposure through its AJAX action `acadp_public_custom_fields_listings`. This vulnerability allows attackers to access confidential data without proper au...

The Salon Booking System WordPress plugin, up to version 10.30.33, is vulnerable to unauthorized access due to a lack of capability checks and OAuth state value validation during its Google Calendar authorization callback. This issue allows unauthenticated attackers to overwrite existing Google C...

The Vitepos WordPress plugin, prior to version 3.6.0, suffers from a significant security flaw due to inadequate sanitization and parameterization of an identifier sourced from a REST request body. This shortcoming can be exploited by users with administrator-level access, enabling them to execut...

The Booking for Appointments and Events Calendar WordPress plugin prior to version 9.7 contains a security flaw that allows authenticated employees to access and manipulate customer records without proper verification. This oversight permits any logged-in employee with access to the Employee Pane...

The Autopay WordPress plugin prior to version 5.0.1 is susceptible to a Cross-Site Scripting (XSS) vulnerability. This flaw arises from the failure to validate user capabilities and nonces during the processing of styling options submitted through public requests. As a result, unauthenticated att...

The Vitepos WordPress plugin, including versions prior to 3.6.0 and 3.5.0, is vulnerable due to the lack of a per-target authorization check in its password-reset API. This oversight grants the custom Outlet Manager role excessive permissions, enabling them to reset any user's password—including ...

The ProSolution WP Client plugin for WordPress contains a significant vulnerability where the application fails to sanitize cookie values before utilizing them in SQL queries. This security flaw allows unauthorized users to access sensitive database information and delete records without any form...

The ProSolution WP Client plugin for WordPress, prior to version 2.0.6, is vulnerable due to inadequate sanitization and escaping of a parameter in SQL statements. This flaw, which is accessible to unauthenticated users, allows for blind SQL injection attacks, potentially compromising the integri...

The Salon Booking System plugin for WordPress versions up to 10.30.33 contains an access control vulnerability that lets unauthorized users manipulate AJAX actions related to booking modifications. This flaw does not adequately validate booking ownership, enabling attackers to alter the total of ...

The Salon Booking System WordPress plugin, up to version 10.30.33, suffers from a vulnerability due to its inadequate validation of booking ownership tokens. This flaw allows unauthenticated attackers to access and disclose sensitive booking records of other customers by submitting a sequential b...

The Salon Booking System plugin for WordPress, up to version 10.30.33, has a serious vulnerability where it fails to verify the ownership of booking requests via its REST API endpoints. This flaw allows any authenticated user, including those with minimal permissions such as Subscribers or self-r...

The Pinpoint Booking System plugin for WordPress, up to version 2.9.9.6.9, suffers from a critical server-side validation flaw. This vulnerability enables unauthenticated users to manipulate booking prices by bypassing proper validation, potentially creating reservations for arbitrary amounts, in...

The Contact Form to Any API plugin for WordPress prior to version 3.0.7 has a security flaw that results from not generating random filenames when files are uploaded via contact forms. This oversight allows unauthorized users to list and download files submitted by others, which could lead to dat...

The Block User Account plugin for WordPress, prior to version 2.0.1, fails to enforce block restrictions effectively across all authentication pathways. This shortcoming permits users who have previously set application passwords to bypass account blocks, thereby retaining access to their assigne...

The Squeeze WordPress plugin prior to version 1.7.12 contains a security flaw due to its failure to validate the file type or extension of image data during attachment updates. This critical lapse allows users with the upload_files capability, such as those with Author roles or higher, to potenti...

The RSS Aggregator plugin by Feedzy allows users with author-level access and above to perform unauthorized actions on import jobs. This includes the ability to permanently delete posts from another user's import job and modify its settings without proper verification. Additionally, the plugin la...

The Customer Reviews for WooCommerce plugin prior to version 5.116.0 contains a significant security flaw where it fails to implement necessary nonce and capability checks on multiple AJAX actions. This oversight allows users with limited permissions, such as Subscribers, to execute administrativ...

The Podcast Player WordPress plugin prior to version 8.3.1 is susceptible to server-side request forgery (SSRF) due to inadequate validation of user-supplied input. This flaw allows an unauthenticated attacker to manipulate server requests, enabling them to target arbitrary hosts and harvest resp...

The HT Contact Form plugin for WordPress fails to implement authorization checks on its endpoint that retrieves saved form drafts. This oversight permits any unauthenticated user to access sensitive information, such as names, email addresses, phone numbers, and physical addresses stored in these...

The Term Pages plugin for WordPress is susceptible to SQL injection due to inadequate sanitization and escaping of parameters before they are passed into SQL queries. This vulnerability enables unauthenticated attackers to exploit the flaw, potentially leading to unauthorized access and manipulat...