Publicly Disclosed
PoC Exploits

A vulnerability in the Unicode Specification, particularly in the Bidirectional Algorithm, allows adversaries to manipulate the visual order of characters. This can lead to confusion when analyzing source code, as the logical order of tokens processed by compilers and interpreters may differ from...

A vulnerability exists in PHP that allows an attacker to manipulate input to the bccomp() function, potentially leading to out-of-bounds write conditions. This flaw can cause significant issues, including stack and heap corruption, in various PHP versions, notably impacting those prior to their r...

A critical security vulnerability exists in Python StateMachine versions prior to 3.2.0, allowing remote code execution through unsafe evaluation of crafted SCXML documents. Attackers can inject malicious expression strings that, when processed by the SCXMLProcessor, are passed to Python's eval()...

The WPvivid — Backup, Migration & Staging WordPress plugin prior to version 0.9.131 contains a vulnerability that allows an unauthenticated attacker, armed with a site-to-site transfer key, to manipulate log file paths. This occurs due to inadequate sanitization of inputs, enabling the attacker t...

The Simple JWT Login plugin for WordPress prior to version 3.6.8 fails to properly validate the audience of Google identity tokens. This flaw enables unauthenticated users to authenticate themselves as any user associated with the email address contained in such tokens. Consequently, this vulnera...

The CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 contains an authorization flaw in specific REST API endpoints. This vulnerability allows unauthenticated users to access sensitive information such as the title, type, size, and URL of media attachments linked to ...

The Visualizer Plugin for WordPress, prior to version 4.0.7, contains an authorization flaw that allows users with Contributor privileges and higher to access sensitive chart configurations. This vulnerability enables these users to read full configurations of charts, including those that should ...

The Masteriyo LMS WordPress plugin prior to version 2.3.3 lacks proper sanitization and escaping of quiz fields, enabling instructor role users to store unfiltered HTML. This vulnerability could lead to Stored Cross-Site Scripting attacks, affecting all visitors, including administrators, of the ...

The Extra Product Options Builder for WooCommerce plugin prior to version 1.2.176 lacks sufficient verification for user entitlements when serving customer-uploaded files. This vulnerability allows unauthenticated users to retrieve these files if they are aware of their stored names. The plugin's...

The WP Directory Kit plugin for WordPress, versions prior to 1.5.7, is vulnerable due to improper sanitization and escaping of parameters used in SQL statements. This flaw allows an administrator on a multisite installation to execute SQL injection attacks, potentially granting them unauthorized ...

The All-in-One WP Migration and Backup plugin for WordPress prior to version 7.108 presents a significant security flaw in multisite environments. This vulnerability permits an administrator of a single subsite to access and execute arbitrary PHP code across the entire network. Without sufficient...

The Premium Packages plugin for WordPress, prior to version 7.0.7, has a flaw that permits authenticated users to submit withdrawal requests without validating their actual earned balance. This weakness enables any user, including those with no sales history such as subscribers, to request arbitr...

The ECS WordPress plugin prior to version 4.3.10 features a security flaw where it fails to enforce proper ownership and post-status checks when retrieving custom field values based on user-supplied post identifiers. This oversight permits users with contributor-level access or higher to access a...

The Manual Image Crop plugin for WordPress prior to version 1.15 lacks proper capability checks and nonce verification for its AJAX actions. This oversight allows logged-in users, even those with subscriber-level access, to manipulate attachment images. An attacker can exploit this weakness to ch...

The Divi WordPress Theme, prior to version 5.9.0, contains a vulnerability in its Social Media Follow module where certain settings are not properly escaped before rendering in link attributes. This oversight permits contributors to inject JavaScript code, which could execute when a user with ele...

The BookingPress Appointment Booking Pro plugin for WordPress prior to version 5.7.3 contains a vulnerability that fails to properly enforce REST API authentication. As a result, this oversight allows unauthenticated attackers to gain access to sensitive customer booking data and make unauthorize...

OpenMed versions prior to 1.5.2 expose a significant remote code execution vulnerability through improper handling of the 'model_name' parameter in the privacy-filter model loading path. This flaw allows attackers to supply a malicious name, which can lead to the loading of arbitrary Hugging Face...

A security flaw has been identified in itsourcecode's Hospital Management System version 1.0, specifically affecting the /vieworder.php file. This vulnerability arises from improper handling of the 'delid' parameter, allowing for SQL injection attacks. These attacks can be initiated remotely, pro...

A buffer overflow vulnerability has been discovered in the Customer Search Module of DefaultFuction's Customer-Relationship-Management-In-C-Project version 2.0. This weakness allows remote attackers to exploit the vulnerable function, potentially leading to unauthorized access or execution of mal...

A local privilege escalation vulnerability exists within the pkexec utility of polkit, a setuid tool that allows unprivileged users to execute commands as privileged users based on predetermined policies. Due to insufficient handling of the calling parameters, pkexec can misinterpret environment ...

A security flaw exists in DefaultFuction Notice-System-Managent 2.0, specifically within the GroovyShell.evaluate function located in the /execute component of NoticeController. This vulnerability allows attackers to perform remote code injection, which can potentially compromise the integrity of...

The Gitea Docker image is susceptible to a security issue where the configuration REVERSE_PROXY_TRUSTED_PROXIES is set to '*' by default. This improper configuration allows any source IP address to impersonate a user when reverse-proxy authentication headers, such as X-WEBAUTH-USER, are enabled. ...

A security flaw has been identified in Dolibarr ERP regarding its User Cloning functionality. The vulnerability resides in an undocumented function within the 'htdocs/user/card.php' file. An attacker can manipulate the ID argument, leading to potential LDAP injection. This vulnerability allows fo...

A vulnerability has been discovered in OpenBoxes versions up to 0.9.6, specifically affecting the 'buildZebraTemplate' function within the file 'grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy'. This flaw allows improper neutralization of special elements used in the templ...

Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.

The vulnerability affects the function needManager in the Role Interceptor component of OpenBoxes, potentially allowing unauthorized users to manipulate access privileges. An attacker could remotely execute an exploit that compromises the intended access control mechanisms of the application, lea...

A server-side request forgery vulnerability exists in the OpenBoxes Product Upload Endpoint, impacting versions up to 0.9.7. This allows an attacker to manipulate the 'params.url' argument, potentially leading to unauthorized server requests. The vulnerability can be exploited remotely, posing a ...

Pdfminer.six, an open-source library for extracting information from PDF documents, is vulnerable to arbitrary code execution due to improper handling of malicious pickle files embedded in specially crafted PDF files. Specifically, the issue arises from the `CMapDB._load_data()` function that uti...

A vulnerability exists in the Evergreen OpenSRF Service's handling of requests within the osrf-gateway-v1 component, allowing remote attackers to execute SQL injection attacks. This issue is present in versions up to 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. Securing the application is vital, as ...

A security vulnerability has been identified in SourceCodester Stock Management System 1.0, affecting the handling of requests to /classes/Master.php?f=delete_supplier. This issue arises from insufficient validation of the 'ID' parameter, allowing malicious actors to execute arbitrary SQL command...

A security weakness has been identified in the Tenda AC10 router that affects its httpd component, specifically the R7WebsSecurityHandler function. This vulnerability allows attackers to manipulate authentication processes remotely, potentially compromising the device's security. The exploit has ...

A SQL injection vulnerability has been discovered in the Online Shopping System version 1.0, specifically affecting the /checkout_process.php file. This vulnerability arises from improper handling of the 'total_count' parameter, allowing attackers to execute malicious SQL queries remotely. Given ...

A security flaw exists in the Online Shopping System version 1.0 from Code-Projects, specifically in the /checkout.php file. This vulnerability allows for cross site scripting (XSS) attacks by manipulating the 'amount_1' parameter. An attacker can exploit this issue remotely, potentially compromi...

A SQL injection vulnerability has been identified in the Online Shopping System 1.0 developed by Code-Projects. This security flaw exists in a particular function within the file action.php, where manipulation of the 'proId' argument can lead to unauthorized database access. The attack can be exe...

A SQL injection vulnerability has been identified in the Online Shopping System version 1.0, specifically affecting the /login.php file within the Login component. The vulnerability arises from a flaw in handling the 'email' argument, allowing attackers to manipulate SQL queries remotely. This ex...

Adobe Commerce has a vulnerability related to incorrect authorization mechanisms, which may allow an attacker to escalate their privileges and access sensitive resources without any user interaction. This security issue emphasizes the importance of robust authorization checks in e-commerce enviro...

A vulnerability identified in the SpaceX Starlink Router Gen 3 version 2025.11.14.mr64708.3 affects the 'get_status' function of the gRPC Management Interface. This flaw allows for improper access control manipulations and poses a risk to users within the local network. Since its disclosure, the ...

A vulnerability exists in the Online Food Order System 1.0 developed by Code-Projects, specifically within the delete_food_items1.php file. This flaw allows an attacker to manipulate the argument checkbox, enabling remote SQL injection attacks. The exploit can compromise the security of the datab...

An identified risk in Code-Projects' Online Food Order System 1.0 lies within the edit_food_items.php file, where manipulation of the 'dname' argument enables cross site scripting attacks. This vulnerability allows remote attackers to inject malicious scripts, potentially compromising user sessio...

Samba versions 3.5.0 up to 4.6.4, along with specific earlier releases, contain a serious vulnerability where a malicious client can upload a shared library to a writable share. This exploit allows the server to load and execute the uploaded file, leading to unauthorized control and potential dam...

Metabase contains a vulnerability that enables a remote, unauthenticated attacker to perform SQL injection through the '/reset_password' endpoint. This flaw allows attackers to manipulate database queries, potentially gaining unauthorized administrator access to the Metabase instance and compromi...

PaperCut NG/MF features an undisclosed flaw within its authentication mechanism that allows unauthenticated remote attackers to exploit timing discrepancies. By analyzing the response times of login attempts, attackers can conduct username enumeration. The system engages in password hash comparis...

The PaperCut NG/MF software experiences a vulnerability in its login component that inadequately restricts excessive authentication attempts. This weakness can be exploited by unauthenticated remote attackers to launch brute-force or credential-stuffing attacks. In specific configurations, attack...

Metabase contains a vulnerability that enables a remote, unauthenticated attacker to perform SQL injection through the '/reset_password' endpoint. This flaw allows attackers to manipulate database queries, potentially gaining unauthorized administrator access to the Metabase instance and compromi...

A use after free vulnerability exists in the Windows Ancillary Function Driver for WinSock. This flaw enables an authorized attacker to exploit the driver and potentially elevate privileges locally, threatening the integrity of the operating system. To mitigate risk, it is essential to apply the ...

A vulnerability in Jinher OA 1.0 has been discovered, allowing unauthorized SQL injection through an unprotected function located in the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This weakness enables remote attackers to manipulate the argument 'httpOID' for malicious purpose...

Metabase contains a vulnerability that enables a remote, unauthenticated attacker to perform SQL injection through the '/reset_password' endpoint. This flaw allows attackers to manipulate database queries, potentially gaining unauthorized administrator access to the Metabase instance and compromi...

A security flaw has been identified in the LB-LINK X-PRO version 1.0.22-20231206 that impacts an unspecified function within the /etc/config/easycwmp file. The vulnerability enables the presence of hard-coded credentials, which could be exploited remotely. Although the complexity of the attack is...

A significant security vulnerability has been discovered in the LB-LINK X-PRO router, specifically in version 1.0.22-20231206. This issue pertains to an unknown function within the /etc/shadow file that exposes hard-coded credentials. Attackers can exploit this vulnerability remotely, allowing ac...

A SQL injection vulnerability has been identified in the SourceCodester Class and Exam Timetabling System, specifically in the 'edit_teacher.php' file. This issue arises from improper handling of the argument ID, enabling attackers to execute malicious SQL code remotely. The exploit has been publ...