Publicly Disclosed
PoC Exploits

A code injection vulnerability has been identified in the LlamaChinese Llama-Chinese Adapter Config through the get_class_from_dynamic_module function located in examples/chat_gradio_no_merge.py. The flaw allows an attacker to manipulate the base_model_name_or_path argument, potentially leading t...

A deserialization vulnerability has been identified in the HanLP natural language processing library developed by hankcs. This flaw exists in the function load_word2vec_as_vocab_tensor located in the torch_util.py file. An attacker can exploit this vulnerability remotely by manipulating the vecto...

A code injection vulnerability has been identified in the RVC-Project Retrieval-based-Voice-Conversion-WebUI, specifically within the change_info_ function of the webui.py file. This flaw allows an attacker to manipulate the ckpt_path argument, potentially leading to remote code execution. The vu...

A vulnerability exists in the Linux kernel that concerns the handling of shared skb fragments during the decryption process in ESP-in-UDP packets. When pages are attached from a pipe directly to an skb using MSG_SPLICE_PAGES, the kernel marked these SKBs with SKBFL_SHARED_FRAG, which plays a cruc...

A vulnerability exists in MeTube's DownloadQueue.__write_feed_metadata_sync function located in the app/ytdl.py file. This issue allows for potential server-side request forgery, which could be exploited remotely. The exploit's complexity makes it difficult to carry out, but legitimate concerns r...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A vulnerability has been identified in the Unsloth AI product, specifically in the FastSentenceTransformer._is_transformer_module_ref function located in the sentence_transformer.py file. This flaw allows manipulation of the argument Type, introducing the risk of accepting externally-controlled i...

A security flaw has been detected in the Tencent ncnn Conversion API within the function ncnn::yuv420sp2rgb, specifically located in the file src/mat_pixel.cpp. This vulnerability is characterized by an integer overflow issue, which can allow remote attackers to exploit the system. The potential ...

A vulnerability has been detected in Tencent's ncnn framework, specifically within the function matmul_transb located in src/layer/matmul.cpp. This vulnerability allows for an out-of-bounds read, potentially enabling attackers to read data beyond the boundaries allocated for a buffer. The exploit...

Amasty Order Attributes for Magento 2 prior to version 4.0.0 is impacted by an unauthenticated arbitrary file upload vulnerability. This flaw allows attackers to upload files of any type to the store's media directory without requiring authentication or session validation. If the uploaded files i...

A vulnerability exists in donetick's History Deletion Handler in the function CanDeleteHistory, located in internal/chore/model/model.go. This issue allows unauthorized manipulation of the argument AssignedTo, which could lead to inappropriate deletion of history records by users who should not h...

A security flaw has been identified in the Diem product of the Diem-Project that allows attackers to exploit the function dmBaseLinkTag::text in the file dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php. By manipulating the text argument, a remote attacker could execute cross-site scripting atta...

A vulnerability exists in the Diem project's implementation of the dmString::random function within the dmCorePlugin module. This issue leads to the generation of cryptographically weak pseudorandom numbers, posing a risk for remote exploitation. Although the complexity of executing such an explo...

An open redirect vulnerability has been identified in the Diem Project's Sign-In component. This issue arises from improper validation of the 'Referer' argument in the BasedmUserActions.class.php file. The flaw allows malicious actors to redirect users to unintended locations, potentially facilit...

A vulnerability exists in Diem-Project's Administrative Console, specifically within the 'append' function of 'actions.class.php'. This security flaw allows an attacker to manipulate the 'dm_command' argument, which can lead to cross-site scripting (XSS) attacks that are executable remotely. The ...

A vulnerability has been identified in the Version Check Service of the Diem Project. This issue affects the html function within the 'dmAdminPlugin/web/js/dmAdminCtrl.js' file, allowing attackers to execute malicious scripts in the context of the affected application. Since the product adopts a ...

A vulnerability in the Linux kernel affects the handling of GPU scheduler memory, leading to potential access to freed memory regions. Specifically, the issue arises from the improper freeing of scheduler-containing ring and VM objects. When the associated structures are deallocated using plain k...

An exploitable flaw exists in the RDBMS Functional Index component of Oracle Database Server versions 23.4 to 23.9. This vulnerability allows an attacker with SYSDBA privilege and network access through Oracle Net to potentially compromise the RDBMS Functional Index. Successful exploitation can p...

A flaw exists in the Diem Project's Google Analytics Client affecting the function within the gapi.class.php file, leading to improper certificate validation. This vulnerability allows for potential remote manipulation, posing a security risk. The complexity of exploiting this vulnerability is hi...

A vulnerability exists in iWebShop-5, specifically in the Util::search function of the classes/util.php file, allowing for SQL injection attacks. This flaw permits unauthorized users to manipulate database queries, potentially leading to data exposure or corruption. The vulnerability can be explo...

A vulnerability exists in the diem project affecting versions up to 5.1.3, specifically within the dmCorePlugin/lib/data/dmDataLoad.php file. An attacker could exploit this issue remotely, allowing them to manipulate default credentials. This vulnerability could lead to unauthorized access, makin...

A vulnerability exists in the Diem Project affecting the SHA1 Handler located in the file lib/model/doctrine/PluginDmUser.class.php. This flaw allows for manipulation of the salt or password arguments, leading to a password hash that lacks sufficient computational effort. Local exploitation is re...

A vulnerability in light0011 CMS has been identified within the Vote Handler component, specifically in the VoteController.class.php file. By manipulating the X-Requested-With argument, attackers can trigger business logic errors that may lead to unauthorized actions or exploits. Remote exploitat...

A vulnerability exists in the Uploadify component of Light0011 CMS, specifically in the file_exists function located in Public/Home/js/uploadify/check-exists.php. This flaw allows attackers to manipulate the filename argument, potentially exposing sensitive file and directory information. Remote ...

A vulnerability in the Linux kernel's IPv4 stack involves improper validation of checksum metadata, allowing packets with bad checksums to enter the system. This can lead to corruption of the network header through the skb_checksum_help function, potentially resulting in unpredictable behavior an...

A security flaw has been identified in light0011 CMS that compromises the password hashing mechanism within the UserModel.class.php file. Specifically, the sha1 function used for hashing passwords allows for hashes to be generated with insufficient computational effort, rendering them vulnerable ...

A vulnerability has been discovered in the light0011 CMS specifically affecting the Captcha Validation component. The weakness is present in the UserController.class.php file, which facilitates improper access controls. An attacker may exploit this vulnerability remotely, potentially allowing for...

A vulnerability has been identified in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance and Threat Defense Software. This issue arises from inadequate error handling during the processing of HTTP requests, which could be exploited by unauthenticated remote at...

A vulnerability in the Linux kernel's IPv4 stack involves improper validation of checksum metadata, allowing packets with bad checksums to enter the system. This can lead to corruption of the network header through the skb_checksum_help function, potentially resulting in unpredictable behavior an...

Plex Media Server versions before 1.43.3.10861 are susceptible to a vulnerability that allows an admin user to write arbitrary files. This occurs because the preference TranscoderH264Options is appended to x264's option string during each transcoding process. At server startup, all .so files are ...

Adobe Commerce is susceptible to a vulnerability that allows improper neutralization of special elements utilized in its template engine. This flaw could enable an attacker to execute arbitrary code within the context of the current user, potentially providing elevated access or control over the ...

A security issue has been identified in Soarkey StudentManagement, where the UserDao.login function fails to securely handle password information. This flaw allows for sensitive data to be stored in cleartext, potentially exposing user credentials during a local execution attack. Although the iss...

A vulnerability in the itsmeravitejak Online-Examination-System's Exam Module allows for SQL injection through the 'topicid' argument in the startExam function of exam.php. This flaw can be exploited remotely, posing significant risks to the integrity and security of the system. Despite being ale...

The Arm Mali GPU Kernel Driver has a vulnerability that enables non-privileged users to gain unauthorized write access to read-only memory pages. This poses a significant risk to the integrity of the system and affects various versions across the Midgard, Bifrost, and Valhall architectures. Syste...

A code injection vulnerability has been identified in the WongKinYiu yolov9 project, specifically within the DetectMultiBackend.__init__ function in models/common.py. This flaw arises from improper handling of argument names and stride, allowing for potential remote code execution by attackers. T...

A SQL Injection vulnerability exists in the Kishan0725 Hospital Management System, specifically within the Appointment Cancellation Handler function located in admin-panel.php. This weakness allows attackers to manipulate the argument ID in the mysqli_query function, potentially leading to unauth...

The go-git library, a pure Go implementation of Git, has a vulnerability related to improper sanitization of reference names before they are used to construct on-disk paths. As a result, an attacker could craft a malicious reference name containing directory-traversal sequences, allowing files to...

A Cross Site Scripting vulnerability has been identified in the Extra-Networks Card Builder component of AUTOMATIC1111's stable-diffusion-webui, specifically in the read_metadata_from_safetensors function within modules/sd_models.py. This flaw allows attackers to manipulate the __metadata__.sshs_...

A code injection vulnerability exists in the AUTOMATIC1111 stable-diffusion-webui software that affects versions up to 1.10.1. The issue lies within the get_obj_from_str function of the sd_models.py file, specifically during model instantiation. This vulnerability allows remote attackers to injec...

A vulnerability exists in the AUTOMATIC1111 Stable-Diffusion-WebUI, affecting versions up to 1.10.1, specifically in the read_metadata_from_safetensors function located in the modules/sd_models.py file. This vulnerability allows remote attackers to manipulate the header length field, resulting in...

A cross-site scripting vulnerability exists in the Card Builder module of the AUTOMATIC1111 Stable Diffusion Web UI, specifically in the function create_item_html located in the file modules/ui_extra_networks.py. This issue arises from improper handling of the 'filename' argument, allowing attack...

The Snac2 application prior to version 2.93 contains a vulnerability in the JSON loader function _xs_json_load_lexer(), which can be exploited by unauthenticated remote attackers. By crafting a specific POST request with a JSON string containing a null escape sequence, an attacker can overflow he...

Libtta versions up to 2.3 contain a divide-by-zero vulnerability within the function tta_decoder_init_get_info(). This flaw can be exploited by attackers to crash various applications, including the bundled tta console tool, by supplying a .tta file with an unvalidated zero sample rate. The attac...

The vulnerability in SMPEG affects versions up to 2.0.0, allowing attackers to exploit an integer underflow in the stream_header() function. By declaring an undersized packet length, attackers can manipulate the packet_size, potentially leading to a crash of the application through an assertion f...

The libmng library, up to version 2.0.3, suffers from a heap-based buffer overflow vulnerability in the mng_read_ordr() function. This issue arises because the sizes of the ORDR entry buffers are determined by 5-byte on-wire records, rather than fitting in standard 8-byte in-memory entries. Attac...

Schism Tracker versions up to 20260524 are susceptible to a heap out-of-bounds write due to improper handling in the fmt_ult_load_song() function. This vulnerability occurs when a crafted .ult module is used to manipulate the sample count, leading to overwriting the instruments pointer array. Con...

A cross site scripting vulnerability has been discovered in the Blood Bank Management System version 1.0.0, specifically within an unknown function in the file /abs.php. This weakness allows remote attackers to manipulate the 'Search' argument, facilitating the injection of harmful scripts into w...

The Modern Events Calendar Lite and Pro plugins for WordPress are prone to a SQL injection vulnerability due to inadequate sanitization and escaping of user-supplied input in SQL statements. This flaw allows authenticated users with minimal privileges, such as subscribers, to manipulate the SQL q...

The WP Photo Album Plus plugin for WordPress prior to version 9.2.11.002 contains a flaw that permits unauthenticated attackers to execute arbitrary JavaScript through category navigation values. By injecting malicious scripts, an attacker can manipulate the behavior of gallery breadcrumb links. ...

The Modern Events Calendar Lite plugin for WordPress prior to version 7.37.0 lacks crucial security checks, permitting authenticated users, including those with minimal privileges, to retrieve sensitive information such as names, email addresses, transaction IDs, and payment amounts associated wi...