Publicly Disclosed
PoC Exploits

A vulnerability has been found in the TRENDnet TEW-823DRU router's CLI Configuration Tool, specifically within the nvram_get function. This flaw allows for command injection, which can be exploited remotely. The potential for unauthorized access and manipulation of system commands poses significa...

A vulnerability exists in the TRENDnet TEW-821DAP product version 2.2.01b05, specifically within the uci_safe_get function of the /cgi-bin/apply_time.cgi script related to the NTP Timezone Configuration. An attacker can exploit this vulnerability by manipulating specific arguments, leading to a s...

A command injection vulnerability exists in the TRENDnet TEW-821DAP version 2.2.01b05, specifically in the functionality of the /cgi-bin/upload.cgi file related to the ssi component. By manipulating the filename parameter, an attacker can execute arbitrary commands remotely, posing a significant ...

The Slider Hero with Video Background, Animation WordPress plugin prior to version 9.1.3 is susceptible to a critical security flaw that permits unauthenticated users to exploit the plugin's request handlers. This exploit bypasses essential authorization and nonce checks, enabling the injection o...

The SmilePass Selfie Login plugin for WordPress, up to version 1.0.2, is susceptible to an authentication bypass vulnerability. This flaw allows attackers to impersonate any registered user, including administrators, by circumventing the necessary server-side identity verification. Consequently, ...

The Social Login & Sharing buttons with Analytics plugin by SoClever, prior to version 1.2.0, contains a significant security flaw that lacks essential authentication, authorization, and nonce checks in its publicly accessible login handlers. This oversight enables unauthenticated attackers to ex...

The WP Social Media Login plugin for WordPress, up to version 1.0.6, contains a vulnerability where it fails to properly verify social logins from identity providers. This flaw permits unauthorized users to bypass authentication and log in as any existing user by merely providing the email addres...

The Forminator Forms plugin for WordPress, prior to version 1.57.0.7, has a security flaw in its role restriction enforcement for registration forms. This vulnerability permits users who are authorized to create forms to set configurations that allow any visitor registering through the form to be...

The Firebase Authentication plugin for WordPress has a security vulnerability that permits unauthenticated attackers to log in as any user, including those with administrative privileges. This issue arises because the plugin fails to verify the email address in the authentication token prior to m...

The ManageWP Worker plugin for WordPress has a vulnerability that allows attackers to bypass authentication processes. This is due to the plugin failing to bind the account being logged into with the authorization signature, which can lead to session hijacking. If an attacker gains access to a pr...

The Forminator Forms plugin for WordPress, prior to version 1.57.0.5, exposes a critical weakness that allows any site administrator within a multisite network to execute arbitrary code. This occurs due to the improper restriction of a network-wide setting, thereby enabling potential malicious ac...

The Conekta Payment Gateway plugin for WordPress versions prior to 6.2.2 contains a serious security flaw where it fails to authenticate incoming webhook notifications from the payment gateway. This oversight allows attackers to manipulate order statuses by marking any order as paid without prope...

The Tutor LMS WordPress plugin, prior to version 4.0.6, has a significant security issue due to the lack of validation for stored file paths when streaming media. This oversight allows users with instructor permissions to read arbitrary files stored on the server. As a result, sensitive informati...

The FiboSearch plugin for WordPress prior to version 1.34.1 allows unauthorized users to access sensitive information on password-protected products through its unauthenticated AJAX endpoints. Specifically, the autocomplete search and details panel endpoints do not enforce adequate authentication...

The Tutor LMS WordPress plugin versions prior to 4.0.6 are susceptible to an insecure access control vulnerability. This flaw allows users with the instructor role to access private course content owned by other instructors. Consequently, an unauthorized user can view sensitive course materials, ...

The Post Grid, Slider & Carousel Ultimate plugin for WordPress prior to version 1.8.1 is susceptible to a JavaScript injection vulnerability. This flaw arises from the plugin's failure to properly sanitize and escape specific custom post type settings prior to rendering them in HTML attributes on...

In ONNX versions prior to 1.21.0, a vulnerability exists in the 'save_external_data' function that allows a local attacker to exploit symlinks when writing external data. This issue arises because the function constructs the file path from the model's external_data location field and opens it wit...

The ProfilePress plugin for WordPress, prior to version 4.17.1, is susceptible to a vulnerability that fails to adequately sanitize input in profile fields before rendering. This flaw enables unauthenticated attackers to inject shortcodes, which are executed when the affected profile page is view...

The Limit Login Attempts Reloaded plugin for WordPress is susceptible to an authentication bypass due to its failure to perform case-insensitive comparisons on its username denylist. Furthermore, the plugin does not consider the account's associated email address, which allows blocked accounts to...

The Passster plugin for WordPress prior to version 4.3.9 contains a flaw that allows unauthenticated attackers to bypass globally set password protections due to improper comparison of REST API endpoint paths. Instead of accurately matching resolved routes, the plugin evaluates paths as unanchore...

The Charitable WordPress plugin prior to version 1.8.12 contains a critical flaw that allows unauthenticated attackers to forge payment webhook notifications. This occurs due to the plugin's failure to verify the authenticity of incoming Square payment webhooks, enabling attackers to mark donatio...

The myCred plugin for WordPress prior to version 3.2.5 contains a security flaw that allows attackers to manipulate the in-site currency system. Specifically, the plugin fails to validate whether the payment notification received corresponds to a legitimate merchant account configured by the site...

The LitExtension WordPress plugin, up to version 1.2.5, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. This issue stems from the plugin's failure to verify nonce tokens before allowing administrative actions. An attacker can exploit this oversight by tricking an authenticate...

The Eventin WordPress plugin prior to version 4.1.21 has a significant vulnerability where it fails to validate user-provided webhook URLs associated with events. This oversight allows users with contributor-level access or higher to send concealed server-side requests to any external server, pot...

A vulnerability exists in Dolibarr versions up to 23.0.4, specifically within the Account Handler component located in htdocs/user/card.php. The issue arises from improper handling of the argument ID, allowing unauthenticated users to gain access to functionalities they should not be permitted to...

A security flaw has been identified in the Comfast CF-N1-S, specifically in version 2.6.0.1. The vulnerability affects the /cgi-bin/mbox-config?method=SET&section=ntp_timezone file, where manipulation of the 'timestr' argument can lead to command injection attacks. This vulnerability can be explo...

A vulnerability exists within the CodeAstro Online Job Portal 1.0 that allows attackers to exploit the file '/users/update-profile.php'. This security flaw enables remote attackers to manipulate the 'Name' argument, leading to unrestricted file uploads. The exploitation does not require any speci...

The Duplicate Post plugin for WordPress before version 1.5.6 fails to properly validate user permissions, allowing users with limited roles to duplicate posts that are password-protected. This oversight enables unauthorized users to republish sensitive content without permission, posing a signifi...

The AI Engine plugin for WordPress, prior to version 3.6.1, contains a vulnerability that fails to properly validate user permissions for privileged management actions. This allows unauthorized users with Administrator roles on Multisite sub-sites to gain control over any account within the netwo...

The Duplicate Post plugin for WordPress prior to version 1.5.6 has a serious access control flaw that fails to properly verify user capabilities when retrieving post data. This oversight allows users with delegated roles to access sensitive content, including metadata and passwords associated wit...

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress, prior to version 5.0.14, suffers from an access control vulnerability. This flaw arises from the plugin's failure to adequately restrict access to commission configuration data available through unauthenticat...

The Media Library Assistant plugin for WordPress is susceptible to SQL injection due to improper validation of search parameters used in media-library query handlers. This vulnerability enables users with the Author role to inject malicious SQL code into queries, potentially compromising the data...

The Dokan plugin for WordPress suffers from a significant payment processing flaw. Versions prior to 5.0.14 allow vendors to submit reverse-withdrawal payment amounts without proper validation against their actual outstanding balances. This deficiency enables malicious vendors to manipulate their...

The Link Whisper Free WordPress plugin versions before 0.9.7 is susceptible to SQL injection due to inadequate sanitization and escaping of parameters in SQL queries. This vulnerability allows authenticated users with the Editor role or higher to manipulate database queries, potentially compromis...

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress versions prior to 5.0.14 contains a flaw in its admin REST API routes. Specifically, it fails to accurately verify user capabilities, allowing unauthorized users—such as Shop Managers—access to install and act...

The Drag and Drop Multiple File Upload functionality in the Contact Form 7 WordPress plugin is susceptible to a security flaw where it fails to validate the final name of uploaded files after removing certain characters. This oversight allows unauthenticated users to bypass restrictions on file t...

The Drag and Drop Multiple File Upload for Contact Form 7 plugin, prior to version 1.3.9.9, contains a vulnerability where it fails to properly escape one of its settings used as an HTML tag name during front-end output. This flaw enables users with administrator access to inject arbitrary web sc...

The NewPath WildApricotPress Add-on for WordPress, up to version 1.0.0, has a vulnerability that fails to protect the privacy of members' fields. This issue allows unauthenticated users to access sensitive information, namely member email addresses and phone numbers, that should only be visible t...

The Welcart e-Commerce plugin for WordPress prior to version 2.12.1 is susceptible to a session fixation vulnerability. This allows an unauthenticated attacker to manipulate the session identifier by supplying a crafted request parameter. Consequently, if a victim logs in after being lured, the a...

The Tamara Checkout plugin for WordPress is susceptible to a vulnerability where it fails to properly verify the order key and nonce during payment cancellation and failure processes. This fault allows an unauthenticated attacker to manipulate WooCommerce order statuses by simply providing numeri...

A vulnerability exists in the SourceCodester Dynamic Input Field Generator where the 'saveUser' function within the 'submit.php' file fails to properly validate input. Specifically, the manipulation of the 'Researcher' argument allows for SQL injection attacks, which can be executed remotely. Giv...

A security flaw has been identified in the SourceCodester Dynamic Input Field Generator, which utilizes HTML, CSS, and PHP. This vulnerability allows an attacker to manipulate a specific function, resulting in cross-site request forgery (CSRF) attacks that can be executed remotely. Exploiting thi...

The OTRS Community Edition is affected by an OS command injection flaw within its PGP encryption module. This vulnerability allows administrators to execute arbitrary commands on the operating system by crafting specific values for the PGP binary path and command options. Because user-supplied co...

A stack-based buffer overflow vulnerability exists in the Comfast CF-N1-S Web Management interface within the function sub_44B50C of the mbox-config component. This issue can be exploited remotely, allowing attackers to manipulate certain inputs to overflow the stack, potentially leading to arbit...

A vulnerability exists in elunez eladmin versions up to 2.7, specifically within the EmailController, AliPayController, GeneratorController, and GenConfigController functions. This flaw allows for improper authorization that can be exploited remotely. The vulnerability was reported to the project...

The Lean 4 kernel fails to verify the structure within a projection expression aligns with the projected value's type. Consequently, the function environment::add_inductive does not properly type check nested inductive applications. This oversight permits a metaprogram to construct an ill-typed n...

The Lean 4 kernel fails to verify the structure within a projection expression aligns with the projected value's type. Consequently, the function environment::add_inductive does not properly type check nested inductive applications. This oversight permits a metaprogram to construct an ill-typed n...

A command injection vulnerability exists in the Tenda CH22 router, specifically within the function formcreateFileName of the file /goform/formcreateFileName. An attacker can manipulate the argument fileNameMit, enabling unauthorized execution of commands remotely. The potential for exploitation ...

A SQL injection vulnerability exists in the itsourcecode Hospital Management System version 1.0, specifically within the /viewappointmentpending.php file. This flaw allows attackers to manipulate the 'delid' argument, enabling them to execute unauthorized SQL queries. The vulnerability may be exp...

A security flaw has been identified in Comfast CF-N1-S version 2.6.0.1, specifically in the SSID Configuration component. This vulnerability resides in the function sub_44B438 within the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid. By manipulating the ssid argument, an attacker can tr...