Publicly Disclosed
PoC Exploits

The EPyT-Flow Python package, which facilitates the generation of hydraulic and water quality scenario data for water distribution networks, contains a vulnerability that enables remote code execution. Prior to version 0.16.1, the package's REST API incorrectly processes attacker-manipulated JSON...

The CVE-2024-27867 vulnerability affects a wide range of Apple’s wireless audio devices, including AirPods (2nd generation and later), AirPods Pro (all models), AirPods Max, Powerbeats Pro, and Beats Fit Pro. It allows an attacker within Bluetooth range to spoof the intended source device and gai...

A SQL injection vulnerability exists in Nessus that allows attackers to create a harmful scan result file. When a privileged user imports this file, it may result in malicious SQL being injected into the scan results database. This exploitation could lead to unauthorized access and potential data...

A vulnerability in WordPress allows for potential SQL Injection due to improper sanitization of the author__not_in parameter in WP_Query. When untrusted input is passed to this parameter via a plugin or theme, it could lead to unauthorized database queries. Affected versions include WordPress 6.8...

A vulnerability in WordPress allows for potential SQL Injection due to improper sanitization of the author__not_in parameter in WP_Query. When untrusted input is passed to this parameter via a plugin or theme, it could lead to unauthorized database queries. Affected versions include WordPress 6.8...

Craft CMS, a customizable content management system, has a remote code execution vulnerability present in specific versions. Attackers could exploit this flaw to execute arbitrary code on the server, posing a significant security risk. The affected versions span from 3.0.0-RC1 to just before 3.9....

A security weakness has been discovered in the GIT File Helper component of umijs. Specifically, the function git.getFileCreateInfo located in packages/utils/src/getFileGitIno.ts is susceptible to OS command injection. This vulnerability could enable attackers to execute arbitrary commands on the...

A security vulnerability has been identified in itsourcecode Hospital Management System 1.0, specifically within an unspecified function of the /prescription.php file. This flaw allows attackers to inject malicious SQL queries through the manipulation of the 'editid' argument, leading to potentia...

A vulnerability has been discovered in the jsforce library, specifically in the function _execCommand located in lib/registry/sfdx.js. This flaw allows for os command injection, posing a risk to local environments where the code is executed. Exploitation of this vulnerability can lead to unauthor...

A security flaw was identified in QUSETIONS MiniCode-Python version 0.1.0, specifically impacting the subprocess.Popen function within the Project File Handler component. This vulnerability allows for potential OS command injection, creating a pathway for attackers to execute arbitrary commands o...

A vulnerability exists in SourceCodester's Class and Exam Timetabling System 1.0 within the /BSIS.php file. This vulnerability enables an attacker to manipulate the 'day' argument, which can lead to Cross Site Scripting (XSS) attacks. Since the exploit can be initiated remotely, it poses a signif...

A cross site scripting vulnerability exists in the SourceCodester Class and Exam Timetabling System 1.0, specifically related to the manipulation of the 'day' argument in the /class.php file. This flaw enables an attacker to execute arbitrary scripts in the user's browser, which can compromise se...

The Apache Camel Keycloak Component contains a vulnerability where improper authentication leads to potential unauthorized access. The KeycloakSecurityPolicy’s default configuration may allow requests with invalid tokens to bypass checks entirely. This means that as long as a request carries a no...

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_subjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published...

The Autel Maxi Charger Single firmware version V1.03.51 contains a significant vulnerability that allows unauthorized access to the NXP i.MX6 recovery mode via exposed hardware recovery pins. This flaw permits attackers with physical access to execute malicious code, enabling them to modify or ex...

A vulnerability exists within the ngx_http_dav_module of NGINX Open Source and NGINX Plus that can be exploited to trigger a buffer overflow in the NGINX worker process. This scenario is possible when configuration files utilize the DAV module's MOVE or COPY methods combined with specific prefix ...

A SQL injection vulnerability exists within Aptabase's ClickHouse query backend, stemming from commit 5a89368. This flaw enables authenticated attackers to exploit unsanitized filter parameters in Liquid SQL templates, allowing unauthorized access to event data across multiple tenants. By manipul...

The XZ utility has been compromised due to malicious code introduced in the upstream tarballs starting from version 5.6.0. A sophisticated obfuscation technique is employed where the liblzma build process extracts a prebuilt object file hidden within a disguised test file in the source code. This...

The djangoSIGE product, up to version 1.10, contains a vulnerability that allows unauthenticated attackers to exploit the ForgotPasswordView functionality. By interacting with the password reset endpoint, attackers can submit arbitrary usernames or email addresses and determine if they correspond...

Linknat VOS3000 and VOS2009 versions up to 2.1.2.0 are susceptible to an unauthenticated SQL injection vulnerability via the login endpoint's name parameter. This flaw allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive data. By manip...

Linknat VOS3000 and VOS2009 versions up to 2.1.2.0 are susceptible to an unauthenticated SQL injection vulnerability via the login endpoint's name parameter. This flaw allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive data. By manip...

Pdfminer.six, an open-source library for extracting information from PDF documents, is vulnerable to arbitrary code execution due to improper handling of malicious pickle files embedded in specially crafted PDF files. Specifically, the issue arises from the `CMapDB._load_data()` function that uti...

A vulnerability exists in the Apache Camel Netty HTTP component, where error messages include sensitive internal information due to configuration settings. Specifically, the 'muteException' option defaults to false, leading to the exposure of detailed Java stack traces during processing errors. T...

The Apache Camel Salesforce Component is susceptible to an authorization bypass due to improper handling of special elements in output. This vulnerability allows an attacker to manipulate SOQL queries, SOSL searches, and other Salesforce operations by controlling the HTTP headers that are passed ...

A remote code execution vulnerability has been identified in the ServiceNow AI platform, allowing an unauthenticated user to execute arbitrary code under specific conditions. The vendor has implemented a security update that addresses this vulnerability for all hosted instances and provided updat...

A security flaw exists in the ZS-Admin product developed by zsadmin2025, specifically affecting the file handling component com.zs.file.controller.SysFileController. This vulnerability allows for unrestricted file uploads through manipulation of the File argument in the /api/system/file/upload en...

A significant vulnerability has been detected in the ZS-Admin product by zsadmin2025, specifically within the MyBatis-Plus Tenant Plugin. The flaw resides in the getTenantId function of the /api/system/sys/dept/page file, where manipulation of the X-Tenant-Id argument allows unauthorized access t...

A vulnerability exists in ZS-Admin software that affects the functionality of the OrderItem.asc and OrderItem.desc methods within the SysDeptController component. This weakness arises from improper validation of user input in the orderField parameter, enabling attackers to execute SQL injection a...

A command injection vulnerability exists in D-Link NAS devices, including models such as DNS-120 and DNS-320. The flaw arises in the 'cgi_check_rsync_rw' function within the 'remote_backup.cgi' file. By manipulating the 'ip' argument, an attacker can execute arbitrary commands remotely. This vuln...

A security flaw has been identified in D-Link's DNS-320 version 1.0.2, specifically within the multi_uploadify.php file. This vulnerability allows attackers to manipulate the Filedata[] argument, leading to unrestricted file uploads. The potential for remote exploitation is significant, given tha...

A vulnerability exists in the Linux kernel's handling of UDP reuse ports which may lead to buffer overflow issues. When a cBPF program is replaced while another thread is sending a UDP packet to the reuse port group, improper resource management can occur. Specifically, the reuseport program is f...

An improper privilege management vulnerability in Apache Syncope allows users to misuse defined Roles through a compromised REST API call. When the all-Java or Flowable user workflow adapters are incorrectly configured, users may escalate their privileges by granting themselves roles without prop...

The bpost-shipping-platform WordPress plugin, prior to version 3.2.3, is susceptible to a SQL injection vulnerability due to improper parameter sanitization during WooCommerce order processing. This flaw permits unauthenticated attackers to execute time-based blind SQL injection attacks, potentia...

The WPBot plugin for WordPress has a security vulnerability where it fails to perform necessary capability and nonce checks in its settings handlers. This oversight allows authenticated users with subscriber-level access to modify configurations within the WPBot plugin prior to version 8.2.0. Suc...

The Academy LMS plugin for WordPress prior to version 3.8.1 contains a significant security flaw in its lesson AJAX handlers. The vulnerability arises from the failure to verify the ownership of user-supplied identifiers, allowing authenticated users with minimal permissions, such as subscribers,...

The Bit Form WordPress plugin, prior to version 3.1.0, is vulnerable due to its failure to secure file-field values from user input. This oversight enables unauthenticated attackers to exploit the plugin, leading to unauthorized access of sensitive server files, including the WordPress configurat...

The Bit Form WordPress plugin prior to version 3.1.0 is prone to a security issue where it fails to properly validate its workflow-trigger token after the associated transient expires. As a result, unauthenticated attackers can exploit this weakness to re-trigger form actions, including sending n...

The Free Builder for Elementor plugin for WordPress prior to version 1.6.7 is vulnerable to a stored cross-site scripting (XSS) flaw. This vulnerability arises because the plugin does not sanitize user input from contact form fields, allowing unauthenticated attackers to craft malicious payloads....

The Classified Listing plugin for WordPress, prior to version 5.3.9, suffers from inadequate access control in its payment-receipt handling functionality. This flaw allows authenticated users with subscriber-level permissions to access and view payment receipt details belonging to other users' or...

A deserialization vulnerability was identified in Comma AI Openpilot 0.11, specifically in the function pickle.load/pickle.loads located in selfdrive/modeld/modeld.py. This vulnerability allows an attacker with local access to exploit the Pickle Module, potentially manipulating the application's ...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A security feature bypass vulnerability exists in Microsoft Windows, referred to as 'YellowKey.' This flaw could allow unauthorized access to restricted features, compromising system integrity. A proof of concept has been publicly released, contrary to established security practices. Users are ad...

A SQL injection vulnerability exists in the itsourcecode Hospital Management System version 1.0, specifically within the `prescriptionorder.php` file. This flaw allows unauthenticated attackers to manipulate the `editid` parameter, potentially leading to unauthorized access to the database. Explo...

The Apache Camel Kafka Component is susceptible to an input validation flaw that enables an attacker to manipulate the target Kafka topic at runtime. Specifically, the kafka.OVERRIDE_TOPIC header can be exploited to publish messages to arbitrary, potentially sensitive topics, bypassing predefined...

A vulnerability found in the D-Link DNS-320 version 1.0.2 allows remote attackers to exploit the multi_uploadify.php functionality. By manipulating the 'Filedata[]' parameter, unauthorized users can perform unrestricted file uploads to the device. This can lead to potential security breaches, as ...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A security flaw has been identified in the D-Link DNS-320 that allows attackers to perform unrestricted file uploads via the save_ajax.php script, potentially leading to unauthorized execution of files on the server. By manipulating the 'Malicious Handler' parameter, remote attackers can exploit ...

A vulnerability has been discovered in D-Link DNS-320 version 1.0.2, specifically in the '/web/jquery/uploader/uploadify.php' file. This flaw allows for unrestricted file uploads via a manipulated request to a specific resource. As a result, attackers can exploit this weak point remotely, enablin...

A vulnerability has been discovered in the D-Link DNS-320 version 1.0.2, specifically in the file 'uploadify.php'. This security flaw allows for the manipulation of a malicious handler that could lead to unrestricted file uploads. Such an exploit can be triggered remotely, exposing the system to ...

A vulnerability exists in the D-Link DNS-320 (version 1.0.2) related to the file /web/web_file/upload.php, which allows for unrestricted file uploads. By manipulating the argument 'File', an attacker can upload potentially harmful files. This issue can be exploited remotely, posing a substantial ...