Publicly Disclosed
PoC Exploits

Prior to version 1.11.3, FreeSWITCH is susceptible to a vulnerability in the sofia_presence_handle_sip_i_message() function that mishandles the parsing of SIP MESSAGE requests. By improperly splitting the 'To' user on a plus sign, it allows attackers to leverage the chat protocol selector. This e...

The itsourcecode Airline Reservation System 1.0 contains a vulnerability in the /admin/manage_user.php file, which allows for SQL injection through improper handling of the ID argument. This flaw may enable remote attackers to manipulate SQL queries, potentially leading to unauthorized access to ...

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log messag...

The vulnerability in Sudo prior to version 1.9.5p2 arises from an off-by-one error that can lead to a heap-based buffer overflow. This flaw can be exploited through 'sudoedit -s' when given a command-line argument that concludes with a backslash. Successful exploitation can grant attackers elevat...

The vulnerability in Sudo prior to version 1.9.5p2 arises from an off-by-one error that can lead to a heap-based buffer overflow. This flaw can be exploited through 'sudoedit -s' when given a command-line argument that concludes with a backslash. Successful exploitation can grant attackers elevat...

The Burst Statistics plugin for WordPress prior to version 3.7.5 is susceptible to an information disclosure issue. This vulnerability arises because the plugin does not validate whether a reported page view is linked to published content. Additionally, it fails to check the post status before di...

The Burst Statistics plugin for WordPress versions prior to 3.7.5 contains a vulnerability that permits unauthorized access to report statistics. This occurs because the plugin fails to enforce date range restrictions on shared report links, enabling users with access to the link to view statisti...

The Custom Block Builder plugin for WordPress prior to version 3.0.0 has a critical flaw in its permission checks for REST routes. It fails to properly deny unauthorized requests, allowing unauthenticated users to manipulate server-side PHP code. This oversight can lead to serious security breach...

The WPGraphQL plugin for WordPress prior to version 2.27.1 features a critical access control flaw that allows users with Contributor roles and above to bypass restrictions on custom non-public post statuses. This means they can unintentionally access and read posts created by other users, potent...

The RegistrationMagic plugin for WordPress prior to version 6.1.0.4 has a security flaw that permits unauthenticated users to exploit the registration form. This vulnerability allows attackers to overwrite the profile fields of legitimate, non-administrator users without verifying the ownership o...

The Membership Plugin for WordPress prior to version 4.0.6 lacks essential authorization and CSRF checks. This oversight allows unauthenticated users to execute a schema-altering database maintenance process, leading to potential data corruption. Specifically, it permits these users to alter the ...

The Membership Plugin for WordPress prior to version 4.0.6 contains a significant access control vulnerability. It fails to ensure that the membership referenced in a saved-card payment request belongs to the user making the request. This flaw allows subscribers to potentially access and disclose...

The A2Reviews WordPress plugin version 1.2.3 contains an authorization bypass vulnerability that allows unauthenticated attackers to modify its settings and product review metadata. This occurs due to improper verification of authorization on multiple API command handlers, which rely on a signatu...

The RegistrationMagic plugin for WordPress is susceptible to an SQL injection vulnerability due to improper sanitization and escaping of parameters within its SQL statements. This flaw enables users with elevated privileges, such as administrators, to manipulate database queries, potentially lead...

The RegistrationMagic plugin for WordPress fails to properly escape user-supplied values in admin screens, enabling attackers to inject arbitrary JavaScript. This vulnerability can be exploited by unauthenticated users who craft a malicious link, tricking administrators into executing the injecte...

The Auth Armor plugin for WordPress, up to version 1.0.3, contains a critical vulnerability that allows logged-out users to access several handlers without authentication. This flaw leads to exposure of the site's stored API credentials, which can be exploited by unauthenticated attackers. Conseq...

The Payment Gateway via Valitor for WooCommerce plugin prior to version 1.9.41 has a significant security flaw that compromises payment confirmation processes. It does not adequately validate the authenticity of payment callbacks, relying on a hard-coded verification secret that is common across ...

The vulnerability in MailEnable arises from improper handling of XML External Entity (XXE) references within the parseObjectResponse method. This flaw permits remote attackers to gain unauthorized access to sensitive data present in the system. Exploitation of this security issue requires user au...

A cross site scripting vulnerability has been identified in the Linux Foundation's Magma NMS component, specifically within the handleReact function of the nms/server/main/routes.ts file. This vulnerability enables attackers to manipulate the web application to execute malicious scripts remotely....

A remote exploitation vulnerability exists in the Host Middleware of Linux Foundation Magma, specifically within the hostOrgMiddleware function. This issue arises from improper handling of the role argument, leading to a lack of necessary authorization checks. As a result, attackers could remotel...

A vulnerability exists in the vllm-project's vllm versions 0.30.0 and 0.31.0 due to a race condition in the single_type_kv_cache_manager.py file. This flaw allows an attacker to exploit the manipulation of the Common Prefix Handler, potentially leading to unauthorized data access. The exploitatio...

A vulnerability has been identified in the D-Link DIR-600L router's HNAP Handler, specifically in the hnap_main function located in the cgibin directory. This flaw allows an attacker to execute a remote stack-based buffer overflow attack, leading to potential unauthorized access and control over ...

The vulnerability in the TLS and DTLS implementations of OpenSSL versions prior to 1.0.1g allows remote attackers to exploit crafted Heartbeat Extension packets. This exploitation results in a buffer over-read, potentially revealing sensitive information from the memory of the affected process. A...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A vulnerability has been identified in the D-Link DIR-600L router, specifically within the authentication functionality of the file 'authentication.cgi'. This vulnerability can be exploited by manipulating the 'id' or 'password' arguments, leading to a stack-based buffer overflow. As a result, at...

A buffer overflow vulnerability has been identified in the TRENDnet TEW-657BRM router, specifically linked to the processing of the 'upgrade_flash.cgi' file. This flaw allows remote attackers to manipulate input argument boundaries, potentially leading to unauthorized access or service disruption...

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

A vulnerability has been identified in the TRENDnet TEW-657BRM router affecting the sprintf function within /setup.cgi of the mini_httpd component. This flaw allows for out-of-bounds writes, which can potentially be exploited remotely. As the affected product has been discontinued for over 15 yea...

A vulnerability in SiteSkite, a WordPress plugin, allows unauthenticated users to execute arbitrary code remotely. This serious security flaw affects versions 2.1.8 and earlier, potentially leading to unauthorized access and manipulation of vulnerable installations. Users are strongly advised to ...

Marimo, a reactive Python notebook, exhibits a significant security vulnerability prior to version 0.23.0. The terminal WebSocket endpoint (/terminal/ws) allows unauthenticated access, enabling attackers to gain a complete pseudo-terminal shell and execute arbitrary commands on the host system. U...

The OpenMage Magento LTS versions prior to 20.18.2 and between 21.0.0-beta1 and 21.0.0-beta3 are vulnerable due to an unrestricted file upload issue stemming from a missing blocklist entry for certain file types. This flaw allows unauthenticated attackers to exploit file custom options to upload ...

An authentication bypass vulnerability in Apache Airflow's CeleryExecutor allows unauthorized users to enqueue malicious callback workloads. By exploiting this flaw, an attacker can run arbitrary code on connected CeleryExecutor workers without needing valid Airflow credentials. This occurs throu...

The ELEX WordPress HelpDesk & Customer Ticketing System is susceptible to a deserialization vulnerability that allows for object injection. This flaw arises from the handling of untrusted data, which can potentially lead to unauthorized actions within the application. Users of versions prior to 3...

The AutomatorWP Pro plugin's webhook addon is susceptible to an authorization bypass flaw in versions up to and including 1.4.4. The vulnerability arises from inadequate verification of user permissions, enabling unauthenticated attackers to reset passwords for any WordPress account, including th...

An OS command injection vulnerability exists in the Air Terminal 6 provided by SoftBank Corp. This security flaw allows users who have access to the web management console to execute arbitrary commands with root privileges, posing significant risks to the integrity and security of the system.

A security flaw has been identified in the Sox_ng product, specifically in the VOC Decoder component where the function read_samples_voc is located. This vulnerability can lead to an out-of-bounds write, which may allow an attacker to manipulate memory beyond intended boundaries. Such manipulatio...

NocoDB before 2026.08.0 is susceptible to a stored cross-site scripting vulnerability. This flaw allows authenticated Creator users to inject malicious scripts via markup in column or table titles. The issue arises when the Delete.vue confirmation dialog utilizes an unescaped innerHTML binding to...

NocoDB versions prior to 2026.09.0 contain a stored cross-site scripting (XSS) vulnerability that allows authenticated Editor users to execute malicious scripts. This is achieved by exploiting crafted attachment MIME types that can be uploaded via the records API. When a user accesses a specific ...

A critical security weakness has been discovered in the Wubang Five-in-One Safety Production Management Information System, affecting versions up to 3.5. The vulnerability lies within the DiyFileUpload function of the /ws.asmx file, allowing attackers to upload files without restriction. This fla...

NocoDB versions prior to 2026.09.0 are susceptible to a privilege escalation vulnerability that compromises the administrative integrity of the platform. When the environment variable for the admin password is empty, the system fails to enforce super-admin bootstrap procedures. This oversight per...

A vulnerability exists in OpenSSL when parsing CMS AuthEnvelopedData structures that employ AEAD ciphers like AES-GCM. This flaw arises from the improper handling of oversized Initialization Vectors (IVs) crafted within ASN.1 parameters, leading to a stack buffer overflow. An attacker can exploit...

An improper neutralization vulnerability exists in the Auth API of Synology DiskStation Manager, impacting versions prior to 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. This flaw allows remote attackers to exploit SQL commands for unauthorized file access or modifications, l...

A security vulnerability has been identified in the Mereithhh VanBlog component, specifically affecting versions up to 0.54.0. The issue resides within the fs.readFileSync function of local.provider.ts, allowing remote attackers to exploit the argument manipulation of the path leading to a potent...

The FrankenPHP standalone static binaries before version 1.13.2 include a PHP Brotli extension that is linked with an outdated version of Brotli. This leads to an out-of-bounds write vulnerability in the decoder, potentially allowing unauthenticated remote attackers to exploit the flaw. By sendin...

A validation flaw in the MongoDB Node.js driver allows an unauthenticated attacker to exploit DNS SRV responses, potentially connecting to unintended hosts and leading to unauthorized access to sensitive application data. When using a mongodb+srv:// connection string, the driver verifies the DNS ...

A vulnerability exists in the Mereithhh VanBlog up to version 0.54.0 that exposes the Image Upload Endpoint to cross-site scripting attacks. An attacker can manipulate the system remotely, allowing for the execution of malicious scripts in the context of a user’s session. This exploitation has be...

A vulnerability has been identified in the Tenda AC18, specifically within the Firmware Upgrade Handler component located at /cgi-bin/upgrade. This flaw arises from insufficient verification of data authenticity due to a manipulation of the upgradeFile argument. As a result, attackers could poten...

A vulnerability has been identified in Opixido OCMS affecting its Admin TUI component. An issue exists in the 'admin/TUI/index.php' file, where improper handling of input within an unknown function allows for cross site scripting (XSS) attacks. This vulnerability can be exploited remotely, enabli...

A security vulnerability has been identified in the Edimax BR6478ACV2 router, specifically within the formPPTPSetup function found in the device's web interface. An attacker can exploit this vulnerability by sending specially crafted arguments related to the pptpUserName parameter, potentially le...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...