Publicly Disclosed
PoC Exploits

The vulnerability allows an attacker to send specially crafted payloads to Microsoft Office SharePoint, potentially resulting in unauthorized remote code execution. This security flaw occurs due to the improper handling of untrusted data. If exploited, it could enable malicious actors to execute ...

An authentication bypass vulnerability exists in the Check Point SmartConsole that enables an unauthenticated attacker to obtain a login token for the application. This allows the attacker to authenticate with full administrative privileges, giving them the ability to alter security policies and ...

The sigstore-js library allows for interactions with Sigstore services but contains a vulnerability where the getRegistryCredentials() function can inadvertently select incorrect credentials. This occurs because the function checks for substring matches with the target registry, rather than ensur...

A buffer overflow vulnerability exists in the httpd daemon of TP-Link TL-WR841N V12 (firmware version 3.16.9) devices, allowing an authenticated remote attacker to execute arbitrary code. This can be exploited through a specially crafted GET request directed at the System Tools page, potentially ...

A cryptographic issue has been identified in IBERMATICA RPS version 2019, allowing unauthorized access to sensitive data. By downloading the log file, an attacker can retrieve SQL queries in plaintext, exposing password hashes encrypted with the AES-CBC-128 bit algorithm. These hashes can be decr...

A race condition vulnerability exists in the Linux kernel that can arise when the NEWTFILTER and DELFILTER actions are executed concurrently. This flaw may lead to a use-after-free (UAF) scenario, resulting in system instability or potential exploitation. The issue was addressed by modifying the ...

A stored Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter's Media Manager due to inadequate validation and sanitization of SVG files. An authenticated user with minimal privileges can upload a malicious SVG file embedded with JavaScript. When administrators view the file, the malic...

The vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows unauthenticated attackers to chain two API endpoints. This exploitation can occur via the /api/v1/auto_login endpoint, which generates SUPERUSER tokens for any caller, in conjunction with the /api/v1/validate/code endpoint...

The TinyWeb server, through version 0.0.8, is susceptible to a path traversal vulnerability that enables unauthorized attackers to access arbitrary files on the server. By exploiting the vulnerability, attackers can manipulate the URL path using '../' sequences, which are directly concatenated to...

NGINX Plus and NGINX Open Source are impacted by a vulnerability in the ngx_stream_ssl_module that arises from improper management of revoked certificates. When both ssl_verify_client and ssl_ocsp directives are enabled, the system may incorrectly allow a TLS handshake to proceed even if an OCSP ...

TinyWeb versions up to 0.0.8 are vulnerable due to a null pointer dereference issue that can be exploited by unauthenticated remote attackers. By sending a malformed HTTP request containing an invalid version string, attackers can trigger a failure in the HttpParser::execute() function. This fail...

TinyWeb, up to version 0.0.8, has a vulnerability that enables unauthenticated attackers to cause significant memory consumption by sending standard HTTP requests. Each request triggers the `HttpParser::execute()` function, which allocates various objects such as Url and HttpHeaders without appro...

Rouille versions 0.3.3 to 3.6.2 are susceptible to an HTTP request smuggling issue. This vulnerability enables remote attackers to circumvent access control mechanisms by injecting bare line feed characters (0x0A) into the request header values. These headers are then sent to upstream connections...

Rouille, a HTTP server framework, has a vulnerability in versions 0.3.3 through 3.6.2 that allows remote attackers to exploit improper header forwarding in its proxy implementation. This flaw occurs when the proxy forwards the client's Transfer-Encoding header to upstream servers without proper m...

Rouille, a web framework by Theopaid, is susceptible to an HTTP response splitting vulnerability that affects versions 0.4.0 through 3.6.2. This security issue arises when attackers embed carriage return (0x0D) or line feed (0x0A) bytes into user-controlled inputs. Such manipulation can allow the...

Rouille versions 0.1.6 through 3.6.2 contain a reachable assertion vulnerability in the Request::remove_prefix function. This flaw enables remote attackers to exploit specific characteristics in crafted percent-encoded URLs, leading to server crashes. When a request is made with a decoded path th...

The tiny-http library, up to version 0.12.0, is susceptible to an HTTP header injection vulnerability. Due to inadequate validation in its header parsing and serialization processes, attackers can inject carriage return (0x0D) and line feed (0x0A) characters into HTTP header values during both re...

The tiny-http library, up to version 0.12.0, is susceptible to an HTTP request smuggling vulnerability due to improper handling of the Transfer-Encoding header. Attackers can exploit this flaw by sending crafted Transfer-Encoding headers, leading tiny-http to incorrectly parse requests and genera...

This vulnerability allows unauthorized command execution in the GPU micronode, leading to potential memory corruption when a specific sequence of commands is executed. Attackers could exploit this weakness to disrupt system functionality or gain access to sensitive areas of memory, posing risks t...

The vulnerability present in Let's Chat versions 0.3.0 through 0.4.8 allows any authenticated user to archive any room on the server via an unrestricted DELETE request to the rooms handler, bypassing necessary ownership checks. This exploitation lets malicious users permanently remove access to p...

The Let's Chat application versions 0.3.0 through 0.4.8 are exposed to a broken access control vulnerability that permits authenticated users to download file attachments from private and password-protected rooms they do not belong to. This vulnerability arises from insufficient checks in the fil...

A null dereference vulnerability has been identified in versions 0.4.0 through 0.4.8 of Let's Chat. This flaw allows authenticated attackers to crash the server by providing a malformed 24-character hexadecimal string as the room parameter in a GET /messages request. If the specified room does no...

Camaleon CMS versions 2.1.1 through 2.9.1 exhibit a security flaw that allows users with specific permissions to execute arbitrary Ruby code. This vulnerability arises from the 'select_eval' custom field type, which permits the storage of malicious Ruby expressions. When a post edit page is rende...

A vulnerability has been identified in the nextlevelbuilder GoClaw product, specifically in the ExecTool.Execute function located in the tools_invoke.go file of the jq Handler component. This flaw allows unauthorized parties to exploit the vulnerability remotely, leading to potential information ...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...

n8n, an open-source workflow automation platform, has a vulnerability that allows authenticated users to exploit crafted expressions within workflow parameters. This can lead to unintended system command execution on the host machine. Versions 2.10.1, 2.9.3, and 1.123.22 have addressed these issu...

The vBulletin platform, including versions 5.x up to 5.7.5 and 6.x up to 6.2.1, is susceptible to an eval injection vulnerability found in the vB5_Template_Runtime::runMaths() method. This issue can be leveraged by unauthenticated attackers who submit specially crafted inputs through the pagenav[...

The vulnerability allows an attacker to exploit an XSS flaw through the naming of uploaded files in SPIP versions prior to 4.1.14 and 4.2.8. This impacts users as malicious scripts can be injected via user-uploaded file names, potentially leading to unauthorized access or data manipulation. Affec...

The FluentCart A New Era of eCommerce WordPress plugin, prior to version 1.4.0, is susceptible to an improper access control vulnerability. This flaw permits authenticated users to manipulate other users' subscriptions without authorization. Specifically, it fails to ensure that a subscription re...

The Tablesome Table plugin for WordPress, specifically versions prior to 1.1.31, has a significant vulnerability that allows unauthenticated users to perform malicious actions. This security flaw arises from the lack of necessary authentication, capability, or nonce checks within a specific AJAX ...

A vulnerability exists in the WPforms plugin for WordPress due to insufficient sanitization and escaping of parameters reflected in the admin page. This oversight may enable attackers to conduct reflected cross-site scripting attacks, targeting users with high-level access, including administrato...

The Event Tickets and Registration plugin for WordPress, prior to version 5.28.4, has a vulnerability where event titles are not appropriately sanitized before being logged in the ticket history. This oversight allows users with the Editor role or above to execute Stored Cross-Site Scripting atta...

The Quiz and Survey Master plugin for WordPress, prior to version 11.1.5, lacks proper capability checks, allowing users with contributor-level access or higher to delete output templates indiscriminately. This vulnerability can lead to unauthorized modifications and significant disruptions, part...

The TrueBooker WordPress plugin is susceptible to a vulnerability that allows unauthenticated attackers to reset passwords for any user account. This flaw exists because the plugin fails to properly validate account ownership during the password reset process. As a result, attackers can exploit t...

The ZTE File Manager contains a vulnerability in its FilePreViewActivity which allows third-party applications to invoke this activity and provide arbitrary file paths. This behavior could potentially enable unauthorized access to various sensitive files within system directories such as /data/da...

The vulnerability allows an attacker to send specially crafted payloads to Microsoft Office SharePoint, potentially resulting in unauthorized remote code execution. This security flaw occurs due to the improper handling of untrusted data. If exploited, it could enable malicious actors to execute ...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

Grav version 2.0.4 is susceptible to a remote code execution vulnerability that arises from the improper handling of callable strings in Blueprint::dynamicData(). This vulnerability allows authenticated users with specific permissions (admin.pages or api.pages.write) to inject malicious commands ...

The BookingPress Appointment Booking Pro plugin for WordPress prior to version 5.7.3 contains a vulnerability that fails to properly enforce REST API authentication. As a result, this oversight allows unauthenticated attackers to gain access to sensitive customer booking data and make unauthorize...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...

Ekushey Project Manager CRM versions up to 5.0 are susceptible to a stored cross-site scripting vulnerability. This flaw enables authenticated users to insert arbitrary HTML and JavaScript into the Reply Ticket field. Attackers can exploit this vulnerability by crafting malicious scripts that are...

Ekushey Project Manager CRM up to version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to input malicious HTML and JavaScript code via the Ticket Title field on the Create New Ticket page. This could lead to attackers being able to store and exec...

The Ekushey Project Manager CRM, up to version 5.0, is vulnerable to a stored cross-site scripting issue. This vulnerability allows authenticated users to enter malicious HTML and JavaScript code into the client Name field within the Edit Profile page without proper input sanitization. As a resul...

Ekushey Project Manager CRM version 5.0 has a vulnerability due to a missing uniqueness constraint that permits authenticated administrators to create multiple client accounts with the same email address. This flaw allows for conflicting account states where different passwords can be associated ...

The SAML Single Sign-On plugin for WordPress, developed by miniOrange, is vulnerable to an authentication bypass due to improper handling of the SAML Signature Algorithm attribute. The vulnerability arises when the `mo_saml_cast_key()` function directly utilizes the `SignatureMethod` attribute fr...

A vulnerability in NGINX Plus and NGINX Open Source arises when a map directive improperly utilizes regex matching in conjunction with string expressions referencing the map’s regex capture variables before the map output variable, or when non-cacheable variables are used under specific condition...

facil.io versions 0.7.5 and 0.7.6 contain a vulnerability in the HTTP/1.1 chunked transfer encoding parser. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted POST request with a negative chunk size value in the 'Transfer-Encoding: chunked' header. This manipu...

The facil.io framework versions 0.6.0 to 0.7.6 contain a vulnerability in the multipart body parser that can lead to a denial-of-service condition. An unauthenticated remote attacker can exploit this flaw by sending specially crafted multipart/form-data requests with a partial closing boundary. T...

The facil.io product through version 0.7.6 is susceptible to an integer underflow vulnerability within its multipart MIME body parser. This flaw allows unauthenticated remote attackers to exploit the server by sending a specially crafted Content-Disposition header with an empty field name. Such a...

A vulnerability has been identified in the Unitedbyai Droidclaw up to version 0.5.3, specifically in the Unsigned Scheduled Callback feature within the file server/src/routes/goals.ts. This issue allows for authorization bypass, enabling unauthorized access to functionalities. The complexity of e...