Publicly Disclosed
PoC Exploits

A vulnerability exists in the web administration interface of Chengdu Feiyuxing Technology's VW2100 and VEC10GP products, specifically in the add_expmac function. This flaw allows an attacker to manipulate the 'mac' argument, leading to OS command injection. Due to the nature of the vulnerability...

A vulnerability has been discovered in WebTorrent versions up to 2.8.5 and 3.0.21 affecting the getFileModtimes function within the file torrent.js component, specifically the File Path Handler. This weakness allows an attacker to exploit manipulated file.path arguments, leading to potential path...

A security vulnerability in the itsourcecode Airline Reservation System version 1.0 has been identified, allowing for SQL injection through manipulation of the 'ID' argument within the '/admin/manage_flight.php' file. This flaw enables remote attackers to execute unauthorized SQL commands, potent...

A serious OS command injection vulnerability affects Chengdu Feiyuxing Technology's VW2100 and VEC10GP products, specifically through the Weixin Auth Endpoint. Exploiting this vulnerability involves manipulating the 'extend' argument within the 'handle_wechat_cn_wifi' function located in the web ...

A vulnerability has been identified in the Relay Configuration API of aaPanel BillionMail up to version 4.9. An attacker can exploit this issue by manipulating the 'helo_name' argument, which can lead to remote injection attacks. Despite the vendor being notified of this concern, there has been n...

A significant vulnerability exists in the Apollo Studio Embeddable Explorer and Embeddable Sandbox, stemming from inadequate origin validation within their client-side code that processes window.postMessage events. This weakness allows a malicious website to forge messages to the embedding page, ...

A significant vulnerability exists in Logseq versions 2.0.1 and 2.0.2, specifically within the Local HTTP API's token validation function. This flaw enables unauthorized access due to missing authentication checks, potentially allowing attackers to exploit the application remotely. Despite notifi...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

The Advanced Appointment Booking & Scheduling WordPress plugin prior to version 2.7 is vulnerable due to a flaw in how it handles user registrations. It fails to check the user's registration settings before allowing account creation through a public shortcode. This oversight enables unauthentica...

The WP Duplicate plugin for WordPress, specifically versions up to 1.1.11, is susceptible to a significant security flaw where it fails to adequately verify request authentication values and does not properly validate the type or path of uploaded files. This oversight allows unauthenticated attac...

The GemBooking WordPress plugin prior to version 1.7.1 has a significant concurrency flaw. This vulnerability permits unauthenticated users to initiate multiple booking requests that can overlap for the same team member. By exploiting this issue, attackers can create simultaneous confirmed bookin...

The GemBooking plugin for WordPress, prior to version 1.7.1, is vulnerable due to inadequate verification of REST requests, potentially allowing users with the 'Staff' role to temporarily gain administrative privileges. This flaw can be exploited to delete arbitrary posts and alter critical site ...

The WooCommerce Stripe Payment Gateway plugin for WordPress prior to version 11.1.0 inadvertently stores customer account passwords in plaintext within order metadata during express checkout. This flaw allows anyone with access to the order data or the database to view sensitive information. Whil...

The UniPAY Payment Gateway for WooCommerce (versions prior to 2.4) contains an authorization flaw that allows unauthenticated attackers to exploit the order-received URL by supplying an arbitrary order ID. This vulnerability permits malicious actors to enumerate orders, potentially revealing sens...

The Event Tickets Manager for WooCommerce plugin fails to properly validate ticket-type pricing sent through unauthenticated AJAX requests when no ticket types are configured for a product. This vulnerability allows unauthenticated users to submit arbitrary prices, potentially allowing ticket sal...

The Vigilant WordPress plugin prior to version 2.11.0 contains a flaw that permits the circumvention of its two-factor authentication on non-default WordPress login forms. This allows attackers with knowledge of a valid user's password to authenticate as that user without completing the second au...

The Fusion Page Builder plugin for WordPress versions prior to 1.7.1 contains a security flaw that fails to validate whether users have ownership of the content they attempt to move to the trash. This oversight permits users with minimal privileges, such as those designated as Contributors, to in...

The WP BASE Booking of Appointments, Services and Events plugin for WordPress fails to adequately restrict access to certain user-creation functionalities. This oversight allows authenticated users with Subscriber-level permissions or higher to exploit the vulnerability by creating unauthorized a...

The Post Duplicator plugin for WordPress, prior to version 3.0.18, lacks proper validation of role capabilities due to ineffective permissions settings. This vulnerability permits a site administrator, who is not a Super Admin on a multisite environment, to inadvertently or maliciously assign arb...

The All-in-One Video Gallery plugin for WordPress prior to version 5.1.1 has a security flaw that fails to validate whether a video is password-protected. As a result, unauthenticated users can access and download media content, including secure files and links from platforms like YouTube and Vim...

The Post Duplicator plugin for WordPress, prior to version 3.0.18, is susceptible to a vulnerability that enables non-Super Admin site administrators within a multisite environment to modify arbitrary site options. This oversight may allow unauthorized users to alter critical settings, including ...

The Limit Login Attempts Security plugin for WordPress, prior to version 3.4.1, contains a flaw that allows an attacker to bypass the two-factor authentication mechanism. This occurs due to the plugin's failure to successfully validate the two-factor authentication step during the login process. ...

The EASY-JS-WPAPI Client for the WordPress REST-API prior to version 2.0 suffers from a serious security flaw that allows unauthenticated users to access stored administrator credentials. This vulnerability stems from the lack of proper authentication verification, which enables attackers to gain...

The Mail Debug for WooCommerce plugin, version 1.3.0, lacks essential authentication and capability checks on its email-logging functionality. This oversight allows unauthenticated users to access sensitive information, exposing the contents of every email sent by the site. Notably, this includes...

The Limit Login Attempts Security plugin for WordPress, prior to version 3.4.1, is vulnerable to an authentication bypass due to inadequate enforcement of two-factor authentication (2FA) on all login avenues. An attacker with knowledge of a user's password can exploit this vulnerability by using ...

The Grand Job plugin for WordPress, specifically versions up to 1.2.1, is vulnerable due to a flaw in its password reset verification process. This insufficient verification allows unauthorized users to manipulate or bypass the password update mechanism. As a result, attackers can gain control of...

The AZEXO Store Locator plugin for WordPress prior to version 1.4 is vulnerable due to a lack of capability and nonce checks on its AJAX actions. The plugin improperly sanitizes a request header that is utilized for constructing file paths. This oversight allows any authenticated user, including ...

The mView Douban Movie plugin for WordPress versions prior to 1.0.3 contains a vulnerability where it fails to validate the type, name, or source of files fetched remotely. This flaw allows authenticated users, including subscribers, to upload arbitrary PHP files to a web-accessible directory wit...

A vulnerability has been identified in SourceCodester Simple CRUD version 1.0, specifically within the app/register.php file. This security flaw allows remote attackers to perform SQL injection by manipulating the 'firstname' argument. Successful exploitation can result in unauthorized access to ...

A security issue has been found in the SourceCodester Online Leave Management System 1.0, specifically within the app/classes/Master.php file related to the Employee Avatar Upload Extension. The vulnerability allows attackers to execute unauthorized scripts in the context of a user's session by m...

The MP3 Audio Player WordPress plugin, prior to version 5.16, is prone to a cross-site scripting vulnerability that arises from improper escaping of an audio player shortcode attribute. This flaw enables users with Contributor-level access or higher to inject arbitrary JavaScript code. Such code ...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A vulnerability has been discovered in Tidelift moto versions up to 5.2.4, specifically within the AWS Batch Emulation component found in the file moto/batch/models.py. This vulnerability arises from improper management of privileges associated with the argument 'privileged/volumes', allowing an ...

A security flaw in Fengoffice’s File Handler component allows for server-side request forgery through the upload_document_image function. This vulnerability affects specific versions of Feng Office, enabling attackers to manipulate the 'url' argument. The issue can be exploited remotely, posing s...

A code injection vulnerability exists in the Translation Tool of Fengoffice, specifically within the write_translations function of the ToolController.class.php file. This vulnerability is triggered by manipulation of the 'lang' argument, enabling attackers to execute arbitrary code remotely. The...

A vulnerability exists in the Azeus Convene Board Management Portal where a malicious actor can manipulate the REDIRECT_URL argument within the /jsp/ge/dummy_launcher.jsp file. This allows for cross-site scripting attacks, which can be executed remotely. The exploit has been made publicly known, ...

The out-of-bounds read vulnerability in Windows Paint enables unauthorized attackers to potentially execute arbitrary code within a network context. This flaw could allow malicious entities to manipulate the application, leading to unauthorized actions being performed on affected systems. Users a...

A vulnerability exists in the Linux kernel that concerns the handling of shared skb fragments during the decryption process in ESP-in-UDP packets. When pages are attached from a pipe directly to an skb using MSG_SPLICE_PAGES, the kernel marked these SKBs with SKBFL_SHARED_FRAG, which plays a cruc...

An improper encoding or escaping of output vulnerability in Synology DiskStation Manager affects multiple versions, enabling remote attackers to potentially read or write arbitrary files. This may lead to unauthorized access and could facilitate denial-of-service attacks, compromising the system'...

A vulnerability exists in Microweber versions prior to 1.1.20 that permits an unauthenticated user to access the database containing user information. This occurs through a specific POST request to the user files module, enabling the exposure of sensitive data without requiring authentication. Or...

A use-after-free vulnerability exists in the Android Binder service, which could allow attackers to elevate privileges from an application to the Linux Kernel. Exploitation of this vulnerability does not require any interaction from the user; however, it necessitates either the installation of a ...

Craft CMS versions 4.0.0 to 4.18.8 and 5.0.0 to 5.11.1 contain an unauthenticated SQL injection vulnerability in the element search endpoint. This occurs when the attribute parameter is unsanitized and concatenated into the SQL query, which permits remote attackers to execute arbitrary SQL comman...

A vulnerability in Python's SSL module arises from the ssl.SSLContext.wrap_bio() not enforcing a valid server_hostname when hostname validation is enabled. This oversight can lead to a situation where certificate verification appears successful, despite being improperly configured. Without a vali...

The SQL::Abstract for Perl, prior to version 2.000003, contains a vulnerability that allows an attacker to exploit SQL injection through arrayref column values during insert and update operations. With the default configuration disabling the array_datatypes option, these operations can treat an u...

An out-of-bounds write vulnerability has been identified in Apple iOS and macOS products, leading to potential memory corruption when processing maliciously crafted PDF files. The issue arises due to insufficient bounds checking, which may allow attackers to exploit the vulnerability and execute ...

A vulnerability in Jinher OA C6 affects the function within the ProjectAfficheManage.aspx file, allowing an attacker to exploit SQL injection through the argument ProjID. This flaw enables remote attackers to execute arbitrary SQL commands, leading to unauthorized access to the database. Despite ...

A vulnerability exists in the FlowCI flow-core-x product that exposes its LocalFileManager component to path traversal attacks. This issue arises from how the component handles the input for the fileName parameter within its functionalities, such as exist, save, read, and remove operations. Attac...

A vulnerability in FlowCI's flow-core-x component affects versions up to 1.23.49, specifically within the FileHelper.unzip function. This issue allows attackers to exploit path traversal, potentially leading to unauthorized file access from remote locations. The complexity of executing this attac...

A vulnerability within the Performance Events system of the Linux kernel permits a heap out-of-bounds write due to an overflow in the read_size of a perf_event. This flaw can potentially be exploited to escalate local privileges, highlighting the importance of timely updates. Users are advised to...