Publicly Disclosed
PoC Exploits

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This issue affects the function Exam::startExam of the file exam.php of the component Exam Module. The manipulation of the argument topicid results in sql injection. The attack...

A code injection vulnerability has been identified in the WongKinYiu yolov9 project, specifically within the DetectMultiBackend.__init__ function in models/common.py. This flaw arises from improper handling of argument names and stride, allowing for potential remote code execution by attackers. T...

A SQL Injection vulnerability exists in the Kishan0725 Hospital Management System, specifically within the Appointment Cancellation Handler function located in admin-panel.php. This weakness allows attackers to manipulate the argument ID in the mysqli_query function, potentially leading to unauth...

The go-git library, a pure Go implementation of Git, has a vulnerability related to improper sanitization of reference names before they are used to construct on-disk paths. As a result, an attacker could craft a malicious reference name containing directory-traversal sequences, allowing files to...

A Cross Site Scripting vulnerability has been identified in the Extra-Networks Card Builder component of AUTOMATIC1111's stable-diffusion-webui, specifically in the read_metadata_from_safetensors function within modules/sd_models.py. This flaw allows attackers to manipulate the __metadata__.sshs_...

A code injection vulnerability exists in the AUTOMATIC1111 stable-diffusion-webui software that affects versions up to 1.10.1. The issue lies within the get_obj_from_str function of the sd_models.py file, specifically during model instantiation. This vulnerability allows remote attackers to injec...

A vulnerability exists in the AUTOMATIC1111 Stable-Diffusion-WebUI, affecting versions up to 1.10.1, specifically in the read_metadata_from_safetensors function located in the modules/sd_models.py file. This vulnerability allows remote attackers to manipulate the header length field, resulting in...

A cross-site scripting vulnerability exists in the Card Builder module of the AUTOMATIC1111 Stable Diffusion Web UI, specifically in the function create_item_html located in the file modules/ui_extra_networks.py. This issue arises from improper handling of the 'filename' argument, allowing attack...

The Snac2 application prior to version 2.93 contains a vulnerability in the JSON loader function _xs_json_load_lexer(), which can be exploited by unauthenticated remote attackers. By crafting a specific POST request with a JSON string containing a null escape sequence, an attacker can overflow he...

Libtta versions up to 2.3 contain a divide-by-zero vulnerability within the function tta_decoder_init_get_info(). This flaw can be exploited by attackers to crash various applications, including the bundled tta console tool, by supplying a .tta file with an unvalidated zero sample rate. The attac...

The vulnerability in SMPEG affects versions up to 2.0.0, allowing attackers to exploit an integer underflow in the stream_header() function. By declaring an undersized packet length, attackers can manipulate the packet_size, potentially leading to a crash of the application through an assertion f...

The libmng library, up to version 2.0.3, suffers from a heap-based buffer overflow vulnerability in the mng_read_ordr() function. This issue arises because the sizes of the ORDR entry buffers are determined by 5-byte on-wire records, rather than fitting in standard 8-byte in-memory entries. Attac...

Schism Tracker versions up to 20260524 are susceptible to a heap out-of-bounds write due to improper handling in the fmt_ult_load_song() function. This vulnerability occurs when a crafted .ult module is used to manipulate the sample count, leading to overwriting the instruments pointer array. Con...

A cross site scripting vulnerability has been discovered in the Blood Bank Management System version 1.0.0, specifically within an unknown function in the file /abs.php. This weakness allows remote attackers to manipulate the 'Search' argument, facilitating the injection of harmful scripts into w...

The Modern Events Calendar Lite and Pro plugins for WordPress are prone to a SQL injection vulnerability due to inadequate sanitization and escaping of user-supplied input in SQL statements. This flaw allows authenticated users with minimal privileges, such as subscribers, to manipulate the SQL q...

The WP Photo Album Plus plugin for WordPress prior to version 9.2.11.002 contains a flaw that permits unauthenticated attackers to execute arbitrary JavaScript through category navigation values. By injecting malicious scripts, an attacker can manipulate the behavior of gallery breadcrumb links. ...

The Modern Events Calendar Lite plugin for WordPress prior to version 7.37.0 lacks crucial security checks, permitting authenticated users, including those with minimal privileges, to retrieve sensitive information such as names, email addresses, transaction IDs, and payment amounts associated wi...

The Modern Events Calendar Lite plugin for WordPress prior to version 7.36.4 contains a significant security flaw allowing authenticated users with the Subscriber role to alter the title, content, and excerpt of various posts, pages, and custom post types without proper authorization checks. This...

The AI Engine WordPress plugin prior to version 3.7.9 is susceptible to an improper access control vulnerability. This allows users with elevated roles, such as Editor or higher, to exploit the media action functionalities. The flaw permits these users to delete any post type indiscriminately, in...

The AI Engine plugin for WordPress versions before 3.7.9 contains a security flaw that fails to ensure user authorization during AI media management tasks. This oversight permits users with an Editor role or higher to alter or edit posts they should not have permission to access, potentially lead...

The Salon Booking System WordPress plugin prior to version 10.31.11 has a significant security flaw where an unauthenticated user can access sensitive REST API endpoints. This oversight allows any authenticated user, including those with low-level permissions, to view all discount coupons set up ...

The Salon Booking System plugin for WordPress prior to version 10.31.11 is susceptible to an arbitrary file retrieval vulnerability. This occurs due to insufficient validation of user-supplied image URLs, enabling users with Salon Staff privileges or higher to manipulate the server into accessing...

The Tasty Recipes Lite plugin for WordPress has a significant flaw, affecting versions prior to 1.2.11. It fails to properly verify user capabilities during the creation, renaming, and deletion of taxonomy terms. Consequently, users with minimal permissions, such as Contributors, can perform unau...

The Salon Booking System plugin for WordPress, prior to version 10.31.11, contains a significant security flaw that allows users with the custom salon staff role to maliciously assign arbitrary capabilities to other accounts while editing customer details. This potential for privilege escalation ...

The Salon Booking System plugin for WordPress, prior to version 10.31.11, contains a significant flaw that permits users assigned with the Salon Staff or Salon Worker roles to modify other users' roles indiscriminately. This includes the ability to demote users, including administrators, to a cus...

The Otter Blocks plugin for WordPress fails to properly validate user-supplied return URLs before utilizing them in the Stripe Checkout session process. This flaw permits unauthenticated attackers to exploit the functionality, potentially redirecting users to arbitrary external sites upon complet...

The PickPlugins Product Designer for WooCommerce lacks proper capability checks and has an inverted nonce validation mechanism. This allows unauthorized users to submit data, potentially inserting malicious design template information into the metadata of any post on the site, further compromisin...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A security flaw exists in the Scheduled Restore component of David-Crty Databasement that allows unauthorized access due to improper validation in the SaveScheduledRestoreRequest.php file. By manipulating the argument schema_name, remote attackers can exploit this vulnerability, leading to potent...

A vulnerability has been identified in OpenCATS 0.10.0 within the processLogin function of the CareersUI.php module, which improperly restricts excessive authentication attempts. This flaw potentially allows remote attackers to exploit the system under complex conditions. The maintainers have int...

The vulnerability arises from improper escaping of output in the mod_rewrite module of Apache HTTP Server versions 2.4.59 and earlier. This flaw allows attackers to manipulate URL mappings, potentially leading to unauthorized access to filesystem locations. These locations, while permitted for se...

A SQL Injection vulnerability exists in the MySQLDB::topicslist function within the exammanger.php file of the AJAX Endpoint in the itsmeravitejak Online-Examination-System. This flaw allows remote attackers to manipulate the 'subject' argument, enabling unauthorized access to the database. Given...

A significant SQL injection vulnerability exists in the itsmeravitejak Online-Examination-System affecting several functions within the MySQLDB database management. This vulnerability allows unauthorized remote attackers to manipulate query arguments, specifically 'id', 'user', and 'topic', poten...

The Grid plugin developed by Theme-one is susceptible to a code injection vulnerability that allows unauthorized command execution. This flaw can be exploited by attackers to execute arbitrary commands on the host server, leading to potential data breaches and system compromise. It affects all ve...

A security weakness in the itsmeravitejak Online-Examination-System has been detected, specifically within the subjectsdb.php file. The flaw allows attackers to manipulate parameters such as query, qtype, sortname, and sortorder, potentially leading to SQL injection attacks. The vulnerability can...

A vulnerability has been identified in the admin functionality of the itsmeravitejak Online-Examination-System, specifically within the isAdmin function found in admin/admin.php. This flaw allows for remote manipulation that leads to missing authentication, presenting a significant security risk....

A vulnerability in GitLab's CI/CD configuration could permit an unauthenticated attacker to execute arbitrary code on the server. This exploit arises from insufficient validation of a specially crafted regular expression. Affected versions include GitLab CE/EE 19.2 prior to 19.2.8, 19.3 prior to ...

A vulnerability has been identified in makeplane Plane affecting the API Endpoint component. The vulnerability arises from the manipulation of the 'X-Forwarded-For' HTTP header, which could allow an attacker to exploit the system by introducing untrusted inputs into critical security decisions. T...

The Login with Phone Number plugin by Hamid Alinia is susceptible to an improper privilege management vulnerability. This vulnerability enables attackers to escalate privileges, providing them unauthorized access to restricted areas of the application. It primarily affects versions from n/a up to...

A security flaw has been identified in the THU-MIG yoloe up to main commit 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This vulnerability affects the AutoBackend Model Loading component's eval function located in the file ultralytics/nn/autobackend.py. The improper handling of arguments such as img...

A vulnerability in the Linux kernel related to posix CPU timers can lead to a use-after-free condition due to a race in non-leader exec() scenarios. When a timer associated with a process is deleted while concurrently executing an exec() command, it can cause access to freed memory. Specifically,...

A vulnerability in the Linux kernel's IPv4 stack involves improper validation of checksum metadata, allowing packets with bad checksums to enter the system. This can lead to corruption of the network header through the skb_checksum_help function, potentially resulting in unpredictable behavior an...

A vulnerability in the Linux kernel related to posix CPU timers can lead to a use-after-free condition due to a race in non-leader exec() scenarios. When a timer associated with a process is deleted while concurrently executing an exec() command, it can cause access to freed memory. Specifically,...

A vulnerability in the Linux kernel's IPv4 stack involves improper validation of checksum metadata, allowing packets with bad checksums to enter the system. This can lead to corruption of the network header through the skb_checksum_help function, potentially resulting in unpredictable behavior an...

The Apache Lounge Windows distribution of the Apache HTTP Server contains a vulnerability caused by insecure installation directory permissions. Specifically, the default installation directory located on C:\ inherits write access for Authenticated Users, which could allow unauthorized modificati...

A vulnerability exists in Plex Media Server that allows for Server-Side Request Forgery (SSRF) through the '/player/timeline' endpoint. By exploiting this flaw, an attacker can manipulate the 'protocol' parameter using any X-Plex-Token value, enabling them to send POST requests to any external de...

BMC Helix Network Management prior to version 26.3.01 suffers from an authentication bypass vulnerability when configured with SAML single sign-on. This flaw allows unauthorized users to gain access as the local administrator by submitting an arbitrary password along with the administrator userna...

The Tandoor Recipes application has a vulnerability that allows an authenticated user to exploit an administrator-controlled AI provider URL, which bypasses important outbound-request security checks. This flaw, present in versions prior to 2.6.10, can enable attackers to connect to internal serv...

The ThirstyAffiliates plugin for WordPress versions prior to 3.12.1 contains a vulnerability in its link redirect tracking handler. This flaw allows unauthenticated users to bypass security controls, leading to the exposure of unpublished affiliate link URLs. Additionally, the lack of proper vali...

The WP User Manager plugin for WordPress suffers from a vulnerability that permits unauthenticated users to create functional accounts without completing the payment process during payment-gated registration. Specifically, if the payment step fails, the plugin fails to revert the account creation...