Publicly Disclosed
PoC Exploits

The mrubyc environment, in versions prior to 4.0.0, has a vulnerability that allows attackers to exploit a null pointer dereference in the op_enter() handler located in src/vm.c. By crafting malicious .mrb bytecode files with OP_ENTER instructions at the top level, an attacker could cause the emb...

A vulnerability has been identified in apport-cli versions 2.26.0 and earlier, which may allow a local attacker to escalate privileges under specific conditions. If a system is misconfigured to allow unprivileged users to execute sudo with apport-cli as the command, and if appropriate settings fo...

The Arm Mali GPU kernel driver exhibits a significant vulnerability allowing unprivileged users to obtain read/write access to restricted pages. This flaw can result in privilege escalation or cause a denial of service through memory corruption. The affected versions include various releases of t...

Dolibarr versions prior to 24.0.1 are susceptible to an authorization bypass vulnerability that enables unauthenticated attackers to read sensitive files. By exploiting a flaw in the document storage endpoints, attackers can leverage a crafted 'hashp' parameter to bypass token validation in criti...

Dolibarr versions prior to 24.0.1 exhibit a vulnerability tied to the sqlfilters API query parameter, resulting in a case-sensitive denylist bypass. Authenticated attackers can exploit this flaw by entering uppercase variants of denylist-protected field names, thus circumventing the protective ch...

A vulnerability in GitLab CE/EE allows unauthenticated users to read arbitrary files due to inadequate path confinement and a lack of proper authentication checks in the repository commits API. This issue affects GitLab versions 18.7 prior to 19.1.8, 19.2 prior to 19.2.6, and 19.3 prior to 19.3.2...

The Arm Mali GPU kernel driver is vulnerable due to mishandled GPU memory operations, which allows unprivileged users to access freed memory. This issue affects multiple versions across the Bifrost, Valhall, and Midgard architectures, posing potential risks for system integrity and data security.

The XML Feed Manager for WooCommerce plugin, prior to version 3.1.1, suffers from improper access control issues. Specifically, it fails to limit which object methods can be invoked by the product shortcode. This oversight allows users with contributor-level access to delete any WooCommerce produ...

The WPBot plugin for WordPress prior to version 8.6.0 is susceptible to an information disclosure vulnerability. This issue arises from the lack of proper capability and nonce checks on the AJAX action responsible for listing stored chat sessions. As a result, unauthenticated attackers can exploi...

The WPBot plugin for WordPress prior to version 8.5.7 is vulnerable to unauthorized access due to the lack of authorization and nonce checks on several AJAX actions. This flaw allows unauthenticated attackers to exploit these actions to relay requests to configured third-party AI providers, effec...

The Rox Appointment Booking plugin for WordPress, prior to version 1.2.0, contains a vulnerability that fails to adequately verify the order total and the chosen payment method against its internal server-side pricing. This oversight enables unauthenticated attackers to create confirmed bookings ...

The Rox Appointment Booking plugin for WordPress prior to version 1.2.3 lacks proper authorization checks on its endpoint that retrieves booking confirmation details. This oversight permits unauthenticated users to enumerate sequential booking identifiers, thereby gaining access to sensitive cust...

The Sprout Invoices WordPress plugin before version 20.8.16 is vulnerable to an authorization bypass flaw in its AJAX actions. This vulnerability allows authenticated users, including those with lower privileges such as subscribers, to overwrite private notes on records that do not belong to them...

The Add User Autocomplete plugin for WordPress versions prior to 1.2 is susceptible to improper access control. It fails to verify capabilities or nonce checks before allowing the creation of a pending site-membership invitation with a role provided by the user. This vulnerability enables any aut...

The YayPricing WordPress plugin prior to version 3.5.7 is susceptible to an authorization bypass vulnerability that affects its REST API. It fails to adequately check user permissions for a specific REST route responsible for storing pricing rules. As a result, unauthorized users with subscriber-...

The Zonify WordPress plugin prior to version 1.0.5 has a significant security flaw that lacks the required capability or authentication checks. This vulnerability enables attackers to access the stored account login token without proper authentication. As a result, unauthorized users can exploit ...

The Rox Appointment Booking plugin for WordPress is susceptible to an authorization bypass, which allows unauthorized users to modify the holiday schedule settings. Specifically, the plugin does not enforce capability or authorization checks when saving its holiday schedule. This flaw can enable ...

The WP Highlight Box plugin allows for the integration of reusable content blocks through shortcodes. However, versions up to and including 1.0 lack proper escaping for certain shortcode attributes prior to rendering on a page. This oversight can lead to stored cross-site scripting vulnerabilitie...

The WP Component WordPress plugin prior to version 2.2.4 has a severe security flaw that permits unauthenticated users to execute actions without proper capability or nonce checks. Attackers can manipulate the option name and value from the incoming requests, making it possible to overwrite criti...

The wpstorecart plugin for WordPress, up to version 5.0.7, is susceptible to a vulnerability that allows direct, unauthenticated access to a bundled add-on. This add-on fails to adequately restrict deserialized user-supplied input, which can enable unauthenticated attackers to inject arbitrary PH...

The piclect WordPress plugin version 1.0 has a critical file upload vulnerability that allows unauthenticated attackers to upload arbitrary files. Due to a lack of validation for the name and type of uploaded files, attackers can exploit this weakness to write files to a publicly accessible direc...

The Album Cover Finder plugin for WordPress, up to version 0.7.0, contains a security flaw that fails to adequately sanitize and escape user input within SQL queries. This oversight allows unauthenticated attackers to execute arbitrary SQL commands, potentially exposing sensitive database informa...

The Masteriyo LMS plugin for WordPress, prior to version 3.4.1, inherently lacks mechanisms to verify whether a user has the rightful ownership of requested records. This flaw permits users assigned the instructor role to download unrestricted content and metadata associated with any posts, inclu...

The BEAR WordPress plugin versions earlier than 1.2.2 suffers from a CSRF vulnerability due to improper nonce verification when saving meta field configurations. This flaw permits attackers to manipulate settings by duping an authenticated administrator into visiting a malicious link, potentially...

The BEAR WordPress plugin prior to version 1.2.2 lacks adequate ownership validation on several handlers. This oversight allows users with restrictions to leverage user-supplied identifiers to access confidential product data. Consequently, users can inadvertently view product information belongi...

A vulnerability in the BEAR WordPress plugin, prior to version 1.2.2, allows attackers to exploit a lack of CSRF nonce verification and user capability checks. This can enable unauthorized modifications of taxonomy terms when a privileged user is tricked into visiting a malicious page, potentiall...

The Masteriyo LMS plugin for WordPress versions prior to 3.4.1 is vulnerable due to a failure to properly sanitize and escape course field inputs in the course editor. This flaw permits users assigned the instructor role to carry out Stored Cross-Site Scripting (XSS) attacks, potentially affectin...

The WPBakery Page Builder plugin for WordPress lacks proper Cross-Site Request Forgery (CSRF) protection in its template import functionality. This oversight allows an attacker to exploit this vulnerability by crafting a malicious request, enabling an authenticated administrator to unintentionall...

The BE REST Endpoints Plugin for WordPress prior to version 1.0.0 is susceptible to an authorization bypass vulnerability. This flaw permits unauthorized users to read, create, update, and delete widgets without any authentication checks. Furthermore, the plugin fails to sanitize input values, ma...

The Masteriyo LMS WordPress plugin versions prior to 3.4.1 contain a deserialization vulnerability that permits unauthorized execution of arbitrary PHP objects. This security flaw allows users with minimal access to insert user-supplied metadata into the application, which can be exploited to exe...

The DS Ad Rotator plugin for WordPress versions up to 0.8 is susceptible to a serious vulnerability due to the lack of capability checks, nonce validation, and file-type restrictions in its image upload handler. This oversight allows unauthenticated attackers to upload arbitrary files, including ...

The Temporary Login Without Password plugin for WordPress, prior to version 1.9.9, lacks robust verification for user permissions. This deficiency enables an administrator of a single site within a multisite network to unwittingly grant super admin rights to an unauthorized user. Additionally, it...

The Temporary Login Without Password plugin for WordPress versions prior to 1.9.9 allows temporary users to create and retain Application Passwords. This vulnerability permits such users to maintain access via REST and XML-RPC even after temporary credentials should have expired or been revoked b...

The Yogeta WP Cloud WordPress plugin prior to version 1.0 is susceptible to a file retrieval vulnerability. This flaw arises from the plugin's failure to properly validate user-supplied file paths before using them in file-read functions on a public endpoint, which does not implement any form of ...

The Gpx2Graphics WordPress plugin, up to version 0.3, is susceptible to a cross-site request forgery (CSRF) vulnerability that allows attackers to bypass file upload restrictions. This exploitation occurs because the plugin lacks necessary CSRF checks and type validation for uploaded files. As a ...

The SAMO Forms plugin for WordPress, prior to version 1.0.0, contains a vulnerability that fails to properly sanitize and escape user input in SQL queries during various unauthenticated actions. This flaw enables attackers to potentially execute SQL injection attacks, compromising the integrity a...

The SureRank SEO WordPress plugin, prior to version 1.10.1, inadvertently exposes users' registered email addresses through structured data on public pages. This vulnerability enables unauthenticated visitors to retrieve email addresses of any user who has published content, compromising their pr...

The Frontegg SAML SSO plugin for WordPress, up to version 1.0.1, contains a significant vulnerability that fails to properly validate the signature and issuer of SAML authentication responses. This oversight permits malicious actors to gain unauthorized access to user accounts, including those wi...

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable due to its failure to validate payment confirmation before marking bookings as paid. An attacker can exploit this flaw by crafting a public, unauthenticated booking request, leveraging any payment gateway named in...

The Booking for Appointments and Events Calendar plugin for WordPress fails to properly verify the user's permissions when editing customer or employee records. This oversight allows individuals with management permissions to change the password and email of other users’ WordPress accounts, poten...

The WebTotem Backups plugin for WordPress prior to version 1.0.1 contains a vulnerability where it fails to validate user-supplied file paths and does not adequately check the permissions of users making requests. This oversight allows authenticated users, even those with the lowest privileges (l...

The CODE MONKEYS PROPOSALS WordPress plugin versions up to 1.0.1 suffers from a critical security issue due to its failure to properly validate user-supplied file paths when deleting files. This flaw allows authenticated users, including those with limited permissions such as subscribers, to dele...

The Custom Menu Wizard Widget for WordPress, up to version 3.3.1, is susceptible to Cross-Site Scripting (XSS) attacks due to insufficient sanitization and escaping of multiple shortcode attributes. This security flaw allows users with contributor-level access and higher privileges to inject arbi...

A race condition vulnerability exists in Windows Push Notifications that allows an authorized attacker to exploit improper resource synchronization. This flaw provides the potential for local privilege escalation, enabling attackers to gain elevated access to system functions. It is crucial for u...

Marimo, a reactive Python notebook, exhibits a significant security vulnerability prior to version 0.23.0. The terminal WebSocket endpoint (/terminal/ws) allows unauthenticated access, enabling attackers to gain a complete pseudo-terminal shell and execute arbitrary commands on the host system. U...

A vulnerability in GitLab CE/EE allows unauthenticated users to read arbitrary files due to inadequate path confinement and a lack of proper authentication checks in the repository commits API. This issue affects GitLab versions 18.7 prior to 19.1.8, 19.2 prior to 19.2.6, and 19.3 prior to 19.3.2...

OpenPanel versions prior to 2.3.0 are susceptible to an unauthenticated server-side request forgery (SSRF) vulnerability affecting the /misc/favicon and /misc/og endpoints. This flaw allows attackers to manipulate the url parameter, leading the API to retrieve information from arbitrary internal ...

A vulnerability in GitLab CE/EE allows unauthenticated users to read arbitrary files due to inadequate path confinement and a lack of proper authentication checks in the repository commits API. This issue affects GitLab versions 18.7 prior to 19.1.8, 19.2 prior to 19.2.6, and 19.3 prior to 19.3.2...

A remote code execution vulnerability found in React Server Components allows attackers to exploit improperly handled payloads. This issue affects versions 19.0.0 through 19.2.0, compromising server function endpoints through unsafe deserialization of HTTP request payloads. As a result, this flaw...

A vulnerability in GitLab CE/EE allows unauthenticated users to read arbitrary files due to inadequate path confinement and a lack of proper authentication checks in the repository commits API. This issue affects GitLab versions 18.7 prior to 19.1.8, 19.2 prior to 19.2.6, and 19.3 prior to 19.3.2...