Publicly Disclosed
PoC Exploits

LibreNMS versions prior to 26.8.0 are susceptible to an authentication bypass vulnerability in the REST API. This issue arises when attackers exploit MySQL type coercion by submitting small integer values (0 through 9) instead of string tokens. By leveraging this weakness, unauthorized individual...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The Smart Popup by Supsystic plugin for WordPress before version 2.0.2 is vulnerable to template injection due to improper handling of template delimiters. An authenticated administrator can exploit this vulnerability by injecting arbitrary template expressions into a popup text block. These inje...

The Essential Addons for Elementor WordPress plugin prior to version 6.8.7 has a flaw that allows users to register and log in without required administrator approval through its email one-time-password registration flow. This vulnerability can permit unauthorized access when the features are ena...

The Royal Elementor Addons plugin for WordPress, prior to version 1.7.1070, contains a security flaw where it fails to properly validate form field values before incorporating them into email recipient addresses. This issue allows unauthenticated attackers to alter the intended recipient list and...

The Sadad QA Payment Plugin for WordPress, up to version 1.28, has a serious flaw in its payment notification handling. The plugin fails to properly verify the authenticity of incoming payment notifications due to the insecure handling of the merchant secret, which is left empty by default. This ...

The BitPay Gateway for WooCommerce WordPress plugin prior to version 4.1.3 has a serious flaw where it fails to properly bind transaction confirmations to their respective orders. This oversight allows an attacker with access to a legitimate low-value transaction to falsely mark any higher-value ...

NGINX Open Source contains a significant vulnerability in its HTTP/3 QUIC module. When this module is enabled, an unauthenticated remote attacker might exploit conditions beyond their control to send specially crafted HTTP/3 requests that can reopen a QPACK encoder stream. This situation can lead...

The URL Shortify plugin for WordPress suffers from an Open Redirect vulnerability due to inadequate validation of the 'redirect_to' parameter within its promotional dismissal handler. This flaw allows unauthorized attackers to create deceptive links that redirect unsuspecting users to potentially...

Gitea versions prior to 1.16.7 are susceptible to a remote code execution vulnerability caused by the improper escaping of the `git fetch` command's remote parameter. This flaw enables an attacker to execute arbitrary code on the server by crafting a malicious request. It is crucial for users of ...

GNU Bash versions up to 4.3 are vulnerable to a code injection flaw due to the mishandling of trailing strings after function definitions in environment variables. This vulnerability enables remote attackers to execute arbitrary code by crafting specific environment variables under various condit...

An unauthenticated remote code execution vulnerability exists in YOOtheme Pro versions 5.0.0 to 5.0.52 due to improper binding of image operations and output destinations in its publicly accessible image transformation handler. This flaw allows an attacker to exploit a legitimate public image URL...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The Recipe Card Blocks Lite plugin for WordPress prior to version 3.6.4 is vulnerable to SQL injection attacks. This vulnerability arises from the plugin's failure to properly sanitize and cast a block and shortcode attribute before incorporating it into SQL queries. As a result, authenticated us...

The Customer Engagement System plugin for WordPress prior to version 2.0.2 contains a significant access control vulnerability. This flaw allows unauthenticated users to access its MailChimp interest-group functionality. Furthermore, the plugin fails to validate the supplied API key, enabling the...

The WP Roster plugin for WordPress prior to version 2.35 contains a flaw that does not enforce capability or nonce checks during its AJAX actions. This vulnerability enables unauthenticated attackers to exploit the plugin, potentially leading to unauthorized deletion of user accounts associated w...

The PayPlug for WooCommerce plugin prior to version 3.1.1 is vulnerable due to its lack of capability and ownership checks on unauthenticated AJAX actions that utilize a caller-supplied order identifier. This flaw permits unauthorized attackers to manipulate, read, and permanently delete WooComme...

The GeoDirectory plugin for WordPress is susceptible to an improper access control vulnerability that allows users with the Contributor role or higher to access and disclose the content, custom fields, and status of other users' listings. This occurs when the plugin renders a listing without veri...

The GeoDirectory WordPress plugin prior to version 2.8.196 is susceptible to a Stored Cross-Site Scripting vulnerability. This occurs due to improper escaping of a post badge shortcode attribute within a JavaScript context before it is inserted into an inline event handler. This flaw allows users...

The Customer Engagement System WordPress plugin prior to version 2.0.2 is vulnerable to SQL injection attacks due to improper handling of user input. The plugin constructs SQL statements for storing visibility rules by concatenating request-supplied ID values directly into an INSERT statement wit...

The Royal MCP WordPress plugin prior to version 1.5.10 contains an object-level permission check vulnerability. This issue allows users with contributor-level access to duplicate requested pages without appropriate restrictions. Consequently, these users can read the full content of any private o...

The Royal MCP WordPress plugin prior to version 1.5.10 lacks proper object-level or post-type authorization checks in its search functionality. This oversight enables authenticated users, specifically those with subscriber privileges, to access and disclose titles and contents of non-public entri...

The MP3 Audio Player WordPress plugin, prior to version 5.16, is prone to a cross-site scripting vulnerability that arises from improper escaping of an audio player shortcode attribute. This flaw enables users with Contributor-level access or higher to inject arbitrary JavaScript code. Such code ...

The Media Library Assistant plugin for WordPress versions prior to 3.42 is vulnerable to cross-site request forgery (CSRF) attacks. This vulnerability allows an attacker to craft a malicious request that, if executed by a logged-in user with Editor privileges or higher, can lead to the permanent ...

The GeoDirectory WordPress plugin prior to version 2.8.196 contains a vulnerability that allows a post badge click-through link value to be improperly sanitized or escaped. This flaw permits users with Contributor roles and higher to exploit stored cross-site scripting attacks, targeting higher-p...

The Media Library Assistant plugin for WordPress contains a security flaw that compromises CSRF nonce validation in its bulk-action handler. This vulnerability allows attackers to send forged requests that may bypass the nonce check when the nonce field is omitted. As a result, authenticated user...

The Welcart e-Commerce plugin for WordPress suffers from a vulnerability where it fails to properly sanitize and escape parameters used in SQL queries. This oversight allows users with the Editor role or higher to execute SQL injection attacks, potentially compromising the integrity of the databa...

The Welcart e-Commerce WordPress plugin, prior to version 2.12.6, contains a flaw that allows unauthenticated users to manipulate the redirection of URLs. This oversight in user-supplied URL validation can lead to attackers redirecting users to any chosen external sites, posing significant securi...

The GoSMTP WordPress plugin versions prior to 1.2.5 contains a significant authorization flaw that fails to verify settings management on its SMTP configuration page. This loophole allows users with roles below the administrator level to manipulate outbound mail delivery settings without proper p...

The Welcart e-Commerce WordPress plugin prior to version 2.12.6 suffers from an authorization bypass issue. This vulnerability allows authenticated users with Author-level access or higher to manipulate SKU data, including prices, confidential cost prices, and stock levels of any product, regardl...

The Persian WooCommerce SMS WordPress plugin prior to version 7.3.2 contains a vulnerability that fails to properly sanitize and escape parameters before rendering them within an HTML attribute. This flaw can be exploited to execute reflected Cross-Site Scripting (XSS) attacks, potentially compro...

The Essential Addons for Elementor plugin allows unauthenticated users to exploit its pagination endpoint, lacking proper restrictions on post types and meta queries. This flaw could lead to the unauthorized reading of private custom fields and non-public post types, posing a significant threat t...

The WPOrLogin plugin for WordPress versions prior to 3.1.0 is vulnerable due to a lack of capability checks and nonce validation when modifying hidden-login URL settings. This vulnerability opens the door for unauthenticated attackers to arbitrarily change login, registration, and password-recove...

The Copy Anything to Clipboard for WordPress plugin prior to version 5.5.5 has a vulnerability that allows shortcodes to be stored and written back to web pages without adequate sanitization and escaping. This oversight can enable users with contributor roles and above to execute Stored Cross-Sit...

The Page Builder by SiteOrigin plugin for WordPress prior to version 2.38.0 has a vulnerability that allows improper sanitization and escaping of widget properties. This shortcoming enables users with contributor roles and above to inject malicious scripts into the page builder interface, which c...

The Page Builder by SiteOrigin plugin for WordPress has an access control vulnerability that allows users with contributor roles or higher to manipulate query arguments within the Post Loop widget. This oversight enables them to access and read content from other users' drafts, pending posts, sch...

The Royal Addons for Elementor plugin prior to version 1.7.1070 has a vulnerability that allows attackers to execute arbitrary JavaScript in the browser of users viewing the page. This occurs due to improper sanitization and escaping of size settings in the plugin's map widget. Any user with a Co...

The PayPlug for WooCommerce WordPress plugin prior to version 3.1.1 contains a significant security flaw that allows unauthenticated users to gain access to sensitive information concerning customer orders. The vulnerability arises because the plugin does not adequately verify the ownership of a ...

The Royal Addons for Elementor plugin for WordPress contains a security vulnerability that fails to adequately verify the visibility of requested posts when serving content through an unauthenticated AJAX action. This oversight means that even if a post is set to a non-public type, such as a cont...

The Royal Addons for Elementor plugin for WordPress lacks robust authorization checks, enabling unauthorized individuals to exploit stored Mailchimp credentials. Attackers can manipulate the plugin to introduce arbitrary email addresses into the site owner's Mailchimp account without authenticati...

The Court Reservation WordPress plugin versions prior to 1.12.4 is vulnerable due to a lack of authorization and nonce verification in its challenge-management actions. This security issue enables unauthenticated users to delete arbitrary tournament-ladder challenge records and any associated cou...

The Royal Addons for Elementor plugin for WordPress, up to version 1.7.1070, contains a flaw in the configuration of contact form email delivery. It improperly scopes the email settings to a global namespace based on a publicly accessible identifier chosen by the author. This oversight allows use...

The Menu Cart for WooCommerce plugin, prior to version 3.2.1, lacks adequate sanitization and escaping for cart item variation data. This oversight enables unauthenticated users to inject a Cross-Site Scripting payload, which can be executed within another user's session, potentially affecting lo...

The Booking Package WordPress plugin prior to version 1.7.33 exposes a security flaw where anyone can trigger email verification code messages without authentication. This vulnerability allows attackers to send these messages to arbitrary email addresses, potentially leading to abuse of the servi...

The Court Reservation plugin for WordPress prior to version 1.12.4 contains a serious flaw where necessary authorization and nonce validation are not enforced on one of its AJAX actions. This oversight permits unauthorized users to perform sensitive actions, such as adding or deleting reservation...

The Payconiq WordPress plugin version 1.0.4 has a vulnerability that permits unauthenticated users to access sensitive order information. Specifically, when users request an order confirmation link, the plugin fails to verify the user's permission to view that order. As a result, unauthorized ind...

The Thrive Automator plugin for WordPress prior to version 11.2 is susceptible to SQL injection attacks due to improper sanitization and escaping of a parameter's array key used in SQL queries. This vulnerability allows authenticated users with editor-level permissions to execute blind SQL inject...

The Casso Flow plugin for WordPress, prior to version 4.2.0, contains a flaw in the authentication of incoming bank-transfer payment notifications. This vulnerability arises from the fact that the token utilized for verification is left empty in default installations. As a result, unauthenticated...