Publicly Disclosed
PoC Exploits

A vulnerability has been found in the Oray Pugongying X5 Pro that affects its session ID handling mechanism. Specifically, the issue exists in the 'session_get' function within the 'session.lua' file of the Session ID Handler component. The flaw arises from the manipulation of the '_user' argumen...

Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthenticated attacker to gain full access to th...

The MapPress plugin for WordPress prior to version 2.97.15 contains a vulnerability that fails to restrict data access in its front-end map embed handler. This flaw enables unauthenticated users to access sensitive information, specifically the email addresses and display names of registered user...

The Media Library Assistant plugin for WordPress prior to version 3.44 has a security flaw that allows authenticated users to gain unauthorized visibility of taxonomy terms associated with private attachments and posts. This vulnerability arises because the plugin fails to appropriately verify us...

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin prior to version 2.4.30 is vulnerable to improper access control. This issue arises when the plugin's test-email handler processes requests without adequately checking user capabilities. It leverages a nonce that any logged-in...

The Kali Forms plugin for WordPress, prior to version 2.4.30, contains a security flaw where it fails to conduct proper capability checks on its test email feature. This allows users with low privileges, such as Subscribers, to exploit a nonce available to any logged-in user. Consequently, they c...

The Media Library Assistant plugin for WordPress is vulnerable due to improper escaping of shortcode attributes before rendering them in generated links. This flaw allows users with Contributor roles and above to conduct Stored Cross-Site Scripting (XSS) attacks, potentially compromising site sec...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability exists in the GStreamer gst-plugins-good package where the rtph264depay and rtph265depay RTP depayloader elements fail to enforce a limit on the size of the reassembly buffer utilized during the processing of fragmented RTP packets. This flaw permits a remote, unauthenticated atta...

A command injection vulnerability exists in the WAVLINK WL-WN530BE1-A router's con_check_read_finish function located in the /protocol.csp file. This flaw allows attackers to manipulate the argument group_name/IP-FROM, potentially leading to remote command execution. The vulnerability has been di...

A vulnerability in the WAVLINK WL-WN530HG4B router allows for OS command injection through the manipulation of the 'Name' argument in the port_forward function located in /cgi-bin/wapi.cgi. This security flaw permits remote attackers to exploit the device, potentially gaining control and executin...

A security flaw has been identified in the WAVLINK WN579X3-D router, specifically within the port_forward function in the /cgi-bin/wapi.cgi file. The vulnerability allows an attacker to manipulate the 'Name' argument, resulting in OS command injection that can be exploited remotely. This could al...

A path handling issue in macOS allows a malicious application to improperly validate file paths, potentially enabling the app to gain root privileges. This vulnerability has been addressed with enhanced validation mechanisms in recently released versions of macOS, specifically in Golden Gate 27.2...

A security vulnerability has been discovered in the WAVLINK WL-WN579A3-A router's Initial Setup Wizard. The specific function affected is set_wzdgwMesh, located in the /cgi-bin/adm.cgi file. This vulnerability allows remote attackers to exploit the system by manipulating the wlan_ssid argument, l...

A vulnerability has been identified in Presenton, impacting versions up to 0.9.11-beta, specifically related to the Desktop Authentication Middleware. This issue arises within the /app_data directory, enabling unauthorized information disclosure. The vulnerability can be exploited remotely, allow...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability has been discovered in Presenton versions up to 0.9.11-beta, affecting its API component. This flaw allows for missing authentication, enabling potential unauthorized remote access. Attackers could exploit this weakness due to the public availability of the exploit. It is crucial ...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

An integer overflow exists in the remote-control screen processing component of TeamViewer clients, potentially allowing malicious remote hosts to induce denial of service or, in some scenarios, execute arbitrary code with the viewer process privileges. Successful exploitation necessitates that a...

A vulnerability in the Linux kernel related to posix CPU timers can lead to a use-after-free condition due to a race in non-leader exec() scenarios. When a timer associated with a process is deleted while concurrently executing an exec() command, it can cause access to freed memory. Specifically,...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A vulnerability exists in Apache HTTP Server that causes a NULL pointer dereference in the mod_xml2enc module. This issue can be exploited by an untrusted backend server, potentially leading to a denial of service condition due to an improperly handled charset conversion in proxied responses. Use...

A significant vulnerability exists in Grafana where users with editing permissions can exploit an integration's legacy schema version to alter protected settings. This can lead to unintended modifications of essential contact point configurations, including destination URLs. Consequently, this ex...

An authentication bypass vulnerability in pgAdmin 4 allows unauthorized users to connect using the service account's Kerberos credentials. This flaw arises due to improper handling of the KRB5CCNAME environment variable when a connection is not intended to use delegated Kerberos credentials. As a...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

PipesHub prior to version 0.10.0 is susceptible to a server-side request forgery (SSRF) vulnerability found in the ImageParser._fetch_single_url function. This flaw allows adversaries to exploit the indexing service by supplying crafted image URLs within documents. Attackers can utilize various m...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The Payable Payment Gateway for WooCommerce prior to version 1.3.1 lacks proper verification of incoming payment notifications. This flaw enables unauthenticated attackers to alter the payment status of any order within a WooCommerce store, irrespective of the payment method used. Consequently, t...

The Quick Event Manager plugin for WordPress, prior to version 9.19, has a security flaw that permits unauthenticated users to access and read the contents of draft and private posts. This vulnerability arises from inadequate verification of the status or type of the requested post when details a...

The Mapster WP Maps plugin for WordPress, versions prior to 2.0.6, features a significant vulnerability that allows unauthorized users to manipulate post data via a REST API endpoint. This lack of authorization checks enables attackers to overwrite the titles of existing posts, create new publish...

The All-in-One Video Gallery plugin for WordPress fails to validate the publication status of videos before displaying them on the player page. This oversight allows unauthenticated users to access sensitive video information, including titles and source URLs of private, draft, pending, scheduled...

The Firelight Lightbox plugin for WordPress prior to version 2.3.24 exhibits a vulnerability where it inadequately escapes image attribute values before rendering them in the browser. This flaw could enable users with contributor-level access and above to inject malicious web scripts. These scrip...

The BuddyForms plugin for WordPress, prior to version 2.10.1, contains a flaw that fails to adequately verify the ownership of guest-uploaded attachments. This vulnerability allows unauthenticated users to delete media files uploaded by other visitors, potentially leading to unauthorized loss of ...

The Security Optimizer plugin for WordPress is susceptible to a serious flaw wherein it fails to limit the number of two-factor authentication codes that can be submitted during a pending login. This weakness enables an attacker, who has knowledge of a user's password, to perform a brute-force at...

The Premium Packages plugin for WordPress prior to version 7.2.2 is susceptible to a serious vulnerability that allows unauthenticated users to overwrite the prices of items stored in their shopping carts. This flaw enables attackers to generate orders with arbitrary totals, potentially leading t...

The Bulk Media Register plugin for WordPress lacks proper validation of user-supplied paths, allowing users with Author permissions to manipulate file movements. This can lead to unauthorized access to sensitive files by enabling users to move or rename files outside the designated WordPress dire...

The Payment Forms for Paystack WordPress plugin prior to version 4.0.6 contains an access control flaw that enables users with the Contributor role and higher to access sensitive configuration pages. This oversight permits unauthorized visibility of critical payment gateway API credentials, inclu...

The Essential Addons for Elementor plugin for WordPress prior to version 6.8.8 fails to enforce proper restrictions on user roles during account creation. Authenticated users with Author-level access or higher can exploit this vulnerability, enabling them to grant elevated roles like Editor to ne...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A security flaw exists in the Next.js framework that allows an attacker to bypass authorization checks if such checks are implemented in middleware. This vulnerability arises in versions prior to 14.2.25 and 15.2.3. To mitigate risk, it is recommended to restrict incoming requests that include th...

The Searchor application, developed by ArjunSharda, contains a flaw in its command-line interface input processing. Prior to version 2.4.2, the application utilizes the 'eval' function on user-provided input without sufficient validation. This oversight can lead to arbitrary code execution, enabl...

The Laravel web application framework has a vulnerability in the TokenGuard, specifically when configured as a standard token-based API guard. Prior to versions 12.68.0 and 13.29.0, this flaw allows an attacker to bypass authentication by submitting a crafted non-string credential. Under certain ...

An authorization bypass vulnerability exists in the local management cluster shell feature of SUSE Rancher Manager. The security check intended to safeguard this feature was not comprehensively implemented across all API routes, allowing authenticated users to potentially execute unauthorized com...

A vulnerability in Google Chrome for Mac allows a remote attacker, who has compromised the renderer process, to execute arbitrary code outside the sandbox. This is accomplished through a specifically crafted HTML page, presenting significant security risks for users. The issue affects versions pr...