Publicly Disclosed
PoC Exploits

An authentication bypass vulnerability exists in Dovecot SQL authentication, where an administrator can inadvertently disable the 'auth_username_chars' configuration. This misconfiguration allows attackers to bypass authentication checks, potentially enabling unauthorized access and user enumerat...

A heap-based buffer overflow vulnerability exists in the Windows Imaging Component, which could allow an unauthorized attacker to execute arbitrary code locally. This flaw can be exploited by malicious actors to manipulate memory allocation and potentially gain unauthorized access to system resou...

Marimo, a reactive Python notebook, exhibits a significant security vulnerability prior to version 0.23.0. The terminal WebSocket endpoint (/terminal/ws) allows unauthenticated access, enabling attackers to gain a complete pseudo-terminal shell and execute arbitrary commands on the host system. U...

The vulnerability in the PPP Daemon (pppd) versions 2.4.2 through 2.4.8 is a buffer overflow issue found in the eap_request and eap_response functions. This flaw can potentially allow an unauthorized attacker to exploit the overflow, leading to arbitrary code execution or causing the application ...

The vulnerability within the Linux kernel occurs in the pppol2tp_recv() function, which fails to properly manage memory deallocation in a multi-threaded environment. This oversight allows an unprivileged user to potentially exploit the system by dereferencing a channel that has already been freed...

Metabase, an open-source business intelligence and embedded analytics tool, suffers from a deserialization vulnerability in versions prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4. When configured with an H2 database connection, including the default sample database, this flaw permits authenti...

This vulnerability involves a memory corruption issue that arises when processing specially crafted media files, which can lead to unintended app termination or memory corruption in affected Apple devices. Apple has addressed this flaw with enhanced input validation in the latest versions of thei...

A vulnerability exists in the Linux kernel's netfilter module that affects the nft_map_catchall_activate() function. This function encounters an inverted element activity check, leading to a failure in appropriately handling catchall map elements during a failed transaction. The bug arises when t...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

Microsoft has identified a vulnerability in the Microsoft Malware Protection Engine associated with Microsoft Defender, allowing unauthorized elevation of privilege. This vulnerability, called 'RoguePlanet', could enable an attacker to gain escalated access to the system. Microsoft is currently d...

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

The Estatik Real Estate Plugin for WordPress features a significant flaw where it fails to properly validate the recipient list intended for messages generated via its property request form. This oversight allows unauthenticated users to exploit the functionality and send emails to any arbitrary ...

The Quick Paypal Payments WordPress plugin versions prior to 5.7.50 contains a security weakness in its PayPal IPN handler. This vulnerability allows an attacker to exploit the payment confirmation process by matching order tokens without validating key transaction details such as the paid amount...

The Kirki WordPress plugin prior to version 6.2.1 is susceptible to inadequate authorization that affects its front-end form submission REST routes. This vulnerability allows unauthenticated attackers to exploit the system by executing any registered shortcodes, which can lead to significant issu...

The Payment Button for PayPal WordPress plugin prior to version 1.2.3.44 features a significant vulnerability related to improper input validation. This security flaw allows unauthenticated users to manipulate the payment amount by sending a client-supplied payment value that is not properly vali...

The Payment Gateway for PayPal in the WooCommerce plugin prior to version 9.2.1 contains a vulnerability that compromises the integrity of payment processing. It fails to validate whether a payment was successfully completed before marking orders as paid. The exploit allows an unauthenticated att...

The Welcart e-Commerce plugin for WordPress is susceptible to a significant vulnerability where it fails to properly verify the authenticity of callback requests related to convenience-store and bank-transfer settlements. This flaw allows an unauthenticated attacker to change the status of an ord...

The Wallet System for WooCommerce WordPress plugin version prior to 2.7.10 is vulnerable due to a lack of validation for user-supplied wallet amounts during the checkout process. This failure allows authenticated users to reduce their order total arbitrarily, including the possibility of setting ...

A vulnerability exists in the Linux kernel's networking subsystem that allows for a race condition involving qdisc_rtab_list. This occurs when multiple CPU cores attempt to access and modify the same singly linked list of rate tables concurrently. The lack of proper synchronization mechanisms can...

The node-tar library, utilized for handling tar files in Node.js, has a security flaw affecting versions up to 7.5.2. This vulnerability arises from an inadequate sanitization of link paths in both hardlink and symbolic link entries when the preservePaths option is disabled (which is the default ...

The Royal Addons for Elementor plugin for WordPress, prior to version 1.7.1065, contains a vulnerability that fails to adequately validate widget settings when generating HTML outputs. This oversight allows users with Contributor roles or higher to inject malicious scripts, facilitating Stored Cr...

The ProSolution WP Client plugin for WordPress, prior to version 2.0.9, suffers from a serious security flaw due to inadequate checks on administrative AJAX actions. This oversight permits any authenticated user, including those with limited roles such as subscribers, to invoke administrative dat...

The Order Sync with Zendesk for WooCommerce plugin prior to version 2.2.3 fails to implement necessary capability checks on its REST API endpoints. This oversight allows unauthenticated users to gain access to sensitive customer information, including order history and total purchases, simply by ...

The ProSolution WP Client WordPress plugin prior to version 2.0.9 has a critical security flaw that permits authenticated users to leverage an unvalidated URL input for server-side HTTP requests. Due to the lack of validation on the user-supplied URL and insufficient checks on user capabilities o...

The WPC Admin Columns plugin for WordPress prior to version 2.3.4 lacks proper authorization checks in one of its AJAX actions. This oversight permits users with minimal roles, such as subscribers, to access and read arbitrary user, post, and term metadata, potentially exposing sensitive informat...

The WP Photo Album Plus WordPress plugin, prior to version 9.2.09.002, fails to enforce user authorization when allowing front-end uploads. This oversight enables any authenticated user, including those with minimal access such as Subscribers, to upload files to albums owned by others, including ...

The Events Manager plugin for WordPress prior to version 7.4.1 contains a significant access control vulnerability. This flaw arises from improper scoping of capability mapping, which negates the access control measures implemented by WordPress for unrelated privileged actions. As a result, unaut...

The WooCommerce Subscriptions plugin, prior to version 9.1.0, is vulnerable to PHP Object Injection when operating on stores that have High-Performance Order Storage enabled. This vulnerability allows unauthenticated users to exploit the weakness by injecting malicious serialized objects. By leve...

An access control vulnerability exists in the Ezoic WordPress plugin prior to version 2.23.1, which fails to adequately restrict access to its content export features. This flaw enables unauthorized users to exploit the plugin, resulting in the ability to trigger an unwanted server-side export of...

The WP Directory Kit WordPress plugin prior to version 1.5.6 fails to properly sanitize and escape input parameters in its SQL statements during authenticated AJAX actions. This lack of adequate authorization checks enables any authenticated user, including subscribers, to exploit this vulnerabil...

The WP Directory Kit WordPress plugin is susceptible to SQL injection due to insufficient sanitization and escaping of parameters used in SQL statements. This vulnerability enables unauthenticated users to manipulate the database by exploiting a non-default search field type, potentially leading ...

The WP Photo Album Plus plugin for WordPress prior to version 9.2.07.002 contains a security flaw that allows unauthorized users to access sensitive configuration data. This occurs because the plugin does not implement necessary checks on certain public endpoints and inadequately handles input va...

The WP Photo Album Plus plugin for WordPress has a significant security issue that arises from its failure to validate user-controlled input when constructing file paths. This vulnerability allows unauthenticated attackers to execute arbitrary deletion commands on ZIP archives stored on the serve...

The Events Manager plugin for WordPress, prior to version 7.4.1, is susceptible to SQL injection due to insufficient sanitization and escaping of user-supplied input in its SQL statements. This vulnerability permits users with subscriber-level access or higher to manipulate booking consent record...

The User Access Manager plugin for WordPress prior to version 2.3.15 contains a significant access control flaw. This vulnerability allows unauthenticated individuals to bypass intended restrictions, gaining unauthorized access to posts, pages, and custom post types. The absence of proper access ...

The Cookie Consent WordPress plugin prior to version 0.0.10 contains a significant flaw that allows authenticated users, even those with minimal privileges, to modify the geolocation service license key. This vulnerability arises due to insufficient enforcement of administrator-only capabilities ...

The WP Photo Album Plus plugin for WordPress versions prior to 9.2.07.002 is susceptible to reflected cross-site scripting (XSS) due to improper sanitization and escaping of input parameters. This weakness can be exploited by unauthenticated attackers, who can craft malicious links that, when cli...

The Form Maker plugin by 10Web for WordPress prior to version 1.15.45 contains a vulnerability due to improper parameterization of user-controlled values. This flaw allows an attacker with subscriber-level permissions to exploit dynamic SQL queries within the plugin, potentially enabling second-o...

The PowerPress Podcasting Plugin by Blubrry prior to version 11.17.1 contains a security flaw where it fails to validate the Podcast Episode URL settings. This oversight permits users assigned to lower roles, such as Contributor, to exploit server-side request forgery (SSRF) vulnerabilities. As a...

The Wallet for WooCommerce plugin prior to version 1.6.10 suffers from a vulnerability where it fails to validate the actual amount collected during wallet top-up transactions. This oversight enables users to increase their wallet balance unjustly, allowing for potential financial exploitation. P...

The WP Travel Engine plugin for WordPress before version 6.8.5 lacks proper authorization checks on unauthenticated cart actions. This loophole allows attackers to exploit the system by providing a booking identifier to access sensitive customer booking details and billing information. Additional...

The Patterns Kit plugin for WordPress has a vulnerability that allows users with minimal privileges, such as the Contributor role, to inject malicious payloads. This occurs because the plugin fails to properly escape link attributes before inserting them into client-side scripts. Consequently, at...

The Cookie Consent plugin for WordPress prior to version 0.0.10 is susceptible to improper access control due to a lack of proper enforcement of administrator capabilities on its REST routes. This vulnerability allows any authenticated user, even those with limited privileges such as subscribers,...

The WPMU DEV Updates plugin prior to version 5.0.1 fails to ensure the integrity of packages installed via its remote management interface. This oversight allows attackers to exploit legitimate management requests, potentially leading to the installation and execution of arbitrary code on affecte...

The Welcart e-Commerce plugin for WordPress prior to version 2.11.34 lacks proper sanitization and escaping of product fields. This oversight allows users with the Author role or higher to inject arbitrary web scripts. Such scripts can execute in the browser of any visitor accessing the product p...

The Total Upkeep plugin for WordPress, prior to version 1.17.3, is susceptible to an insecure direct object reference, resulting in inadequate protection of backup-restore functionality secrets. This flaw allows unauthenticated users to access sensitive backup data and potentially initiate a full...

The WP Crowdfunding plugin for WordPress, prior to version 2.2.1, exhibits a significant security flaw that fails to verify ownership of orders before disclosing their details. This allows any authenticated users, including those with Subscriber roles, to access sensitive WooCommerce order inform...

The WP Crowdfunding plugin for WordPress prior to version 2.2.1 features an authorization bypass flaw. This vulnerability allows authenticated users, including those with subscriber privileges, to submit crowdfunding campaign posts without the necessary permissions. Specifically, the plugin does ...

The Giftware WordPress plugin prior to version 4.2.10 has a security flaw that fails to properly validate the type of uploaded files in certain upload paths. This oversight allows unauthenticated users to upload arbitrary files, including potentially malicious PHP scripts, which can be executed o...

The Import WP plugin prior to version 2.14.23 is susceptible to an authorization bypass flaw, which permits unauthenticated attackers to download export files that were generated by administrators. These files may unintentionally expose sensitive user information, including email addresses, login...