Publicly Disclosed
PoC Exploits

A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remote...

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument ...

A path traversal vulnerability has been discovered in the Template Management component of CicadasCMS, specifically in the function TemplateController.input. This flaw allows an attacker to manipulate the filePath argument, leading to unauthorized access to directories and files outside the inten...

A security flaw has been identified in the Westboy CicadasCMS affecting the Backend Template Editor's TemplateController.save function. This vulnerability allows for manipulation that leads to path traversal, potentially enabling attackers to access unauthorized files from a remote location. As t...

A vulnerability exists in the deepseek-ai deepseek-harness software, specifically within the agent function of the dsh-workflow-worker-thread component. This flaw allows an attacker to manipulate the behavior of the workflow remotely. The exploit is actively available, and the potential for misus...

A vulnerability has been identified in Deepseek-AI's Deepseek-Harness up to version 0.1.1-rc.2. This issue resides within the 'spawn' function of the Sandbox component, where manipulation of the Profile argument could lead to potential sandbox escapes. Given that this flaw permits attacks on loca...

The Blinko product through version 1.8.8 exposes a directory traversal vulnerability that allows authenticated users to overwrite critical startup files as root. This issue arises from the installation procedure for plugins, where an unsanitized user input is used to construct the file path. By u...

A notable vulnerability exists in the houtini-ai voice-analyser-mcp up to version 2.1.1, allowing for server-side request forgery through manipulation of the 'sitemap_url' parameter in the fetch function of the src/utils/crawler.ts file. This vulnerability enables remote attackers to exploit syst...

The houtini-ai seo-crawler-mcp product contains a vulnerability in the run_seo_audit function found in the src/core/CrawlOrchestrator.ts file. This weakness allows an attacker to execute server-side request forgery (SSRF) attacks remotely. By exploiting this flaw, attackers could manipulate serve...

A vulnerability has been identified in macrozheng mall up to version 1.0.3, specifically within the JwtAuthenticationTokenFilter's refreshHeadToken function. This flaw allows for manipulation of token arguments, potentially resulting in unintended session expirations. The vulnerability can be exp...

A business logic error has been identified in the payment functionality of the Macrozheng Mall application. The flaw lies in the AlipayServiceImpl.pay method within the Payment Endpoint component, where the manipulation of the total_amount argument can lead to unexpected behaviors. This vulnerabi...

A security vulnerability has been identified in the Backup Download component of the PRVTPRO Amnezia-Web-Panel, specifically in the file app.py. This flaw enables unauthorized remote access through the utilization of default credentials, allowing an attacker to gain control over the affected syst...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability exists in the ngx_http_rewrite_module of NGINX Plus and NGINX Open Source, triggered when a rewrite directive is followed by an if or set directive that includes a Perl-Compatible Regular Expression (PCRE) capture and a replacement string with a question mark. Attackers can exploi...

A vulnerability exists in the Bleenco Abstruse product that affects the Cache Endpoint, specifically within the filepath.Join function found in server/api/worker/download_cache.go. The flaw allows an attacker to manipulate the input arguments, potentially leading to unauthorized access to sensiti...

A security flaw has been identified in the zhayujie CowAgent application, specifically within the Markdown Rendering component in the Markdown.tsx file. This vulnerability allows for remote manipulation that can lead to a denial of service condition, potentially disrupting service availability. T...

OliveTin, a web interface tool, has a significant vulnerability due to improper handling of shell commands. Up to version 3000.10.0, the safety check 'checkShellArgumentSafety' fails to properly filter 'password' argument types. This oversight allows authenticated users to inject harmful shell me...

A vulnerability in Databasement prior to version 1.8.2 permits remote code execution by allowing authenticated users to run certain commands with user-specified database names. Specifically, commands like mariadb-dump can be manipulated to write arbitrary files, enabling potential code execution ...

A vulnerability has been identified in zhayujie CowAgent versions up to 2.2.0, specifically within the json.loads function of the Streaming Tool-Call Argument Handler. This vulnerability allows for resource allocation manipulation, which could lead to adverse effects on system performance and ava...

JeecgBoot versions up to 3.9.5 contain a significant missing authorization flaw in the SysUserController's getUserDetailByUserId method. This vulnerability permits any authenticated user to access and retrieve sensitive information, including real names, usernames, email addresses, phone numbers,...

JeecgBoot version 3.9.5 is impacted by a missing authorization vulnerability within the SysDepartRoleController's exportXls handler. This flaw enables any authenticated user, including those with minimal privileges, to exploit the /sys/sysDepartRole/exportXls endpoint. As a result, they can downl...

JeecgBoot prior to version 3.9.6 has a vulnerability in its SysCommentController exportXls handler that lacks adequate authorization checks. This deficiency allows any authenticated user to exploit the export functionality to download all comments from the system, including sensitive information ...

The JeecgBoot application, up to version 3.9.5, is susceptible to a missing authorization issue within the SysUserController's queryChildrenByUsername function. This vulnerability permits authenticated users to gain unauthorized access to sensitive account records of other users. Attackers can ex...

JeecgBoot version 3.9.5 contains a security flaw in the SysMessageController's delete handler, allowing authenticated users with low privileges to execute DELETE requests without proper ownership checks. This vulnerability enables attackers to delete any message records by sending requests with a...

JeecgBoot version 3.9.5 contains a vulnerability in the SysMessageTemplateController delete handler. This flaw allows any authenticated user to delete message templates due to missing authorization checks. Low-privileged attackers can exploit an unprotected endpoint to obtain template IDs, subseq...

The JeecgBoot product version 3.9.5 contains a vulnerability in the SysPositionController that allows authenticated users to exploit a missing authorization check. This flaw enables low-privileged attackers to execute DELETE requests with arbitrary user IDs and position IDs, leading to unauthoriz...

JeecgBoot version 3.9.5 is affected by a missing authorization vulnerability in the editThirdAppConfig handler. This flaw allows any authenticated user, including those with low privileges, to modify critical configurations of third-party applications. Specifically, unauthorized users can alter c...

The JeecgBoot application version 3.9.5 has a missing authorization vulnerability within the getTenantPackInfo handler. This flaw permits any authenticated user to access and read product pack membership information for other tenants. By manipulating parameters such as tenantId and predefined pac...

The JeecgBoot application, specifically versions up to 3.9.5, is susceptible to an insecure direct object reference (IDOR) vulnerability in the AiragBaseApiController. This flaw allows authenticated users to access other users' AI chat variables by manipulating the username parameter when making ...

JeecgBoot versions up to 3.9.5 exhibit a serious missing authorization issue in the PUT /sys/dict/editDictByLowAppId endpoint. This flaw allows any authenticated user to alter application dictionaries by leveraging the low_app_id, which can be retrieved from the GET /sys/dict/list API endpoint. A...

A missing authorization vulnerability in JeecgBoot versions prior to 3.9.5 allows low-privileged authenticated users to access sensitive AI application configurations. Exploitation of this vulnerability occurs through the unprotected /airag/app/listDict endpoint, allowing attackers to enumerate a...

JeecgBoot version 3.9.5 has a vulnerability in the AiragPromptsController that allows authenticated users to delete AI prompt templates without proper authorization. By leveraging the unprotected GET /airag/prompts/list endpoint, low-privileged attackers can retrieve template IDs and subsequently...

JeecgBoot, up to version 3.9.5, has a vulnerability in the putCancelQuit handler of SysUserController, allowing authenticated users to bypass authorization controls. This flaw enables low-privileged attackers to cancel user resignations by supplying user IDs and tenant parameters, effectively res...

The JeecgBoot application, specifically in version 3.9.5, has a flaw where limited privilege authenticated users can manipulate user roles related to department management. By exploiting the PUT method on the endpoint /sys/user/changeDepartChargePerson, attackers can gain the ability to appoint o...

JeecgBoot, up to version 3.9.5, is susceptible to a missing authorization vulnerability within the SysUserController's addSysUserGroup handler. This flaw allows any authenticated user to manipulate user group memberships without proper permission checks. By sending crafted POST requests that incl...

JeecgBoot version 3.9.5 is affected by a vulnerability that allows low-privileged authenticated users to perform unauthorized modifications to department data. By exploiting a flaw in the system, these users can call the PUT endpoint /sys/user/doUpdateDepartInfo, enabling them to change departmen...

JeecgBoot 3.9.5 is vulnerable due to a missing authorization check in the saveDatarule handler of the SysDepartRoleController. This flaw permits low-privileged authenticated users to send crafted request parameters such as permissionId, roleId, and dataRuleIds, which may allow them to overwrite d...

JeecgBoot version 3.9.5 contains a vulnerability in the batchEditUsers handler within the SysUserController. This issue allows any authenticated user, including those with low privileges, to execute unauthorized edits on user department assignments. By sending crafted PUT requests to the /sys/use...

JeecgBoot version 3.9.5 contains a vulnerability within the SysRoleController's saveDatarule handler. This flaw enables low-privileged authenticated users to alter role data rules without proper authorization. Attackers can exploit this by sending specific parameters such as permissionId, roleId,...

JeecgBoot before version 3.9.5 contains a missing authorization vulnerability that enables low-privileged authenticated users to send arbitrary system announcements. By exploiting this flaw, attackers can manipulate the announcement parameters—such as title, content, fromUser, and toUser—allowing...

JeecgBoot versions up to 3.9.5 are impacted by a missing authorization vulnerability, allowing authenticated users to exploit POST requests to the /sys/api/sendBusTemplateAnnouncement endpoint. This oversight enables low-privileged attackers to send templated system announcements to arbitrary use...

JeecgBoot, up to version 3.9.5, has a flaw in the SystemApiController's getUserRoleSetById function, which permits any authenticated user to access other users' role assignments without proper authorization. This issue arises from improper access controls, allowing low-privileged users to supply ...

JeecgBoot versions up to 3.9.5 are susceptible to a missing authorization vulnerability that permits authenticated users to access another user's permissions. By exploiting this flaw, low-privileged attackers can manipulate the 'userId' parameter in the queryUserAuths handler, enabling them to ex...

A security vulnerability exists in zhayujie CowAgent versions up to 2.1.9, specifically within the Media Download Handler component. This flaw allows for uncontrolled memory allocation, potentially leading to a denial of service. The issue can be exploited remotely, making it crucial for users to...

A vulnerability has been discovered in the zhayujie CowAgent, specifically in versions up to 2.1.6. This weakness resides in the Web Console's upload function, which can be exploited to facilitate a Denial of Service (DoS) attack. Attackers can execute this manipulation remotely, leading to servi...

A vulnerability has been found in zhayujie CowAgent that impacts the Web Console component, specifically in the web_channel.py file. This security flaw allows attackers to manipulate the session_id argument, leading to a denial-of-service condition. Attackers can exploit this vulnerability remote...

A race condition vulnerability has been identified in Apple iOS and macOS products, where improper state handling could lead to unexpected system terminations or allow an app to write unauthorized kernel memory. This flaw has been addressed in recent updates across various Apple platforms, includ...

A security flaw has been identified in FunnyWolf Viper versions up to 3.1.11, stemming from a vulnerable function within the file /root/viper/.git/config. This vulnerability allows attackers to exploit hard-coded credentials, thereby opening a pathway for remote exploitation. With the exploit now...

An unauthenticated SQL injection vulnerability exists in the OrdaSoft Joomla CCK, where the order column for records is derived from user input and is not adequately validated. This oversight allows attackers to manipulate SQL queries, potentially compromising database integrity and exposing sens...

The mini-swe-agent versions 1.10.0 through 2.4.6 are vulnerable due to an information exposure flaw in the BubblewrapEnvironment. This vulnerability arises because the command bwrap fails to clear the environment variables with the --clearenv option, allowing sandboxed commands to unintentionally...