Publicly Disclosed
PoC Exploits

An unauthenticated remote code execution vulnerability exists in YOOtheme Pro versions 5.0.0 to 5.0.52 due to improper binding of image operations and output destinations in its publicly accessible image transformation handler. This flaw allows an attacker to exploit a legitimate public image URL...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in NoMachine involves improper validation of user-supplied file paths during command line operations. Local attackers can exploit this flaw by executing low-privileged code, leading to unauthorized privilege escalation and the potential execution of arbitrary code within a root...

The NoMachine software contains a vulnerability that allows local attackers to delete arbitrary files by exploiting improper validation of environment variables. An attacker needs to execute low-privileged code on the target system to exploit this weakness. By supplying a malicious path, the atta...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

Adobe Commerce is vulnerable to an unrestricted file upload issue that may allow an attacker to upload files of potentially harmful types, leading to arbitrary code execution within the context of the current user. This security weakness can be exploited through user interaction, such as visiting...

The Gotenberg PDF API, a Docker-based tool for PDF file processing, has a significant vulnerability affecting versions 8.30.1 and earlier. It allows unauthenticated attackers to exploit the metadata write endpoint, which inadequately sanitizes metadata values. By including a newline character in ...

A critical vulnerability has been identified in the a2ui project affecting the Parser component. Specifically, the issue arises in the formatString function within the expression_parser.ts file, which can lead to significant resource consumption when manipulated. This vulnerability can be exploit...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A vulnerability exists in a2ui Project that affects versions up to 0.10.6, specifically in the function DataContext.resolveSignal within the file data-context.ts of the Resolver component. This vulnerability can be exploited remotely, leading to significant resource consumption issues. An exploit...

This vulnerability arises from the improper neutralization of argument delimiters in a command used by the Windows Error Reporting Service. An authorized attacker could exploit this flaw to elevate their privileges locally, potentially gaining unauthorized access to system-level functions. To mit...

A resource consumption vulnerability has been identified in a2ui by a2ui-project, specifically within the Binder component's file generic-binder.ts. This flaw can be exploited remotely, potentially leading to excessive resource utilization. The issue affects versions up to 0.10.6 and has been pub...

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log messag...

An exploitable vulnerability resides within the Oracle Application Object Library component of Oracle E-Business Suite. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized actions. Specifically, this vulnerability could enable unauthorized access to the Orac...

The Laravel web application framework has a vulnerability in the TokenGuard, specifically when configured as a standard token-based API guard. Prior to versions 12.68.0 and 13.29.0, this flaw allows an attacker to bypass authentication by submitting a crafted non-string credential. Under certain ...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A resource consumption vulnerability in the a2ui project allows attackers to exploit the function DataModel.set located in the file renderers/web_core/src/v0_9/state/data-model.ts. By manipulating this function, an attacker can initiate a remote attack leading to unexpected resource depletion. A ...

A vulnerability exists in Plex Media Server that allows for Server-Side Request Forgery (SSRF) through the '/player/timeline' endpoint. By exploiting this flaw, an attacker can manipulate the 'protocol' parameter using any X-Plex-Token value, enabling them to send POST requests to any external de...

CrushFTP versions prior to 7.3.0 are susceptible to a cross-site request forgery vulnerability due to the lack of CSRF protection enabled by default. This vulnerability potentially allows attackers to trick an authenticated administrator into visiting a malicious webpage. Once this occurs, the at...

The unrestricted file upload vulnerability found in C97net qEngine CMS, Kemana Directory, and Cart Engine allows users with editor privileges to upload PHP scripts through the image fields. This occurs via the page_image or cat_image parameters, leading to potential remote code execution on the s...

The unrestricted file upload vulnerability found in C97net qEngine CMS, Kemana Directory, and Cart Engine allows users with editor privileges to upload PHP scripts through the image fields. This occurs via the page_image or cat_image parameters, leading to potential remote code execution on the s...

The a2ui application up to version 0.10.6 contains a vulnerability within the Error Handler component, specifically in the DataContext.dispatchExpressionError function. This flaw leads to information exposure through detailed error messages, which can potentially divulge sensitive data to attacke...

A vulnerability exists in Phenix Digital's Phoenix Storybook that allows unauthenticated remote code execution due to unsanitized attribute value interpolation during HEEx template generation. The psb-assign WebSocket event handler permits arbitrary attribute names and values from unauthenticated...

A security vulnerability has been found in the a2ui Project, specifically affecting versions up to 0.10.6. The flaw lies in the data-context Resolver, particularly in the functionality related to resource management within the file renderers/web_core/src/v0_9/rendering/data-context.ts. This vulne...

The vulnerability allows an attacker to potentially execute arbitrary code on systems running Apache Tomcat, specifically when the default servlet is enabled for write access, and the system is utilizing case insensitive file systems. This occurs due to a timing issue during JSP compilation, whic...

Apache Tomcat is affected by a security vulnerability that allows attackers to exploit path equivalence issues. If certain conditions are met, such as having write permissions enabled for the default servlet and supporting partial PUT uploads, attackers can potentially execute remote code or disc...

The REDAXO Core versions prior to 5.21.4 exhibit an authentication bypass vulnerability in the structure/history plugin, enabling unauthenticated attackers to manipulate session-tied secrets. This flaw allows attackers to create forged temporary login tokens for admin accounts, gaining unauthoriz...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

Authlib versions 1.7.2 and earlier have a vulnerability in the JsonWebSignature.deserialize_json() method, which improperly validates signatures. This flaw allows for the potential bypass of signature checks, as it accepts a JSON Serialization JWS object and returns the payload as verified, witho...

The Consul-k8s product by HashiCorp is susceptible to a cross-namespace authorization bypass due to misconfigurations in component ACL binding rules. This flaw enables attackers to escalate their privileges within the Consul deployment. It affects all versions from 0.42.0 onward, necessitating a ...

An improper authentication vulnerability in Microsoft Authenticator may allow an attacker to elevate their privileges locally. This flaw poses a significant risk as it could enable unauthorized users to gain elevated access rights, potentially compromising sensitive user information and system in...

Grafana, an open-source monitoring and observability platform, is susceptible to a directory traversal vulnerability in versions ranging from 8.0.0-beta1 to 8.3.0. This vulnerability enables unauthorized access to local files via specially crafted URL paths which include the identifier for any in...

A vulnerability in Chitchatter's PostMessage Handler allows for improper authentication due to manipulation of the 'parentDomain' argument within the 'isConfigMessageEvent' function. This flaw poses a risk for remote exploitation, making it essential to apply the available patch promptly. The ven...

A significant vulnerability in Gradio's open-source Python package allows for Server-Side Request Forgery (SSRF) via the `/queue/join` endpoint. Attackers can exploit the `async_save_url_to_cache` function, forcing the Gradio server to send HTTP requests to URLs controlled by the attacker. This e...

The URL Shortify plugin for WordPress suffers from an Open Redirect vulnerability due to inadequate validation of the 'redirect_to' parameter within its promotional dismissal handler. This flaw allows unauthorized attackers to create deceptive links that redirect unsuspecting users to potentially...

The midi-Synth plugin for WordPress allows unauthenticated attackers to exploit a vulnerability that permits arbitrary file uploads. This occurs due to inadequate validation of file types and extensions within the 'export' AJAX action in versions up to and including 1.1.0. The lack of security ch...

A vulnerability in NGINX Plus and NGINX Open Source occurs when the alias directive is improperly configured, allowing an unauthenticated attacker to exploit the system by sending specially crafted HTTP requests. This can lead to a heap buffer overflow in the NGINX worker process, potentially cau...

The Frontend Post Submission Manager Lite plugin for WordPress contains a vulnerability that permits open redirection due to inadequate validation of the 'requested_page' parameter in its verify_username_password function. This flaw allows unauthenticated attackers to manipulate users into visiti...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

An out-of-bounds write vulnerability has been identified in Apple iOS and macOS products, leading to potential memory corruption when processing maliciously crafted PDF files. The issue arises due to insufficient bounds checking, which may allow attackers to exploit the vulnerability and execute ...

A vulnerability in the Linux kernel related to posix CPU timers can lead to a use-after-free condition due to a race in non-leader exec() scenarios. When a timer associated with a process is deleted while concurrently executing an exec() command, it can cause access to freed memory. Specifically,...

A vulnerability in the Wasmtime WebAssembly runtime allows a user-controlled Wasm module to potentially escape its sandbox. A flaw in the Cranelift compiler backend for aarch64 can cause a 'br_table' instruction to compile incorrectly, leading to improper branch target assignments. This misconfig...

A vulnerability has been identified in ReduxJS Redux-Devtools version 5.0.0, specifically within the evalAction function of the Remotedev Server component. This security flaw allows for code injection due to improper handling of the action argument. The vulnerability can be exploited with local a...

An access control flaw in Microsoft Defender permits an authorized attacker to elevate their privileges within the system. This vulnerability arises due to insufficient granularity in access controls, potentially enabling local exploitation of the affected product capabilities. Organizations need...

A vulnerability exists in the php-travel-agency-system by oretnom23, specifically in the Contact Form Handler's contact_insert.php file. Attackers can exploit this weakness remotely to execute arbitrary SQL commands by manipulating input fields such as name, company, email, topic, phone, and comm...

A vulnerability in versions of SPIP prior to 4.4.20 allows unauthenticated remote attackers to execute arbitrary code. This flaw arises from improper recognition of PHP blocks, particularly with mismanaged strings that contain characters like '<'. Exploitation of this issue poses a significant ri...

An unauthenticated Remote Code Execution vulnerability affects REDCap, enabling attackers to exploit the survey passthrough routing and Data Import processing. By manipulating HTTP requests, a malicious user can target an unintended controller route from a public survey context and provide a craf...

The Bookly plugin for WordPress is susceptible to an Insecure Direct Object Reference vulnerability affecting versions up to and including 28.2. This flaw arises from the 'bookly_get_form_id' AJAX handler, which improperly processes the 'order_id' supplied by users, allowing an attacker to exploi...