Publicly Disclosed
PoC Exploits

In Mautic 7, a stored Cross-Site Scripting (XSS) vulnerability exists within the Projects component. This flaw arises due to improper sanitization of user-supplied project names displayed in administrative detail views, such as campaigns, emails, or forms. When an authenticated user, who has perm...

A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. The application inadequately sanitizes project names retrieved via AJAX, which can lead to malicious scripts being injected into the DOM. An authenticated user capable of creating projects can ...

A vulnerability exists in Gitea that allows an unauthorized user to bypass the workflow approval gate, creating a potential security risk. This issue could lead to unauthorized modifications being made without proper oversight, undermining the integrity of project workflows. Users are advised to ...

Dompdf, an HTML to PDF converter for PHP, has a vulnerability where it improperly processes BMP images. Versions up to 3.15 can accept BMP images with declared header dimensions that do not correlate with the actual pixel dimensions. This oversight allows attackers to supply an excessively large ...

The RSFiles Joomla extension presents a security vulnerability that allows for unauthenticated users to upload arbitrary files, potentially enabling the execution of malicious code remotely. This flaw can lead to significant security risks for affected Joomla installations as it opens pathways fo...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A logic issue in iOS and iPadOS may allow a malicious app to enumerate the installed applications on a user's device. This could lead to potential privacy breaches, where sensitive information about user preferences and installations could be exposed. The issue has been addressed with enhanced ch...

Certain DVR devices, including the TBK DVR4104 and DVR4216 models, as well as various rebranded variants, are susceptible to a remote authentication bypass. By manipulating the 'Cookie: uid=admin' header, attackers can access sensitive functionalities without proper authentication. This vulnerabi...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The WooCommerce Designer Pro theme for WordPress is vulnerable to an arbitrary file read, impacting all versions up to and including 1.9.28. This vulnerability allows unauthenticated attackers to read sensitive files from the server, potentially exposing critical information such as database cred...

The Gallery for Google Photos plugin for WordPress prior to version 1.2.1 contains a significant access control vulnerability. This flaw allows unauthorized access to stored third-party OAuth credentials associated with the connected account. Consequently, unauthenticated users can retrieve persi...

The Simply Schedule Appointments plugin for WordPress prior to version 1.6.12.6 contains a vulnerability that fails to adequately restrict bulk operations to a requester's own records. This oversight allows unauthenticated individuals to access personal data related to all appointments on the sit...

The Charitable WordPress plugin, prior to version 1.8.5.3, has a vulnerability where it fails to properly sanitize and escape a campaign image text field. This oversight may be exploited by users with elevated privileges to execute Stored Cross-Site Scripting attacks. Such attacks could lead to a...

The Webtoffee Cookie Consent plugin for WordPress, prior to version 3.5.3, is vulnerable due to the absence of proper authorization checks across several REST API routes. This weakness allows unauthenticated attackers to perform critical actions such as exporting and deleting stored visitor conse...

The ProfileGrid plugin for WordPress, prior to version 5.9.9.8, contains an improper authorization vulnerability that enables authenticated users, such as Subscribers, to delete notifications intended for other users. This occurs due to the lack of verification that a notification belongs to the ...

The Frontend File Manager Plugin for WordPress contains a vulnerability that allows attackers to exploit missing nonce validation in a specific file-metadata update action. This vulnerability can enable an unauthorized user to manipulate the metadata of files uploaded by logged-in users, potentia...

The Product Attachment for WooCommerce plugin for WordPress prior to version 2.3.3 contains a significant security oversight, failing to enforce authorization checks before allowing access to media library files. This vulnerability enables unauthenticated users to exploit the system and download ...

The Event Booking Manager for WooCommerce before version 5.3.7 has a significant vulnerability, where it fails to properly check user authorization when using the quick-edit feature for events. This weakness permits users with a Contributor role or higher to alter the titles and publication statu...

The Event Booking Manager for WooCommerce, a popular WordPress plugin, is susceptible to a vulnerability that allows users with post-editing capabilities, such as Authors, to inject malicious JavaScript. This occurs because the plugin fails to properly sanitize or escape event timeline content be...

The Event Booking Manager for WooCommerce Plugin prior to version 5.3.7 allows unauthorized users with Contributor access and above to exploit deserialization vulnerabilities in certain event content fields. Although no direct payload chains are present within the plugin itself, if another versio...

The Login-Social plugin for WordPress versions up to 1.0.4 has a critical flaw that allows attackers to bypass authentication mechanisms. It fails to verify password-reset requests against a secure reset key or the identity of the requester, leading to grave security risks. Unauthenticated attack...

The LWS Optimize plugin for WordPress prior to version 3.4 contains a vulnerability that fails to implement proper capability checks on cache-clearing actions. This oversight enables authenticated users, including those with a Subscriber role, to clear the site's caches at will. As a result, it p...

The Narrative Publisher plugin for WordPress, up to version 1.0.7, has a security flaw that lacks proper restrictions on write access to a REST-exposed post meta field. This oversight permits users with contributor-level permissions or higher to inject JavaScript code into posts. When these posts...

The RT Mega Menu plugin for WordPress prior to version 1.5.2 has a security flaw due to inadequate capability checks on its AJAX actions. The vulnerability allows a logged-in user with subscriber-level permissions to manipulate the mega-menu configuration. By exploiting this flaw, the user can in...

The POUCO Import Users plugin for WordPress version 1.0.0 is susceptible to a serious security flaw that allows unauthorized users to exploit AJAX actions. The plugin fails to implement necessary capability and nonce checks for these actions, which are accessible even to unauthenticated users. Th...

The Simple Restrict WordPress plugin, prior to version 1.2.9, suffers from an access control vulnerability that allows unauthorized users to bypass content restrictions through the REST API. While the plugin correctly imposes content-restriction checks on the front end, it instead relies on a gen...

The Clever Mega Menu for Visual Composer plugin, versions up to 1.0.1, lacks essential nonce verification and capability checks during an AJAX action that updates menu item metadata. This oversight permits any authenticated user, including those with minimal privileges like Subscribers, to alter ...

The Lenxel WP WordPress theme prior to version 1.0.31 is susceptible to an authorization bypass vulnerability that allows unauthenticated users to reset passwords for any user, including administrative accounts. The vulnerability arises from the inadequate checks on the password-reset action, whi...

The Element Pack Addons for Elementor plugin allows users with contributor-level access or higher to exploit a vulnerability where option values are not properly sanitized. This oversight enables attackers to inject arbitrary JavaScript code, which is then executed in the browser session of any v...

The AI ChatBot for WooCommerce plugin, prior to version 4.8.4, contains a critical vulnerability that lacks necessary authorization and nonce checks for specific AJAX actions. This security gap allows unauthenticated users to exploit the plugin by utilizing the site owner's stored third-party API...

The SMS Alert WordPress plugin prior to version 3.9.8 exposes a critical flaw in its user authentication mechanism. An attacker can exploit the vulnerability by verifying an OTP sent to their own mobile device and subsequently supplying a different phone number to log in as any user. This potenti...

The Meta Box WordPress plugin, prior to version 5.13.1, contains a significant oversight where it fails to properly authorize users attempting to delete media attachments. This flaw enables users with lower privilege roles, such as Contributors, to erase arbitrary attachments belonging to other u...

A vulnerability has been identified in a popular WordPress plugin, allowing unauthorized users to access sensitive information. This security flaw can potentially lead to data exposure, putting user privacy at risk. All versions of the affected plugin are susceptible, making it crucial for admini...

The FluentBoards plugin for WordPress prior to version 1.95.3 is vulnerable due to improper access control mechanisms. Authenticated users with member access to any single board can exploit this vulnerability to gain unauthorized access to stages and tasks from other boards within the site. This ...

The Five Star Restaurant Reservations plugin for WordPress, prior to version 2.7.23, has a security vulnerability that allows users with minimal booking-management permissions to exploit a flaw in its AJAX processing. This vulnerability permits unauthorized users to modify the site’s booking noti...

The JetEngine plugin for WordPress, prior to version 3.8.12, is susceptible to stored cross-site scripting (XSS) attacks. In this vulnerability, the plugin fails to properly escape post meta values before rendering them through shortcodes. This oversight allows users with Contributor roles and ab...

The King Addons for Elementor plugin for WordPress, prior to version 51.1.76, contains a vulnerability that allows attackers to inject arbitrary JavaScript into the browser of a user through an unauthenticated AJAX response. By exploiting this weakness, a malicious actor can create a specially cr...

The Realtyna Organic IDX and WPL Real Estate plugins for WordPress are susceptible to arbitrary file upload due to inadequate file type validation in the upload function. This vulnerability affects all versions up to and including 5.2.0. The issue arises from a publicly accessible I/O endpoint th...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

This vulnerability arises due to the improper placement of an integer overflow guard in libsoup, specifically within the conditional block for masked frames. As a result, unmasked server-to-client frames are vulnerable. A malicious WebSocket server could exploit this flaw by sending a specially c...

The HTTP/2 protocol is susceptible to a denial of service vulnerability that can be exploited via rapid stream resets. This allows attackers to overwhelm servers by rapidly canceling requests, leading to significant resource consumption and potential service disruption. Exploitation of this vulne...

The Kestra orchestration platform suffers from an authentication bypass vulnerability in its REST API. Specifically, any request ending with '/configs' is treated as public, bypassing necessary credential checks. This lack of authentication allows unauthorized users to create and execute flows, p...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

Concrete CMS versions 9.5.0 and earlier are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. The '/ccm/frontend/conversations/get_rating' endpoint allows unauthorized users to confirm the existence of any message's ID and retrieve its rating score. This exposes sensitive i...

The Mapster WP Maps plugin for WordPress, prior to version 1.24.0, is susceptible to an unauthorized access vulnerability. The plugin fails to implement necessary authorization or post-status checks on a public REST endpoint. This oversight permits unauthenticated users to access sensitive data, ...

The YOP Poll plugin for WordPress prior to version 7.0.6 is susceptible to a flaw that fails to properly validate the origin of connection IP addresses. This vulnerability allows unauthorized users to exploit the plugin's per-IP vote restrictions by trusting client-controlled forwarding headers. ...

The Booking for Appointments and Events Calendar plugin for WordPress prior to version 2.4.4 permits users with the Amelia Manager role to manipulate arbitrary fields in user records through its import feature. This vulnerability allows for unauthorized alterations, potentially compromising the i...

The Pixel Tag Manager for WooCommerce plugin prior to version 2.2.1 is susceptible to an authorization check failure in one of its AJAX actions. This vulnerability allows unauthenticated users to exploit the system by submitting forged e-commerce conversion events. The unauthorized use can lead t...

The Download Manager plugin for WordPress prior to version 3.3.66 contains a vulnerability where it fails to properly escape the titles of packages before rendering them on the frontend. This oversight allows users with the Author role or higher to inject arbitrary JavaScript into these titles. C...

The Event Tickets and Registration plugin for WordPress before version 5.29.0.1 features a significant security issue where it lacks authorization checks on its order-management REST endpoints. This deficiency enables unauthenticated users to manipulate the status of existing orders, potentially ...