Publicly Disclosed
PoC Exploits

A security vulnerability has been identified in the onetwothreeneth HospitalManagementSystem, specifically within the php/sessions.php file. The vulnerability arises from improper handling of the ID argument, allowing for potential unauthorized access. This flaw enables remote attackers to exploi...

The Divi Membership plugin for WordPress has a critical vulnerability that allows unauthenticated attackers to bypass authentication processes, enabling them to log in as any existing user, including administrators. This issue arises from a flaw in how the `process_paypal_callback` function handl...

A vulnerability has been identified in the onetwothreeneth HospitalManagementSystem, where the functions responsible for managing patient and physician data suffer from an unrestricted file upload issue. This weakness resides in the php/controller.php file, particularly within the functions add_p...

A security flaw has been identified in the CodeAstro Simple Loan Management System version 1.0, specifically within an unidentified function in the /admin/index.php file. This vulnerability allows attackers to carry out SQL injection attacks by manipulating the 'g_name' argument, potentially lead...

An SQL injection vulnerability has been identified in the CodeAstro Simple Pharmacy Management System version 1.0. This vulnerability arises from improper handling of the ID parameter in the file /SimplePharmacy-PHP/product/delete.php, which allows remote attackers to manipulate the SQL query exe...

The Simple Pharmacy Management System by CodeAstro, version 1.0, contains a vulnerability that can be exploited through an SQL injection attack via the view.php file. This vulnerability allows an attacker to manipulate the ID argument, potentially leading to unauthorized access to sensitive data....

A vulnerability exists in the SourceCodester Student Result Management System version 1.0, specifically within the Announcement Module's new_announcement.php file. This weakness allows remote attackers to execute cross site scripting (XSS) attacks by manipulating the 'title' or 'announcement' arg...

A vulnerability exists in the Tenda AC9 router, specifically in the POST Request Handler component found at /goform/fast_setting_internet_set. This vulnerability arises when an attacker manipulates the netWanType argument, leading to a stack-based buffer overflow. The exploit can be executed remo...

A critical security vulnerability exists in Tenda's HG7, HG9, and HG10 routers, specifically within the function boaGetVar of the Boa Web Server component. This vulnerability allows an attacker to manipulate the Ethtype argument, resulting in a stack-based buffer overflow. The nature of this vuln...

A critical security weakness has been detected in the onetwothreeneth HospitalManagementSystem affecting the edit_accounts.php file's get function. This flaw occurs due to improper handling of query parameters such as user_id, patient_id, physician_id, discounts_id, and services_id, which allows ...

A vulnerability exists in the itsourcecode Online Admission System Project version 1.0, specifically within the confirm.php file. An unknown function in this file processes an argument ID, which can be manipulated to execute SQL injection attacks. This flaw allows unauthorized users to potentiall...

The Gotenberg PDF API, a Docker-based tool for PDF file processing, has a significant vulnerability affecting versions 8.30.1 and earlier. It allows unauthenticated attackers to exploit the metadata write endpoint, which inadequately sanitizes metadata values. By including a newline character in ...

The MStore API WordPress plugin prior to version 4.22.1 is susceptible to a user manipulation vulnerability that permits any authenticated user with a self-registerable account to alter the status of their own unpaid orders. This flaw enables individuals to change their order status to 'paid' or ...

The Unlimited Elements for Elementor WordPress plugin is affected by a vulnerability allowing unauthorized users, including those with minimal permissions such as 'subscriber', to execute arbitrary shortcodes on the site. This flaw arises from inadequate validation of requests made to render widg...

The WebToffee Gift Cards for WooCommerce plugin prior to version 1.3.1 fails to adequately validate user-provided gift card amounts on the server side. This oversight permits unauthenticated users to input arbitrary or negative amounts, sidestepping the established denominations set by the store....

The Easy PayPal & Stripe Buy Now Button WordPress plugin, prior to version 2.0.6, contains a vulnerability where the payment amount is derived directly from a client-supplied field. This design flaw allows unauthenticated attackers to manipulate the payment amount, enabling them to set an arbitra...

The WP Edit Password Protected WordPress plugin prior to version 2.0.7 suffers from an access control bypass issue, failing to properly enforce site-wide restrictions on the WordPress REST API. This flaw permits unauthenticated attackers to gain unauthorized access to the content of published pos...

The Events Calendar plugin for WordPress, in versions prior to 6.17.5.1, is prone to a vulnerability that allows unauthenticated users to submit data through an AJAX action without proper validation or sanitization. This can lead to unauthorized execution of arbitrary shortcodes registered on the...

The Popup Maker WP plugin for WordPress prior to version 1.4.5 lacks proper authorization checks on multiple actions, leaving its management interface exposed to any logged-in user. This exploitation allows individuals with low-privileged roles, such as Subscribers, to manipulate display-targetin...

The WP User Frontend plugin for WordPress, prior to version 4.3.12, contains a flaw in its post-creation handler, permitting authenticated users with subscriber-level access and above to create and publish posts through forms intended for paying subscribers only. This vulnerability circumvents th...

The CMP – Coming Soon & Maintenance plugin for WordPress prior to version 4.1.20 suffers from an access control vulnerability. When the plugin is activated in maintenance or coming-soon mode, it fails to adequately restrict access to the site. This allows unauthorized users to bypass the intended...

The WP Mail Logging plugin for WordPress, prior to version 1.17.0, is susceptible to an HTML injection vulnerability. This flaw arises from inadequate restrictions on the HTML and CSS of logged emails, which are displayed on admin log screens. An attacker can exploit this vulnerability by sending...

The Giveaways and Contests by RafflePress plugin for WordPress versions prior to 1.12.27 lacks proper validation for a giveaway's parent page URL during the saving process. This vulnerability allows unauthenticated attackers to manipulate the site's giveaway confirmation and referral URLs, potent...

The BuildKit WordPress plugin prior to version 1.0.29 lacks necessary data sanitization and escaping for user inputs submitted by contributors. This oversight allows unauthorized SQL code injection, leading to potential database manipulation and exposure of sensitive information. Once the malicio...

The Giveaways and Contests by RafflePress WordPress plugin prior to version 1.12.27 fails to adequately secure the reCAPTCHA secret key, which is unintentionally exposed on public giveaway pages. This oversight allows unauthorized users to access the secret key associated with any active giveaway...

The OMGF plugin, designed for GDPR/DSGVO compliance and improved Google Fonts integration, is prone to a vulnerability that allows unauthenticated attackers to initiate a specific action without requiring authentication or a valid nonce. This action generates a slow server-side loopback request t...

A code injection vulnerability has been identified in the Unlimited Elements for Elementor WordPress plugin before version 2.0.21. This flaw arises from inadequate escaping of an icon value in the plugin's shared widget-parameter processor. As a result, authenticated users with Contributor access...

The Motors WordPress plugin, prior to version 1.4.124, contains a significant authorization flaw that permits authenticated attackers, with subscriber-level access or higher, to alter post metadata without the necessary permissions. This vulnerability is especially critical when the WooCommerce i...

The Motors WordPress plugin prior to version 1.4.124 contains a security flaw that fails to properly sanitize and escape a listing badge setting before it is rendered within an HTML attribute. This oversight enables users assigned to specific listing-management roles to inject malicious web scrip...

The Paytm Payment Gateway plugin for WordPress prior to version 2.8.9 exhibits a critical flaw in its payment callback verification process. When the plugin is activated without configuring the secret key, it fails to authenticate incoming payment callbacks from the payment provider. This oversig...

The Popup Maker plugin for WordPress, specifically version 1.4.5, lacks adequate capability checks on certain account-connection actions. This oversight permits authenticated users with minimal privileges, such as Subscribers, to alter crucial site-wide Popup Maker configurations, including linke...

The Request a Quote plugin for WordPress through version 2.5.6 is susceptible to an authorization bypass flaw in its unauthenticated AJAX handler. This security issue permits unauthorized users to access sensitive contact records from quote-request submissions, which can include unpublished infor...

The Tabs Responsive WordPress plugin, up to version 2.5, has a cross-site scripting vulnerability that arises from improper sanitization of WooCommerce product tab contents. This allows a shop manager to inject harmful JavaScript, posing a risk to all users, including administrators, when they vi...

ModSecurity, an open source web application firewall engine utilized with Apache, IIS, and Nginx, presents a vulnerability that can lead to a denial of service condition under specific circumstances. This occurs in versions up to and including 2.9.8 when processing requests with the content type ...

A vulnerability has been identified in the SourceCodester Online Reviewer Management System version 1.0. Specifically, the issue arises from the file located at /reviewer_0/admins/assessments/activities/btn_functions.php, where manipulation of the 'Title' argument leads to SQL injection. This typ...

The JBoss RichFaces framework versions 3.1.0 to 3.3.4 are susceptible to an expression language injection vulnerability. This flaw allows unauthenticated remote attackers to inject EL expressions and potentially execute arbitrary Java code. This can occur when the application processes paths that...

A security flaw has been identified in ModelContextProtocol's Fetch Tool, affecting versions up to 2026.6.4. The vulnerability resides in the fetch_url function within the server.py file of the mcp-server-fetch and mcp-server-everything components. Attackers can manipulate the url/path argument, ...

A vulnerability has been identified in Calcom's Cal.diy product, specifically in versions up to 6.2.0. The flaw resides in the function doesUserIdHaveAccessToBooking within the PBAC Permission Engine, which fails to properly enforce access controls. This oversight allows an attacker to initiate u...

A SQL injection vulnerability has been identified in the itsourcecode Pet Shop Management System version 1.0. This issue arises from an unknown function in the file admin_reject_completed.php, where improper handling of the ID argument allows attackers to manipulate SQL queries. As a result, it i...

An unauthenticated Remote Code Execution vulnerability affects REDCap, enabling attackers to exploit the survey passthrough routing and Data Import processing. By manipulating HTTP requests, a malicious user can target an unintended controller route from a public survey context and provide a craf...

ClipBucket versions 5 through 5.5.3-#197 are susceptible to an SQL injection vulnerability that potentially allows authenticated users with ad_manager_access permission to manipulate SQL queries via the delete parameter in admin_area/ads_manager.php. By leveraging time-based blind payloads, attac...

GLPI, an open-source asset and IT management software, is susceptible to template injection through administrator actions, allowing for remote code execution. This vulnerability affects versions 11.0.0 to 11.0.5 and has been resolved in version 11.0.6. Users of affected versions are advised to up...

The Balbooa Forms extension for Joomla has a vulnerability that allows unauthenticated remote code execution (RCE) due to improper handling of PHP code submission. This issue arises when the product supports administrator-defined PHP code that executes after a public form submission. By manipulat...

An improper input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway, enabling unauthenticated attackers to execute arbitrary commands. This potentially compromises system integrity and security, allowing unauthorized control over the affected product.

A vulnerability in the Apache Camel Quarkus XSLT support extension allows attackers to read local files or issue requests to internal network locations through XML external entity declarations. This weakness exists due to the extension's use of an outdated TransformerFactory that does not adhere ...

A vulnerability exists in itsourcecode Leave Management System version 1.0 that allows for SQL injection through manipulation of the LEAVEID argument in the controller.php file. Attackers can exploit this flaw remotely, potentially leading to unauthorized access and data manipulation. The exploit...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability exists in the Rhukster DOM-Sanitizer component related to SVG sanitization. The flaw lies in the handling of the function 'url' in the src/DOMSanitizer.php file, which creates an incomplete blacklist for input validation. This allows a potential attacker to exploit the vulnerabili...

Sharp and Toshiba Tec multifunction printers are susceptible to an unauthenticated local file inclusion vulnerability. This issue arises from improper validation of user input in the installed_emanual_down.html endpoint. By manipulating the path parameter, attackers can execute directory traversa...

A security flaw exists in rhukster's dom-sanitizer component, specifically in the URL validation functionality. The issue lies within the DOMSanitizer::isDangerousUrl method, which can be exploited for cross-site scripting attacks. This vulnerability can allow attackers to initiate remote exploit...