Publicly Disclosed
PoC Exploits

A vulnerability in the Qihoo 360 Whole Home Router M5 affects the boot script, exposing hard-coded credentials. This flaw enables remote exploitation, potentially allowing unauthorized access to the router's functionalities. The vendor, Qihoo 360, was notified but has not addressed the issue publ...

A security vulnerability has been identified in Qihoo 360 Smart Cameras that affects versions D603-2, D600-2, and D606-6 up to 6.3.2. The vulnerability resides in the function on_push_message found in the file /fs2/bin/iscm, specifically within the Timezone Push Handler component. An attacker cou...

A vulnerability exists in Qihoo 360 products, specifically within the function testspeed_command located in the /fs2/bin/iscm file. By manipulating the argument 'host', an attacker can execute arbitrary OS commands, potentially allowing for remote exploitation. This flaw affects versions of the D...

A critical vulnerability exists in several Qihoo 360 devices due to the improper verification of cryptographic signatures within the Firmware Signature Verification component. This vulnerability is exploitable remotely, allowing attackers to manipulate the verification function and potentially co...

A vulnerability has been identified in the TOTOLINK A950RG router, specifically in version 4.1.2cu.5268_B20221104. The flaw resides in the MAC Filter Handler component, within the setMacFilterRules function found in /cgi-bin/cstecgi.cgi. This issue allows attackers to manipulate the argument 'add...

A vulnerability exists in the TOTOLINK A950RG router that affects its Multi-SSID Configuration functionality. Specifically, the setWiFiMultipleConfig and delWiFiMultipleConfig functions located in /cgi-bin/cstecgi.cgi are susceptible to a stack-based buffer overflow due to improper handling of th...

A vulnerability exists in the TOTOLINK A950RG router, specifically within the Basic Wireless Configuration Handler's strcpy function in the cstecgi.cgi file. This flaw allows an attacker to exploit the wepkey argument, resulting in a stack-based buffer overflow. This vulnerability can be initiate...

A security vulnerability has been identified in InfiniFlow RAGFlow, affecting versions up to 0.27.2 and 1.0.0-rc2. The flaw is located in the 'RunSQL' function within the 'internal/engine/infinity/sql.go' file, enabling an attacker to manipulate the 'tableName/kbIDs' arguments, which may result i...

A vulnerability exists in the Umami analytics platform affecting versions up to 3.4.1, specifically within the Record API Endpoint's function in src/app/api/record/route.ts. This security flaw allows an unauthorized entity to manipulate the 'Website' argument, resulting in an authorization bypass...

The SourceHut meta.sr.ht application versions prior to 0.89.0 are prone to an authorization bypass vulnerability. When public registration is disabled, attackers can still create accounts by leveraging the /login endpoint to obtain a CSRF token. They can then exploit the unchecked GraphQL Registe...

A vulnerability has been identified in the Provider Test-Connection Endpoint of ArcReel versions 0.32.0 to 0.34.0. This vulnerability allows for server-side request forgery, potentially enabling remote attackers to manipulate server requests. The affected endpoint, located at /api/v1/providers/{i...

A vulnerability exists in MiroTalk P2P prior to version 2.0.87, which impacts the Room Action Handler's checkPassword function. This flaw allows for excessive authentication attempts, opening doors to potential unauthorized access. Remote attackers can exploit this vulnerability, although the com...

A vulnerability has been identified in Umami versions 3.3.x, 3.4.0, and 3.4.1, specifically within the 2FA Policy Handler component located at src/app/api/auth/login/route.ts. This flaw allows attackers to bypass two-factor authentication, reverting to single-factor authentication mechanisms. The...

A vulnerability has been identified in the Sumiie24 School-Management-System, specifically within the public search feature's parent_Login.php file. This flaw permits an attacker to manipulate the email argument, leading to a potential SQL injection. Such an attack can be executed remotely, expos...

A heap-based buffer overflow vulnerability has been identified in IrfanView version 4.76.0.0 specifically affecting the TIFF Wang Annotation Handler component. This vulnerability allows for potential manipulation that can be exploited remotely, although achieving successful exploitation is comple...

A security flaw in the Headless CMS Plugin for WordPress, specifically affecting versions up to 2.0.4, has been identified. This vulnerability resides in the get_required_post_data function within the REST API component, located at /wp-json/rae/v1/post. By manipulating the post_id or post_slug pa...

A vulnerability exists in earlier versions of Git that affects the handling of repositories with submodules. Specifically, it can be exploited to redirect file writes to the `.git/` directory rather than the intended submodule's worktree. This exploit enables the potential execution of unauthoriz...

A vulnerability exists in Git that affects how configuration values are read and written, particularly regarding trailing carriage returns. When a submodule path includes a trailing carriage return, it is altered when read back, which can cause the submodule to be checked out to an incorrect loca...

A SQL injection vulnerability was discovered in the CloudClassroom-PHP-Project, specifically affecting the facultydetails.php file. This vulnerability arises from improper handling of the 'deleteid' argument, which can be exploited remotely to manipulate database queries. Because the product oper...

Vembu BDRSuite, prior to version 7.6.0, is affected by an unauthenticated cross-site scripting vulnerability arising from insufficient input validation in the restoreprogress.sgp file. Attackers can exploit this flaw by manipulating request parameters, allowing them to inject arbitrary JavaScript...

A session fixation vulnerability has been discovered in the mathurvishal CloudClassroom-PHP-Project. The flaw lies within the `session_regenerate_id` function, specifically in the `loginlinkadmin.php` file. An attacker can exploit this vulnerability by manipulating the `PHPSESSID` argument, leadi...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability has been identified within phpMyAdmin's MoTranslator, specifically in the Loader::getTranslator function located in motranslator-master/src/Loader.php. By manipulating the locale argument, an attacker may exploit the vulnerability to gain unauthorized access to files on the server...

The Bagisto eCommerce platform versions prior to 2.3.16 and 2.4.1 are vulnerable to a race condition in the manageCartRule() function. This vulnerability allows attackers to exploit single-use coupons by submitting concurrent order requests. As a result, attackers can bypass existing checks in th...

A vulnerability exists in the phpMyAdmin SQL-Parser affecting versions 6.0.0 and 6.0.1, specifically within the 'parse' function of the ExplainStatement.php file. This vulnerability allows for the manipulation of the 'nextToken' argument, resulting in an incorrect type conversion. Attackers can e...

A vulnerability exists in the ShapeFile component of phpMyAdmin, specifically in the ShapeRecord::loadFromFile function. This flaw allows remote attackers to manipulate the file handling process, potentially leading to an infinite loop condition. The issue has been made public, and there has been...

A code injection vulnerability exists in the Lua Handler of the Ziroom ZHOME A0101, specifically in the loadstring function within the file usr/lib/lua/luci/controller/api/zrUsb.lua. This flaw allows attackers to manipulate the software to execute arbitrary code remotely. Exploitation is feasible...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

The Eupago Gateway for WooCommerce plugin versions 4.5.0 through 4.7.5 is vulnerable to a significant security flaw that allows attackers to bypass payment confirmation verification. This vulnerability enables unauthenticated malicious actors to manipulate incoming payment-confirmation webhook re...

The CryptoCloud WordPress plugin versions 3.0.0 to 3.0.1 contains a significant security flaw that stems from the absence of authentication checks for payment notifications received from its gateway callback. This vulnerability arises because the integrity verification process is not implemented,...

OpenIdentityPlatform's OpenAM, an access management solution, is susceptible to a pre-authentication Remote Code Execution vulnerability due to unsafe Java deserialization. This issue arises from the handling of the jato.clientSession HTTP parameter, allowing unauthenticated attackers to execute ...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

The weMail WordPress plugin version 2.1.6 is susceptible to an access control misconfiguration that fails to accurately verify user capabilities within its REST API permission checks. This flaw permits users assigned roles listed in the allowed-roles list, which includes roles like Editor and abo...

The WATI Chat and Notification WordPress plugin, up to version 1.1.8, has a significant vulnerability where it does not enforce authentication on a public endpoint that exposes its stored API token. This lack of security allows unauthenticated attackers to exploit the endpoint, retrieve the API t...

The weMail plugin for WordPress prior to version 2.1.6 contains a significant vulnerability that allows users with Editor roles to access a site-wide third-party email-service API key. This unrestricted access can lead to unauthorized actions as the key can be used to impersonate other users with...

The DT LMS WordPress plugin up to version 1.2 is vulnerable to an improper authorization issue, where lack of capability and nonce checks on an AJAX action permits unauthenticated attackers to revoke course and class completion statuses of learners. This vulnerability exposes the system to unauth...

The DT Directory Lite Addon for WordPress lacks essential nonce and capability checks in its settings handlers. This oversight permits unauthenticated attackers to alter the configuration and skin options of the plugin, potentially leading to unauthorized changes that could compromise site functi...

The Gallery for Social Photo plugin for WordPress, up to version 1.0.0.41, contains a flaw that permits unauthenticated attackers to manipulate server-side requests. The vulnerability arises from the inadequate validation of user-supplied URLs, enabling attackers to make requests to arbitrary int...

The AZEXO Store Locator plugin for WordPress, specifically version 1.4, is affected by an authorization bypass vulnerability that enables any authenticated user, including subscribers, to delete posts and pages without proper capability checks. This lack of authorization control poses a significa...

An improper authentication vulnerability exists in the Danfoss AK-SM 8xxA Series, which can allow unauthorized access to sensitive functions within the affected products. This vulnerability risks the security of controlled environments, potentially leading to exposure of critical data and operati...

Codefriar sf-mcp before version 1.3.3 is vulnerable to an OS command injection attack. This vulnerability arises due to improper handling of inputs in the escapeValue() function within src/utils.ts, which fails to neutralize shell metacharacters such as backticks and $() substitutions. Attackers ...

A vulnerability exists in Payload CMS affecting versions between 3.0.0 and 3.90.0. This flaw allows for a custom field option to unintentionally influence authentication claims in login tokens, compromising the integrity of user authentication. Users are advised to upgrade to version 3.90.0, wher...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A security flaw exists in the Next.js framework that allows an attacker to bypass authorization checks if such checks are implemented in middleware. This vulnerability arises in versions prior to 14.2.25 and 15.2.3. To mitigate risk, it is recommended to restrict incoming requests that include th...

Greenshot versions 1.2.10 and earlier are vulnerable due to insecure deserialization of .greenshot files. This flaw could allow an attacker to execute arbitrary code on the user's system by crafting a malicious .greenshot file. When opened, the application fails to properly validate the data, cre...

A vulnerability in the Welcart e-Commerce Plugin allows attackers to execute cross-site scripting (XSS) attacks by manipulating the ResponseCd argument in the error_page_message function of the classes/paymentESCOTT.main.class.php file. This vulnerability can be exploited remotely, and the exploi...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability was identified in EchoHS GeekezBrowser versions up to 1.7.2 and 1.8.0, affecting the Public API component's /api/status file. This flaw could enable attackers to disclose sensitive information through local exploitation methods. To address this issue, users are strongly advised to...

ReadyMedia versions 1.3.0 through 1.3.3 are susceptible to a stack-based buffer overflow vulnerability that can be exploited by remote attackers. This flaw occurs when a specially crafted DFF audio file containing an oversized PROP chunk size is processed. The vulnerability allows attackers to ma...