Publicly Disclosed
PoC Exploits

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

Named Pipe File System Elevation of Privilege Vulnerability

The JetFormBuilder plugin for WordPress is exposed to a privilege escalation vulnerability due to inadequate validation of form IDs during submission. This flaw allows attackers, without authentication, to craft a request that creates an administrator-level user account, potentially compromising ...

The affected versions of cPanel and WHM contain a serious authentication bypass flaw in the login flow. This vulnerability enables unauthenticated remote attackers to bypass authentication mechanisms, allowing them to gain unauthorized access to the control panel. Users of the specified versions ...

A denial-of-service vulnerability has been identified in the Google Protocol Buffers library, specifically within the json_format.ParseDict() method in Python. This issue arises from a flaw in handling recursion depth when processing nested google.protobuf.Any messages. Attackers can craft deeply...

The TCH QRing smart ring model R20_B006, running firmware RT09R20_1.00.00_250318, exhibits a significant vulnerability that allows attackers within range to exploit the unsecured Nordic UART Service. This flaw permits nearby attackers to connect to the device without requiring any form of pairing...

Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...

ComfyUI versions prior to 0.30.0 have a vulnerability where the application fails to sanitize the 'folder_name' input in dataset save nodes, enabling attackers to exploit this flaw. By crafting a malicious workflow, an attacker can write files to unintended locations outside the designated output...

The vulnerability in changedetection.io versions up to 0.60.6 allows attackers to exploit the Goto URL action in browser steps without authentication. By manipulating the optional_value parameter, attackers can bypass URL validation and access sensitive internal resources. This flaw represents a ...

The Changedetection.io product, up to version 0.60.6, contains a vulnerability where it fails to properly escape scraped page titles in HTML notifications. This oversight can be exploited by attackers to inject malicious markup into monitored page titles. When the watch_title token is used in not...

Decap Server exhibits a path traversal vulnerability within its local proxy containment guard. This flaw stems from the use of string prefix comparison that does not validate path separators. As a result, attackers can exploit this vulnerability to navigate sibling directories that share the same...

The recent vulnerability in Metabase, affecting versions up to 0.63.18, stems from a failure to correctly validate GeoJSON URLs. By using the address 0.0.0.0 in custom GeoJSON entries, an unauthenticated attacker can orchestrate requests that connect to internal loopback services. This can lead t...

Versions 1.44.0 through 2.56.7 of Browserless are susceptible to a file protocol restriction bypass vulnerability. This flaw enables authenticated token holders to bypass file protocol restrictions on Playwright websocket endpoints, allowing them to access arbitrary files. Even with the ALLOW_FIL...

The PrestaShop psgdpr module versions up to 1.4.3 exhibit a vulnerability where the system fails to properly verify that GDPR consent log entries belong to the authenticated user. This flaw allows authenticated attackers to exploit the application by submitting arbitrary customer identifiers, res...

The PrestaShop Blockwishlist plugin prior to version 3.0.3 suffers from a vulnerability in the getUrlByIdWishListAction method. This flaw allows authenticated users to bypass ownership validation, leading to the exposure of private wishlists of other customers. By exploiting this, attackers can s...

Prior to version 3.6.17, phpList's mass subscriber removal form handler lacks sufficient validation for cross-site request forgery (CSRF) tokens. This flaw can be exploited by attackers who can manipulate authenticated administrators into visiting harmful websites. These crafted pages are designe...

In Suitenumerique's Docs prior to version 5.4.1, an access control vulnerability exists where revoked users can maintain real-time read and write capabilities through ongoing WebSocket sessions. This occurs when access is revoked at parent documents but not properly cascaded to sub-documents, all...

Manticore Search versions from 27.0.0 up to 28.4.3 exhibit a significant security flaw that fails to validate permissions across all statements in multi-statement SQL requests. This oversight permits read-only users to execute unauthorized queries by appending additional SELECT statements. As a r...

Wiki.js versions up to 2.5.314 exhibit a flaw in the authorization mechanism that fails to enforce strict path separation when applying START and END page rules. This oversight permits attackers to access and modify files that share similar prefixes with permitted folders, thereby circumventing a...

Wiki.js versions up to 2.5.314 are exposed to a server-side request forgery vulnerability within the Image Prefetch renderer. This issue allows attackers with page editing permissions to exploit the system by injecting img elements featuring the prefetch-candidate class. As a result, arbitrary UR...

Wiki.js versions prior to 2.5.314 present a significant flaw where page tags are not subjected to authorization checks within various GraphQL resolvers. This oversight permits attackers to bypass access restrictions based on tags, enabling unauthorized retrieval of sensitive page metadata such as...

Harbor versions up to 2.15.2 exhibit insufficient filtering of the q query parameter, allowing project administrators to exploit this weakness. By using fuzzy filtering on the AccessCredential column, attackers can extract the scanner adapter secret iteratively, character by character, leveraging...

A vulnerability exists in the Chatwoot application, particularly in the Shopify OAuth component, which may allow an attacker to exploit the system through server-side request forgery. This vulnerability is related to an unknown function in the callbacks_controller.rb file, enabling potential unau...

A type confusion issue in Apple's operating systems may allow an app to unexpectedly terminate system processes due to improper memory handling. This vulnerability affects several versions of iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple has addressed this issue in recent system updates ...

A security flaw identified in the itsourcecode Leave Management System version 1.0 allows attackers to exploit an unsanitized input in the /module/leave/index.php file. By manipulating the argument ID, remote attackers can execute SQL injection attacks, potentially gaining unauthorized access to ...

A significant weakness has been discovered in GPAC version 26.08-DEV, specifically affecting the function wait_for_header_and_parse in the src/utils/downloader.c file. This vulnerability allows attackers with local access to manipulate the Content-Range argument, resulting in an out-of-bounds rea...

A security vulnerability has been identified in GPAC 26.08-DEV, specifically within the Proto Link Handler component in the function gf_inline_get_proto_lib located in mpeg4_inline.c. This flaw can lead to a use after free scenario, where previously freed memory can be accessed, potentially resul...

A use after free vulnerability was detected in GPAC 26.08-DEV, specifically within the gf_sg_command_del function in the BIFS Handler component. This flaw allows a local attacker to manipulate the application, potentially leading to execution of unintended commands. The exploit is publicly availa...

A vulnerability exists in the GPAC MP4Box where the function gf_node_deactivate_ex located in src/scenegraph/base_scenegraph.c can lead to a use after free condition. This issue can be exploited locally, potentially allowing an attacker to manipulate the application's memory. The vulnerability ha...

A security vulnerability has been identified in the ChangeWeDer crm, specifically in the Save Endpoint feature. An issue with handling the customerName argument in the src/main/resources/public/js/customerServe/customer.serve.js file leads to a cross-site scripting (XSS) risk. This flaw allows re...

The SIMAC MyPHR 1.1 software is susceptible to an insecure direct object reference (IDOR) vulnerability. This flaw allows authenticated attackers to access and alter arbitrary employee records without proper server-side ownership validation. By sending a PUT request to the employee update endpoin...

A vulnerability has been identified in Artifex MuPDF affecting the PDF Xref Loading functionality. The flaw occurs in the 'pdf_open_filter' function within the 'pdf-stream.c' component. An attacker can exploit this vulnerability by executing a crafted manipulation, potentially leading to a null p...

A SQL injection vulnerability has been identified in the SourceCodester Inventory and Monitoring System version 1.0, specifically within a function in the /admins/assessments/databank/btn_functions.php file. This security flaw allows attackers to manipulate the 'difficulty_id' argument, which can...

A SQL Injection vulnerability has been identified in the SourceCodester Inventory and Monitoring System version 1.0, specifically within an unprotected function of the /index.php file. This weakness allows attackers to manipulate the Username argument, potentially gaining unauthorized access to s...

A vulnerability exists in GPAC version 26.07.0 within the WebSocket Handler, specifically in the rmt_client_handle_ws_frame function of the rmt_ws.c file. This vulnerability stems from the manipulation of the argument payload_size, leading to a heap-based buffer overflow. The exploit is remote an...

A significant OS command injection vulnerability has been identified in the Ruijie RG-EW3000GX device. This issue affects the admin component of the user_list_note module located at /etc/rg_config/admin. By manipulating the argument Name, an attacker can execute arbitrary OS commands through remo...

A security flaw has been identified in the Ruijie RG-EW3000GX, specifically within the cc_set function of the unifyframe-sgi.elf component, where improperly validated input allows attackers to inject operating system commands. This command injection vulnerability enables remote exploitation, pote...

A vulnerability exists in the SourceCodester Online Food Ordering System 1.0 that allows for cross-site scripting (XSS) attacks through the manipulation of the /admin/update_category.php file. This issue occurs due to an unknown function within the system, enabling attackers to execute arbitrary ...

The vulnerability occurring in UNISOC's BootRom allows a possible unchecked write address, enabling local escalation of privilege without requiring additional execution privileges. This flaw poses a significant security risk, as it can be exploited by malicious actors to gain unauthorized access ...

A security vulnerability has been identified in PbootCMS affecting versions up to 3.2.24, specifically within the UserController module. The vulnerability originates from inadequate validation within functions responsible for user deletion and modification, exposing the application to cross-site ...

The vulnerability in WSO2 products relates to the JWT authentication mechanism, which improperly validates tokens signed with algorithms not explicitly configured or supported. This flaw enables an attacker to create a JSON Web Token (JWT) using an unsupported signing algorithm. If an attacker su...

A cross site scripting (XSS) vulnerability has been identified in the PbootCMS framework affecting the decode_string function within the Template Rendering component. Specifically, the issue is present in apps/admin/controller/content/ContentController.php, where the manipulation of the 'Title' a...

A security flaw in WuzhiCMS versions up to 4.1.0 has been identified within the Remote Image Fetch component, specifically in the function `ckditor::saveRemote`. This vulnerability allows attackers to manipulate the `source[]` argument, potentially leading to server-side request forgery (SSRF) at...

A significant SQL injection vulnerability exists in the Regular Search component of Code-Projects' Matrimonial System 1.0. This flaw allows remote attackers to manipulate parameters such as sex, mothertongue, marital status, country, state, religion, agemin, and agemax, leading to unauthorized ac...

The vulnerability in the TLS and DTLS implementations of OpenSSL versions prior to 1.0.1g allows remote attackers to exploit crafted Heartbeat Extension packets. This exploitation results in a buffer over-read, potentially revealing sensitive information from the memory of the affected process. A...

A flaw in the Avast sandbox minifilter driver allows a local, low-privileged attacker operating within the sandbox environment to escape file isolation. This vulnerability arises from improper handling of security descriptors when virtualizing files. By neglecting to apply necessary permissions, ...

A vulnerability has been identified in the itsourcecode Leave Management System version 1.0, specifically affecting the file located at /module/employee/index.php. This vulnerability arises from improper handling of the ID argument, which allows for SQL injection attacks. Attackers can exploit th...

The zlt2000 microservices-platform's file-center module up to version 6.0.0 contains a significant vulnerability that allows authenticated users to delete files belonging to other users. The DELETE /files/{id} endpoint lacks proper ownership verification, enabling attackers to exploit this oversi...

The zlt2000 Microservices-Platform version 6.0.0 exposes an authorization bypass vulnerability in the search-center service. This flaw allows authenticated users to gain unauthorized access to sensitive Elasticsearch indices by manipulating the index name in specific API request paths. Attackers ...

The zlt2000 Microservices-Platform version 6.0.0 exposes an authorization bypass vulnerability in the search-center service. This flaw allows authenticated users to gain unauthorized access to sensitive Elasticsearch indices by manipulating the index name in specific API request paths. Attackers ...