Publicly Disclosed
PoC Exploits

The Expat library, also known as libexpat, versions prior to 2.4.5 contain a vulnerability that allows attackers to insert namespace-separator characters into namespace URIs. This attack vector can lead to various security issues, such as XML parsing attacks, which could compromise the integrity ...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with...

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

The Zip implementation within Rust's standard library, prior to version 1.52.0, contains a flaw that can manifest as an integer overflow when processing Zip file sizes. This can result in the library returning an erroneous size, which may ultimately lead to a buffer overflow vulnerability if a Zi...

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

The Rust standard library prior to version 1.77.2 is susceptible to a vulnerability involving improper escaping of arguments when executing batch files on Windows using the `Command` API. This vulnerability arises from the unique way Windows processes command-line arguments, particularly with `cm...

The HTTP/2 protocol is susceptible to a denial of service vulnerability that can be exploited via rapid stream resets. This allows attackers to overwhelm servers by rapidly canceling requests, leading to significant resource consumption and potential service disruption. Exploitation of this vulne...

The vulnerability in the SSH transport protocol with specific OpenSSH extensions may allow remote attackers to circumvent integrity checks, leading to the omission of some packets during the extension negotiation phase. Consequently, a client and server may establish a connection where certain se...

The Hisense VIDAA Smart TV firmware exhibits an authentication bypass vulnerability within its remote-control MQTT broker on TCP port 36669. This flaw allows attackers to exploit default credentials and an inadequate 4-digit pairing PIN that lacks rate limiting or lockout features. Consequently, ...

The ERPNext OCR app for Frappe/ERPNext version 1.1.1 is susceptible to a path traversal vulnerability that permits any authenticated user to access arbitrary server files. This occurs through the exploitation of the whitelisted read_document method, where attackers can leverage client-controlled ...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

The Dell Wyse Management Suite prior to version 5.5 is prone to a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially exploit the system, which could lead to an Elevation of Privileges. It is crucial for users to upgrade to the latest ...

A manipulation of the chapterId argument within the getBookChapter function of the Book Chapter Read Handler in the XXYOpen novel software up to version 3.5.0 presents a serious authorization bypass vulnerability. This flaw allows remote attackers to gain unauthorized access to content. The vulne...

A vulnerability in the Book Content Service by xxyopen allows attackers to manipulate the chapterId argument in the BookServiceImpl.getBookContentAbout function, leading to improper authorization. This vulnerability can be exploited remotely, potentially allowing unauthorized access to sensitive ...

A code injection vulnerability has been discovered within the OpenBMB Internet of Agents software, specifically affecting the Code Executor Tool. This flaw arises in the execute_code function located in the code_executor.py file. By manipulating the argument 'filename/lang,' an attacker could pot...

A security flaw in the NASA-GCN Email Notification Handler allows for improper authorization through manipulation of the Recipient argument in the /user/email file. This vulnerability can be exploited remotely, potentially leading to unauthorized access and actions. The product follows a rolling ...

A newly discovered vulnerability in esengine's DeepSeek-Reasonix product allows for improper handling of user inputs in the discoverDocs function located in internal/memory/doc.go. This security flaw can be exploited remotely, leading to significant risks if left unaddressed. The vulnerability pr...

MacCMS v10 prior to version 2026.1000.4054 is susceptible to an authentication bypass vulnerability that enables attackers to reset passwords for any user account. This flaw arises from the improper handling of the password recovery process where the check_msg() function fails to validate the com...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

An insufficient authentication and access control vulnerability exists within the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server. This flaw allows an unauthenticated attacker to interact with sensitive internal functions, potentially leading to unauthorized access and manipu...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

The Quick Event Manager plugin for WordPress, prior to version 9.19, has a vulnerability where it fails to verify the authenticity of PayPal payment notifications. This flaw allows unauthenticated attackers to manipulate the system, marking event registrations as paid without genuine payment bein...

The Order Tracking Plugin for WordPress allows unauthenticated users to mark orders as paid without proper verification. Versions before 3.6.0 do not ensure that a PayPal payment notification corresponds with the merchant's account or matches the total order amount. This security flaw can be expl...

The WP Libre Form plugin version 1.5.0.1 fails to properly validate uploaded file types, allowing unauthenticated users to upload malicious PHP files to accessible directories. This flaw can lead to unauthorized execution of remote code, compromising the security of the web application and potent...

The MC4WP: Mailchimp for WordPress plugin prior to version 4.15.0 is vulnerable to a code injection flaw. This issue arises when request-derived values in dynamic content tags are processed as shortcodes, which allows unauthenticated users to execute arbitrary shortcodes with attributes specified...

A vulnerability exists in the MDJM Event Management and Mobile Events Manager WordPress plugins that allows unauthorized users to execute role deletion requests on every page load. This security issue arises because the plugin does not perform any capability checks or validate requests using a no...

The MDJM Event Management and Mobile Events Manager plugins for WordPress, up to version 1.7.8.7, lack proper validation of user inputs when creating roles. This weakness allows any authenticated user, including those with minimal privileges like subscribers, to inject arbitrary web scripts into ...

The MDJM Event Management and Mobile Events Manager plugins for WordPress, prior to version 1.7.8.7, contain a significant security flaw that fails to verify ownership or user capabilities during client profile updates. This vulnerability allows any authenticated user, including subscribers, to a...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

The Mailchimp for WordPress plugin prior to version 4.15.0 has a security flaw where it fails to properly validate the Mailchimp audience associated with email sign-up forms. This oversight permits unauthenticated individuals to subscribe any email address to audiences in the connected Mailchimp ...

The PublishPress Revisions plugin for WordPress, prior to version 4.3.1, contains a vulnerability that allows users with limited editing capabilities, such as Contributors, to publish content without proper oversight. This flaw bypasses the established editorial approval process, enabling unrevie...

The PublishPress Revisions plugin for WordPress, specifically versions before 4.3.1, exhibits a significant flaw where it fails to adequately verify user permissions for accessing post content. This oversight permits any authenticated user, including those with minimal roles such as Subscribers, ...

The AutomatorWP plugin for WordPress prior to version 6.0.7 contains a significant access control flaw. This vulnerability enables unauthenticated attackers to exploit the plugin’s Zoom and AWeber integration functionalities by replacing the authenticated user's stored credentials with their own....

The PublishPress Revisions plugin prior to version 4.3.1 is susceptible to an access control flaw that allows users with contributor-level or higher permissions to duplicate posts that they do not own. This vulnerability permits unauthorized access to private, draft, pending, or scheduled posts, ...

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon for WordPress, prior to version 2.4.4, contains a security vulnerability in its AJAX actions. This flaw arises from inadequate validation of user capabilities and the ownership of targeted posts. Specifically, it fails to ensure that users...

The GS JWT Authentication for WP REST API WordPress plugin, versions up to 1.0.0, is susceptible to SQL injection due to insufficient sanitization and parameterization of request values within several unauthenticated REST routes. This flaw permits unauthenticated attackers to craft malicious quer...

A vulnerability in the CleanTalk Anti-Spam WordPress plugin prior to version 6.91 allows unauthenticated users to exploit the application by injecting arbitrary web scripts. The plugin fails to adequately escape user input on the administrative spam-review screen, potentially leading to the execu...

The Advanced Custom Fields (ACF) WordPress plugin prior to version 6.8.11 is susceptible to a cross-site scripting (XSS) vulnerability. This occurs due to inadequate sanitization of stored field definitions that can be manipulated via comment handling. Consequently, unauthenticated users are capa...

The Surfer WordPress plugin prior to version 1.8.1.759 contains a vulnerability that inadvertently exposes sensitive API credentials to users with limited access, such as contributors. This exposure occurs through the post editor page. The vulnerability relies on these credentials as the only mea...

The All-in-One Video Gallery plugin for WordPress before version 5.1.0 fails to properly escape video thumbnail URLs when displaying them in the admin video list. Additionally, the plugin does not sanitize these URLs when written outside its editor, empowering users with minimal permissions, such...

The All-in-One Video Gallery plugin for WordPress prior to version 5.1.0 has an improper input validation flaw that allows unauthenticated users to manipulate the metadata related to view count and video duration for any post. This vulnerability enables attackers to modify even private or draft p...

A security issue in the WCFM Membership WordPress plugin before version 2.12.1 allows authenticated users with Subscriber or Customer roles to bypass payment verification. This flaw enables these users to activate a paid vendor membership without completing the payment process, effectively granti...

The iubenda plugin for WordPress versions prior to 3.13.7 contains a security flaw that fails to properly sanitize user input in its integrated HTML parser. This vulnerability enables unauthorized users to inject malicious scripts into web pages, which can be executed in the browser sessions of a...

The Cool Media Filter WordPress plugin, up to version 1.0.1, lacks proper capability and nonce verification when updating user roles. This allows any authenticated user, including those with lesser privileges, to escalate their permissions and assume administrative roles, potentially leading to f...

The Static Snapshot plugin for WordPress prior to version 0.2.1 is susceptible to a command injection vulnerability. This arises from the improper sanitization of shell metacharacters in user-supplied inputs. As a result, unauthorized users can exploit this weakness to execute arbitrary commands ...

The Ever Accounting plugin for WordPress prior to version 2.3.3 is susceptible to an improper input validation vulnerability in its CSV import routine. This flaw allows users with the custom Accounting Manager role, which lacks administrative privileges, to specify unrestricted file paths. Conseq...

The WHIZZ WordPress plugin version 1.1.8 has a significant security vulnerability that fails to properly validate the password-reset key. This oversight allows attackers, who do not need authentication, to exploit a nonce exposed to unauthorized users. Consequently, they can reset passwords for a...