Publicly Disclosed
PoC Exploits

Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft reques...

The Weaver E-cology mobile plugin is susceptible to an unauthenticated SQL injection vulnerability that enables remote attackers to execute arbitrary SQL commands. By manipulating the userIdentifiers GET parameter, attackers can exploit this flaw to perform UNION-based injections, effectively byp...

The Weaver E-cology mobile plugin is susceptible to an unauthenticated SQL injection vulnerability that enables remote attackers to execute arbitrary SQL commands. By manipulating the userIdentifiers GET parameter, attackers can exploit this flaw to perform UNION-based injections, effectively byp...

The Hongjing e-HR software prior to version 8.2 is susceptible to a SQL injection vulnerability located at the /servlet/codesettree endpoint. This flaw allows an unauthenticated remote attacker to inject a crafted UNION SELECT statement through the categories query parameter, potentially exposing...

The Hongjing e-HR software prior to version 8.2 is susceptible to a SQL injection vulnerability located at the /servlet/codesettree endpoint. This flaw allows an unauthenticated remote attacker to inject a crafted UNION SELECT statement through the categories query parameter, potentially exposing...

The Hongjing e-HR software prior to version 8.2 is susceptible to a SQL injection vulnerability located at the /servlet/codesettree endpoint. This flaw allows an unauthenticated remote attacker to inject a crafted UNION SELECT statement through the categories query parameter, potentially exposing...

A vulnerability exists in certain versions of Saleor, specifically within the get_client_ip function in throttling.py. This issue can lead to inadequate restrictions on excessive authentication attempts, allowing remote exploitation. The complexity of the attack is high, and while exploitability ...

A vulnerability in the Linux kernel related to posix CPU timers can lead to a use-after-free condition due to a race in non-leader exec() scenarios. When a timer associated with a process is deleted while concurrently executing an exec() command, it can cause access to freed memory. Specifically,...

A vulnerability exists in gedelumbung HospitalManagement that affects its Password Change Handler responsible for managing user password updates. This flaw allows attackers to manipulate user credentials, particularly the 'kode_user' or 'username' parameters, enabling unauthorized access. The iss...

The SOGo email server prior to version 5.12.11 contains a significant vulnerability that allows unauthorized attackers to exploit the password-reset process. By injecting a malicious Origin header when submitting password recovery requests, attackers can redirect valid password-reset tokens to th...

A vulnerability in gedelumbung's HospitalManagement system allows for cross-site request forgery (CSRF), enabling attackers to exploit the weakness remotely. Users may unknowingly trigger malicious requests while authenticated, potentially compromising sensitive data. An exploit for this flaw has...

Sublime Text for Windows, specifically versions 4 (Build 4192) and 3 (Build 3207), is prone to a local privilege escalation vulnerability. This flaw allows an unprivileged local attacker to execute arbitrary code with elevated privileges. The exploit takes advantage of the update staging mechanis...

Grafana, an open-source monitoring and observability platform, is susceptible to a directory traversal vulnerability in versions ranging from 8.0.0-beta1 to 8.3.0. This vulnerability enables unauthorized access to local files via specially crafted URL paths which include the identifier for any in...

An authentication bypass vulnerability exists in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) that may allow an unauthenticated remote attacker to access Management services and execute arbitrary commands. This vulnerability poses a significant risk as ...

A vulnerability has been identified in XYZ Product that allows an attacker to exploit a stack overflow issue during the unauthenticated login process. This flaw could lead to remote execution of arbitrary code with root privileges, posing serious security risks to systems using this product.

A vulnerability exists in the virtio-fs host server used by Docker Sandboxes on macOS, where improper symlink handling when reopening unlinked files can lead to unauthorized access. An attacker can manipulate the environment by replacing a parent directory with a symlink, allowing them to escape ...

This vulnerability allows unauthorized command execution in the GPU micronode, leading to potential memory corruption when a specific sequence of commands is executed. Attackers could exploit this weakness to disrupt system functionality or gain access to sensitive areas of memory, posing risks t...

The Clean Login WordPress plugin prior to version 1.19 suffers from an authentication bypass vulnerability due to inadequate verification of the registration CAPTCHA. When the session value is empty, unauthorized users can exploit this flaw to bypass the anti-automation controls on the registrati...

The Clean Login WordPress plugin version prior to 1.19 contains a vulnerability that fails to verify if user registration is enabled before allowing account creation. This flaw permits unauthenticated individuals to create accounts on websites where account registration functionalities should be ...

The Hide My WP Ghost plugin for WordPress prior to version 7.0.11 is susceptible to a loopback security flaw, which fails to adequately verify security-check requests when disabling login and URL protection features. This shortcoming allows unauthorized users to manipulate the verification values...

The All Bootstrap Blocks plugin for WordPress before version 1.3.32 contains a local file inclusion vulnerability due to improper validation of block attributes used to construct filesystem paths at render time. This flaw enables users with contributor-level access and above to manipulate file pa...

The Hide My WP Ghost plugin for WordPress prior to version 7.0.11 contains a vulnerability that permits unauthenticated attackers to disable critical security features. By exploiting a flaw where the plugin does not confirm the validity of WooCommerce requests, attackers can manipulate request pa...

The Breeze Cache WordPress plugin prior to version 2.5.15 is susceptible to a vulnerability that allows unauthenticated attackers to exploit cached pages. The plugin fails to account for a specific set of tracking-related query parameters in its page-cache key. As a result, when a page is cached ...

The Generate PDF using Contact Form 7 WordPress plugin, prior to version 4.2.2, contains a significant design flaw that fails to restrict the destination of image fetches initiated by its PDF renderer. This vulnerability allows unauthenticated users to exploit the system by making requests to int...

The Filter Gallery WordPress plugin prior to version 1.1.5 is susceptible to a security issue due to the absence of nonce verification in its AJAX handlers. This oversight permits low-privileged users to manipulate post content and erase settings related to the stored gallery options, thus compro...

The Bookit — Booking & Appointment Calendar WordPress plugin, prior to version 2.6.0.5, contains a critical flaw that permits users assigned the low-privileged custom Staff role to delete any appointment without proper capability checks. This deficiency can lead to unauthorized removal of importa...

The All Bootstrap Blocks WordPress plugin prior to version 1.3.31 contains a vulnerability where it fails to adequately escape a block attribute before rendering it in an HTML tag-name context. This security oversight permits users with Contributor-level access and higher to inject malicious web ...

The Bookit — Booking & Appointment Calendar plugin for WordPress prior to version 2.6.0.5 has a critical flaw that bypasses necessary authorization checks on appointment retrieval actions. This defect allows users with lower privileges to access sensitive information belonging to other users, inc...

The MasterStudy LMS WordPress Plugin prior to version 3.7.50 is susceptible to a vulnerability that fails to properly verify if a requesting user owns a particular course. This allows users with the Instructor role to gain unauthorized access to sensitive information, specifically revealing the n...

The Tz Weekly Radio Schedule plugin for WordPress, up to version 1.8.1, is susceptible to SQL injection attacks. This vulnerability arises from insufficient sanitization and escaping of parameters in AJAX actions, which are accessible to unauthenticated users. As a result, attackers can exploit t...

The Easy Appointments WordPress plugin prior to version 4.0.2.2 is vulnerable due to the lack of an unguessable token for authorizing mail-link actions related to appointment cancellation and confirmation. The token is derived from a hardcoded salt and the appointment's creation timestamp, which ...

The Easy Appointments plugin for WordPress prior to version 4.0.2.2 is susceptible to an authorization bypass vulnerability. This issue arises from the lack of proper ownership checks on its unauthenticated appointment-reservation endpoint. Attackers can exploit this vulnerability to modify exist...

The iGMS Direct Booking plugin for WordPress prior to version 2.0 has a critical authorization issue that permits unauthenticated users to manipulate the widget settings. This flaw allows these users to inject arbitrary web scripts, which may execute within the context of an administrator's view,...

The Really Simple Security plugin for WordPress, prior to version 9.8.3, contains a vulnerability that allows unauthenticated attackers to exploit unvalidated input. By providing a client-supplied address value as a storage key, an attacker can manipulate the plugin's functionality, leading to ex...

The wp Shortcut Link and Advertisement Banner Plugin, up to version 1.2.0, is susceptible to SQL injection due to inadequate sanitization and escaping of parameters in an AJAX action accessible to unauthenticated users. This flaw can enable attackers to manipulate SQL queries, leading to unauthor...

The Price Drop Alert for Woo Commerce plugin for WordPress, up to version 1.1, is vulnerable to SQL injection due to improper sanitization and escaping of parameters used in an AJAX action. This vulnerability allows unauthenticated attackers to exploit the plugin and execute arbitrary SQL queries...

The Tz Weekly Radio Schedule Plugin for WordPress, versions up to and including 1.8.1, is vulnerable to SQL injection due to improper sanitization and escaping of input parameters. This vulnerability allows unauthenticated attackers to manipulate SQL queries through an AJAX action, potentially le...

The Question and Answer WordPress plugin, up to version 1.1.0, fails to properly sanitize and escape input parameters before incorporating them into SQL queries executed via AJAX actions. This flaw allows unauthenticated attackers to exploit the vulnerability by executing SQL injection attacks, p...

The Easy Form Builder plugin by WhiteStudio prior to version 4.2.0 is susceptible to an authentication bypass. Due to insufficient validation of input values against stored configurations for specific form types, unauthenticated users can create WordPress accounts even on sites where registration...

The VikBooking Hotel Booking Engine & PMS plugin for WordPress preceding version 1.8.15 has a vulnerability that allows unauthenticated users to upload files through the live chat feature. This plugin fails to properly restrict the types of files that can be uploaded or to sanitize their contents...

The Easy Form Builder plugin by WhiteStudio for WordPress suffers from a vulnerability due to insufficient validation of submitted values. Specifically, prior to version 4.2.0, it allows unauthenticated users to store arbitrary content. This content is rendered unescaped in an admin page, which c...

The UpsellWP plugin for WordPress suffers from a vulnerability that permits unauthenticated users to add products to their cart using the Frequently Bought Together campaign feature. This flaw does not verify if the products selected belong to the valid campaign, enabling users to exploit the dis...

The AF Companion WordPress plugin is susceptible to a file upload vulnerability that allows users with low-privileged store-management roles to upload arbitrary files. This flaw stems from inadequate validation of file types in one of its import features, potentially enabling the execution of mal...

The All-in-One WP Migration and Backup plugin for WordPress exhibits a significant security flaw, wherein it fails to enforce proper capability checks across several AJAX actions. This shortcoming is due to the reliance on an installation-wide secret, which is accessible to any user authorized to...

The King Addons for Elementor plugin prior to version 51.1.81 lacks adequate object-level authorization checks during the process of importing template content. This oversight enables users with contributor-level permissions and higher to modify Elementor page content indiscriminately, including ...

The King Addons for Elementor plugin for WordPress, prior to version 51.1.81, fails to implement appropriate per-object authorization checks for various image optimization actions. This oversight permits authenticated users with author-level access or higher to bypass security measures, potential...

The King Addons for Elementor plugin for WordPress prior to version 51.1.81 features a critical flaw that neglects to enforce checks for capability, post-status, and password before displaying the contents of user-generated posts. As a result, users with Contributor-level access or higher can unl...

The RestroPress plugin for WordPress through version 3.4.6 includes a significant flaw in its payment recovery process. This vulnerability allows unauthorized attackers to exploit the payment-recovery flow by submitting a request with a specific order identifier without verifying ownership. As a ...

The MasterStudy LMS WordPress Plugin prior to version 3.7.50 exhibits inadequate access control measures when interacting with its REST API. Specifically, users with the Instructor role can bypass necessary ownership and capability checks, enabling them to alter any order on the system. This flaw...

Spinnaker, a multi-cloud continuous delivery platform, is vulnerable to arbitrary command execution in specific versions. An attacker can exploit this vulnerability by executing arbitrary commands on clouddriver pods. This could lead to credential exposure, file deletion, or unauthorized resource...