Publicly Disclosed
PoC Exploits

A memory management vulnerability in the Linux kernel's eventpoll subsystem allows for a misuse of freed memory, resulting from improper handling of file structures during critical operations. The flaw occurs when an ep_remove operation clears a file pointer under lock while allowing concurrent o...

The Frontend File Manager Plugin for WordPress, version 23.6, is susceptible to a vulnerability that allows unauthenticated users to delete arbitrary files on the server without proper validation of file paths derived from user input. This issue is particularly concerning when guest upload mode i...

The vulnerability arises from a logic error in the key-based pairing process of certain Android devices. This flaw may allow an attacker in proximity to exploit the issue and gain unauthorized access to sensitive user information, including conversations and location data. Notably, the attack doe...

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 

An SQL injection vulnerability exists in specific versions of Django prior to 5.1.14, 4.2.26, and 5.2.8. Through the use of specially crafted dictionaries, attackers can exploit the `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()` methods, as well as the `Q()` class, when utilizing...

The OAuth implementation in phpBB has a critical flaw where improper authentication checks can lead to account hijacking. This vulnerability is particularly concerning as it may allow unauthorized users to gain access to accounts even if OAuth is not configured or enabled. Default installations a...

A vulnerability has been identified in Hyland Perceptive Filters versions prior to December 8, 2023. This issue affects products like Cisco IronPort Email Security Appliance Software and Cisco Secure Email Gateway, along with several non-Cisco products. Attackers can exploit this flaw by crafting...

A vulnerability exists in the command-line interface (CLI) of Cisco Secure Email Gateway due to improper input validation. This security flaw allows authenticated, remote attackers to inject malicious operating system commands into legitimate commands. A successful exploitation of this vulnerabil...

A vulnerability exists within the Web UI and administrative CLI of Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA). This security flaw enables both authenticated local and remote attackers to escalate their privileges, potentially gaining root access on the device. T...

The webservices in Proofpoint Enterprise Protection (PPS/POD) are susceptible to a vulnerability that enables unauthorized users to execute remote code through 'eval injection'. Exploitation of this vulnerability necessitates network access to the webservices API; however, such access is typicall...

The webutils component of Proofpoint Enterprise Protection is affected by a vulnerability that permits an authenticated user to leverage eval injection for remote code execution. This vulnerability affects all versions up to and including 8.20.0, potentially allowing malicious actions by users wi...

A significant SQL injection vulnerability has been identified in the Hotel and Tourism Reservation application by Code-Projects, specifically within the Room Management Page component. The vulnerability arises from the manipulation of an argument within the /admin/rooms.php file, allowing an atta...

Cognee, prior to version 1.2.0, exhibits an improper access control vulnerability that allows unauthenticated attackers to register an account and modify global LLM provider configurations through the settings endpoint. This endpoint does not enforce necessary administrative checks, enabling atta...

The FluxInk Color Management Driver (TcnPeripheral64.sys) version 1.0.7.2 contains a security flaw that allows a standard user account to escalate privileges by mapping arbitrary physical memory. This vulnerability poses a significant risk, enabling unauthorized users to gain elevated access and ...

NocoBase, up to version 2.1.20, exhibits a server-side request forgery vulnerability within the serverRequest wrapper. This flaw permits authenticated administrators to make unauthorized outbound HTTP requests by inputting malicious URL links into workflow request nodes, custom action buttons, or...

A vulnerability exists within the RAR5 recovery-volume parser used in WinRAR and UnRAR, leading to potential heap corruption through crafted .rev files. This flaw stems from the incorrect validation of input that allows for manipulation of internal data structures, posing a risk when users perfor...

GeoServer, an open-source server enabling geospatial data sharing and manipulation, contains a vulnerability that permits unauthenticated users to execute arbitrary code. This flaw arises from the handling of OGC request parameters, where property names are unsafely evaluated as XPath expressions...

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default config...

The web server binary '/bin/httpd' contains a vulnerability that enables a hidden backdoor authentication mechanism within its login function. This flaw allows unauthorized access by reading a backdoor password from the device configuration file if normal authentication fails. Using a direct comp...

Vtiger CRM versions prior to 8.4.0 are subject to an authenticated file upload vulnerability that allows low-privileged users to perform remote code execution. This is achieved by uploading a .phar file containing malicious PHP code through the Documents module, circumventing the configured denyl...

Vtiger CRM versions up to 8.4.0 contain a vulnerability that permits authenticated users with administrative privileges to execute arbitrary PHP code remotely. This occurs via the ModuleManager's import feature, which allows crafted zip files to be uploaded without sufficient validation. Attacker...

The MSI Feature Manager, through its KernCoreLib64.sys kernel driver, introduces a local privilege escalation vulnerability. This flaw enables any locally authenticated user to execute arbitrary read/write operations on physical memory and conduct unrestricted I/O port operations. By exploiting e...

A vulnerability has been identified in the Linux kernel concerning the KVM x86 module, specifically a use-after-free scenario due to an unexpected role in shadow paging. This issue arises when a host modifies a Page Directory Entry (PDE) mapping from outside a guest virtual machine and subsequent...

Active Directory Domain Services Elevation of Privilege Vulnerability

The Windows NT OS Kernel contains a vulnerability that allows authorized attackers to exploit an integer underflow condition, which can lead to local privilege escalation. This design flaw may enable attackers to gain elevated privileges on affected systems, making it critical for users to apply ...

A vulnerability in the SP Page Builder for Joomla permits unauthenticated users to upload arbitrary files. This weakness can lead to the execution of PHP code, presenting significant security risks for Joomla websites using this extension.

Budibase, an open-source low-code platform, has a vulnerability that allows unauthenticated visitors to access and manipulate sensitive database documents. This issue primarily affects versions prior to 3.39.12. An attacker can exploit this flaw by sending an HTTP request to a published Budibase ...

GNU Bash versions up to 4.3 are vulnerable to a code injection flaw due to the mishandling of trailing strings after function definitions in environment variables. This vulnerability enables remote attackers to execute arbitrary code by crafting specific environment variables under various condit...

A remote code execution vulnerability found in React Server Components allows attackers to exploit improperly handled payloads. This issue affects versions 19.0.0 through 19.2.0, compromising server function endpoints through unsafe deserialization of HTTP request payloads. As a result, this flaw...

An authenticated arbitrary file upload vulnerability exists in the /admin/tinymce/upload endpoint of Webkul Krayin CRM version 2.2.x. This flaw enables attackers to upload crafted PHP files, which can subsequently lead to the execution of arbitrary code on the server. Such vulnerabilities can be ...

The WP Travel Engine plugin for WordPress fails to validate the source of user-supplied profile image paths effectively. This security flaw allows authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-i...

The Uncanny Automator Pro WordPress plugin versions prior to 7.3.0.6 were found to have a critical backdoor that was planted following a compromise of the vendor's update infrastructure. This malicious code allows attackers without authentication to gain administrative access to the affected site...

The DoLeads Integrator and wp2epub plugins for WordPress allow unauthorized users to install unverified extensions from wordpress.org. This creates a pathway for remote code execution (RCE), jeopardizing website security. Website administrators must ensure that these plugins are updated to mitiga...

The Frontend File Manager Plugin for WordPress, version 23.6, is susceptible to a vulnerability that allows unauthenticated users to delete arbitrary files on the server without proper validation of file paths derived from user input. This issue is particularly concerning when guest upload mode i...

In Livewire up to and including version 3.6.3, a vulnerability exists that allows unauthenticated attackers to execute commands remotely in certain configurations. This issue is caused by specific component property updates that are not adequately secured. Importantly, exploitation of this vulner...

Netdata, an open-source real-time infrastructure monitoring tool, contains a vulnerability that allows attackers to execute arbitrary commands on the Netdata agent. This occurs when an attacker establishes a streaming connection and triggers an alert, thereby exploiting the function `health_alarm...

The GNU Inetutils telnet daemon (telnetd) is vulnerable to a remote authentication bypass that can occur when an attacker manipulates the USER environment variable by specifying a '-f root' value. This flaw allows unauthorized users to gain access without proper authentication. Affected users sho...

A flaw in the handling of password comparisons in Oracle MySQL and MariaDB allows remote attackers to bypass authentication by repeatedly attempting to login with the same incorrect password. This occurs due to an improper check of the return value from the memcmp function, leading to a situation...

The Apache Camel embedded HTTP server contains a vulnerability that allows unauthenticated access to protected endpoints. Specifically, when authentication is enabled, and non-root context paths are set, the derived authentication paths do not cover subpaths. This misconfiguration can lead to una...

The Camel-Mail component allows for potential header injection due to improper filtering of Camel message headers when email is consumed. The MailHeaderFilterStrategy only applies filtering on outbound messages, leaving inbound message checks unconfigured. As a result, attackers can deliver craft...

A vulnerability exists within Apache Camel's camel-coap component that allows an unauthenticated attacker to exploit message header injection. By sending a single CoAP UDP packet to a Camel route that accepts coap:// input, attackers can inject arbitrary Camel internal headers into the Exchange. ...

A vulnerability exists in the Samba printing subsystem that allows remote attackers to execute arbitrary commands on affected systems. The flaw occurs due to improper handling of the client-controlled job description string, which is passed directly to the configured print command without escapin...

A vulnerability exists in the Mobatek MobaXterm Home Edition, specifically in the msimg32.dll library, which allows for an uncontrolled search path. This could potentially enable an attacker to exploit the software locally. The complexity of the attack is notably high, making it challenging to ex...

The Consul component of Apache Camel contains a deserialization vulnerability that allows for potentially malicious Java objects to be injected and executed. When an attacker gains write access to the Consul KV store, they can insert such objects, leading to arbitrary code execution when Camel su...

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or h...

A vulnerability has been identified in GPAC's MP4Box component, specifically within the sgpd_del_entry function of the source file box_code_base.c. The issue allows for a heap-based buffer overflow, which can be exploited by an attacker with local access. This provides a method for data manipulat...

A vulnerability within GPAC's MP4Box component, specifically in the gf_isom_nalu_sample_rewrite function of avc_ext.c, has been identified. This issue arises from the manipulation of the nalu_out_bs argument, leading to a potential double free condition. An attacker can exploit this vulnerability...

The Avada (Fusion) Builder plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation in its maybe_delete_files function. This vulnerability affects all versions up to and including 3.15.3, enabling unauthenticated attackers to delete files on the server...

A security vulnerability has been identified in the React Create-React-App framework on macOS, specifically within the startBrowserProcess function located in openBrowser.js of the react-dev-utils component. This flaw permits OS command injection, allowing attackers to potentially execute arbitra...

The OverlayFS implementation in the Linux kernel failed to adequately validate user namespaces when setting file capabilities on underlying file systems. This weakness, combined with specific patches in the Ubuntu kernel that permit unprivileged overlay mounts, enables attackers to exploit the si...