Publicly Disclosed
PoC Exploits

The GNU Inetutils telnet daemon (telnetd) is vulnerable to a remote authentication bypass that can occur when an attacker manipulates the USER environment variable by specifying a '-f root' value. This flaw allows unauthorized users to gain access without proper authentication. Affected users sho...

A flaw in the handling of password comparisons in Oracle MySQL and MariaDB allows remote attackers to bypass authentication by repeatedly attempting to login with the same incorrect password. This occurs due to an improper check of the return value from the memcmp function, leading to a situation...

The Apache Camel embedded HTTP server contains a vulnerability that allows unauthenticated access to protected endpoints. Specifically, when authentication is enabled, and non-root context paths are set, the derived authentication paths do not cover subpaths. This misconfiguration can lead to una...

The Camel-Mail component allows for potential header injection due to improper filtering of Camel message headers when email is consumed. The MailHeaderFilterStrategy only applies filtering on outbound messages, leaving inbound message checks unconfigured. As a result, attackers can deliver craft...

A vulnerability exists within Apache Camel's camel-coap component that allows an unauthenticated attacker to exploit message header injection. By sending a single CoAP UDP packet to a Camel route that accepts coap:// input, attackers can inject arbitrary Camel internal headers into the Exchange. ...

A vulnerability exists in the Samba printing subsystem that allows remote attackers to execute arbitrary commands on affected systems. The flaw occurs due to improper handling of the client-controlled job description string, which is passed directly to the configured print command without escapin...

A vulnerability exists in the Mobatek MobaXterm Home Edition, specifically in the msimg32.dll library, which allows for an uncontrolled search path. This could potentially enable an attacker to exploit the software locally. The complexity of the attack is notably high, making it challenging to ex...

The Consul component of Apache Camel contains a deserialization vulnerability that allows for potentially malicious Java objects to be injected and executed. When an attacker gains write access to the Consul KV store, they can insert such objects, leading to arbitrary code execution when Camel su...

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or h...

A vulnerability has been identified in GPAC's MP4Box component, specifically within the sgpd_del_entry function of the source file box_code_base.c. The issue allows for a heap-based buffer overflow, which can be exploited by an attacker with local access. This provides a method for data manipulat...

A vulnerability within GPAC's MP4Box component, specifically in the gf_isom_nalu_sample_rewrite function of avc_ext.c, has been identified. This issue arises from the manipulation of the nalu_out_bs argument, leading to a potential double free condition. An attacker can exploit this vulnerability...

The Avada (Fusion) Builder plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation in its maybe_delete_files function. This vulnerability affects all versions up to and including 3.15.3, enabling unauthenticated attackers to delete files on the server...

A security vulnerability has been identified in the React Create-React-App framework on macOS, specifically within the startBrowserProcess function located in openBrowser.js of the react-dev-utils component. This flaw permits OS command injection, allowing attackers to potentially execute arbitra...

The OverlayFS implementation in the Linux kernel failed to adequately validate user namespaces when setting file capabilities on underlying file systems. This weakness, combined with specific patches in the Ubuntu kernel that permit unprivileged overlay mounts, enables attackers to exploit the si...

A vulnerability has been discovered in the imhamzaazam ecommerceFlask platform, affecting versions prior to cb7d9e24c30a99379651b7493b32048126ef402b. This weakness can lead to unauthorized commands being transmitted from an authenticated user to the application without their consent. Since this i...

The Admin and Site Enhancements plugin for WordPress, both the standard and pro versions prior to 8.8.4, contains a significant vulnerability that permits unauthenticated attackers to exploit the role-restoration request handler. This flaw enables malicious users to reinstate administratively dem...

Certain WordPress plugins, including FileOrganizer, Advanced File Manager, File Manager Pro, and File Manager, have a vulnerability due to insufficient input escaping before executing shell commands during image operations. This flaw allows authenticated users to potentially execute arbitrary com...

The Simple Membership WordPress plugin prior to version 4.7.5 is susceptible to a web script injection vulnerability due to insufficient verification of Stripe webhook requests when no signing secret is configured. Additionally, the plugin fails to properly escape values retrieved from these requ...

The AllCoach WordPress plugin prior to version 1.0.2 contains a critical flaw that fails to confirm whether an email address submitted for account registration is already linked to an existing user. This oversight enables unauthorized individuals to overwrite the passwords of existing users, incl...

The FileOrganizer plugin for WordPress, prior to version 1.2.0, is susceptible to a file upload vulnerability. This flaw allows authenticated users with file-manager access—potentially extended to sub-admins via a premium add-on—to bypass file type validation during various file management operat...

The Notifications for Forms & WordPress Actions Plugin for WordPress, prior to version 2.6, is prone to a server-side file inclusion vulnerability. This flaw occurs due to the lack of validation on user-supplied input when constructing file paths. As a consequence, authenticated users with subscr...

The Ultimate Member plugin for WordPress, prior to version 2.12.0, contains a flaw in how it handles the sanitization of custom textarea profile fields. This oversight permits authenticated users with Subscriber-level access and higher to inject malicious JavaScript code into their profiles. When...

A memory allocation issue exists in Apache HTTP Server's mod_http module, which can lead to denial of service when an attacker sends crafted HTTP requests with excessive size values. This vulnerability affects a wide range of Apache HTTP Server versions, making it critical for users to implement ...

A security flaw has been identified in the CodeAstro Ecommerce Website version 1.0, specifically affecting the wishlist management functionality located in the file /customer/my_account.php?my_wishlist. The vulnerability allows an attacker to manipulate the 'delete_wishlist' parameter, leading to...

A vulnerability exists in the CodeAstro Apartment Visitor Management System (version 1.0) that allows for SQL injection through inadequate sanitation of user input, specifically in the 'visname' argument of the '/apartment-visitor/visitor-entry.php' file. This flaw can enable an attacker to execu...

A vulnerability in the server-side state machine of libssh permits a malicious client to create communication channels without prior authentication. This flaw can lead to unauthorized access, posing risks to the confidentiality and integrity of data transmitted through the affected software. User...

A SQL injection vulnerability in the CodeAstro Apartment Visitor Management System version 1.0 arises from improper handling of input in the edit-apartment.php file. Attackers can manipulate the 'editid' argument, potentially allowing them to execute arbitrary SQL queries. This flaw is exploitabl...

A vulnerability in CodeAstro's Apartment Visitor Management System version 1.0 has been identified, allowing for SQL injection attacks via the manipulation of the 'fromdate' argument in the report.php file. This flaw could enable attackers to execute arbitrary SQL queries on the database, potenti...

A SQL injection vulnerability exists in the CodeAstro Apartment Visitor Management System version 1.0. The issue arises from improper validation of input within the '/apartment-visitor/action-visitor.php' file, specifically in the argument 'remark'. This flaw allows an attacker to manipulate SQL ...

A security weakness has been discovered in the Crater Invoice application, specifically within the getFormattedString function of the InvoicesRequest.php file. This vulnerability allows an attacker to manipulate the argument used in the invoicing notes, potentially leading to cross-site scripting...

A flaw exists in GPAC version 26.02.0 within the Media File Handler's function nhmldump_send_frame, specifically in the src/filters/write_nhml.c file. This vulnerability allows an attacker with local access to manipulate the function, potentially leading to a null pointer dereference. The exploit...

A stack-based buffer overflow vulnerability has been identified in the radareorg radare2 tool, specifically within the Memory64ListStream Parser of the libr/bin/format/mdmp/mdmp.c component. This vulnerability arises from improper handling of inputs, allowing an attacker with local access to mani...

A security vulnerability exists in the radare2 tool, specifically in the r_core_bin_load function within the libr/core/cfile.c file. This vulnerability is characterized by a use after free condition that allows an attacker to manipulate memory allocations, potentially leading to arbitrary code ex...

A weakness has been identified in the radare2 product from radareorg, specifically within the cmd_print function in the libr/core/cmd_print.inc component. This vulnerability allows for an integer overflow condition, which can be exploited locally. The public availability of an exploit raises conc...

A security flaw has been identified in the radareorg radare2 software, particularly within the function r_str_word_get0set in the libr/util/str.c file. This vulnerability leads to an integer overflow that can potentially allow an attacker to exploit the system, provided they have local access. Th...

A path traversal vulnerability was identified in NousResearch's Hermes-Agent 2026.5.29.2, specifically in the skill_view function within tools/skills_tool.py. Attackers can exploit this vulnerability by manipulating request parameters, potentially allowing unauthorized access to the filesystem. T...

A security vulnerability has been identified in the SourceCodester Online Examination & Learning Management System 1.0, specifically within the Enrollment Management component. This vulnerability stems from improper handling of the parameters student_id, schedule_id, and action within the /ajax_e...

The Product Video Gallery for Woocommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the custom_thumbnail parameter. Authenticated users with shop manager-level access can exploit this vulnerability to inject mali...

A vulnerability exists in the announcements.php file of the SourceCodester Online Examination & Learning Management System, where improper validation allows for unrestricted file uploads. This flaw can be exploited remotely, enabling attackers to upload malicious files, potentially leading to fur...

A security flaw has been identified in the SourceCodester Online Examination & Learning Management System 1.0, specifically within the pathinfo function of the /upload_files.php file associated with the Filename Extension component. This vulnerability enables an attacker to manipulate upload func...

A vulnerability exists in the SourceCodester Online Examination & Learning Management System 1.0 that allows attackers to exploit the /process_lesson.php file. By manipulating the user_id parameter, unauthorized users can upload files without restrictions. This can lead to serious security risks,...

A SQL injection vulnerability has been identified in the Itsourcecode Hospital Management System version 1.0, specifically within the /paymentdischarge.php file. This vulnerability arises due to improper handling of the patientid parameter, which can be manipulated by an attacker to execute arbit...

A SQL injection vulnerability has been discovered in the itsourcecode Hospital Management System 1.0, specifically affecting the /payment.php file. This flaw allows an attacker to manipulate the 'patientid' parameter, enabling unauthorized access to the database. The attack can be executed remote...

A vulnerability exists in the SourceCodester Class and Exam Timetabling System 1.0 where an SQL injection can be executed via the manipulation of the ID parameter in the /edit_course1.php file. This flaw allows remote attackers to inject malicious SQL statements, potentially leading to unauthoriz...

In jQuery, there is a vulnerability that affects versions starting from 1.0.3 up to, but not including, 3.5.0. This flaw allows malicious actors to execute untrusted code if HTML containing <option> elements is passed to jQuery's DOM manipulation methods, such as .html() and .append(), even after...

A security flaw was discovered in the SourceCodester Class and Exam Timetabling System, specifically in the editing functionality of the application. The vulnerability resides in the /edit_exam1.php file, where an unknown function allows manipulation of the argument ID. This breach can enable att...

A remote code execution vulnerability has been identified in select QNAP NAS products. This issue could potentially allow attackers to execute arbitrary code on affected systems, posing a significant risk to data integrity and system functionality. QNAP has released patches to address this vulner...

A critical SQL injection vulnerability exists within the SourceCodester Class and Exam Timetabling System, specifically in the /edit_room.php file. This flaw allows attackers to manipulate the argument ID, potentially leading to unauthorized access and manipulation of the database. The exploit ca...

A security vulnerability has been identified in the Real State Services application version 1.0, specifically in the /pay.php file. Malicious actors can exploit this vulnerability by manipulating the 'Bankname' parameter, potentially leading to SQL injection attacks. This type of attack can be ex...

A significant SQL injection vulnerability has been discovered in Code-Projects Real State Services 1.0, which impacts the file /builderHome.php. An attacker can manipulate the 'loc' argument, potentially leading to unauthorized access to the database. This vulnerability allows for remote exploita...