Publicly Disclosed
PoC Exploits

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The sysPass application, versions 3.0.1 through 3.2.11, features a critical authentication bypass vulnerability. This flaw allows unauthorized attackers to exploit the install/install handler, permitting them to bypass the necessary checks for installed status. By sending specific POST requests, ...

Psono Server versions 1.12.6 through 7.5.0 of the Community Edition and prior to 7.5.1 of the Enterprise Edition contain an authorization flaw. An attacker with group share-admin privileges can delete group share-right records without having accepted a group invitation. This occurs because the au...

The WP Ultimate CSV Importer plugin for WordPress, prior to version 9.3, is susceptible to SQL injection due to inadequate escaping of imported file values. This vulnerability allows privileged users, such as site administrators in single or multisite environments, to inject malicious SQL queries...

The Quick Page/Post Redirect Plugin for WordPress prior to version 5.2.4 had a hidden update mechanism that allowed it to receive updates from a malicious server instead of WordPress.org. This oversight enabled attackers to push a compromised version that injected arbitrary content into web pages...

The WP Ultimate CSV Importer and its Pro version exhibit a security flaw that causes files exported via the single post export feature to be stored in a publicly accessible location. This exposure allows unauthenticated users to download the exported content and custom fields of any post, includi...

The SEOJuice WordPress plugin prior to version 2.12.0 contains a vulnerability that improperly manages the authentication filter for its REST API interface. This lack of proper restriction allows unauthorized users to bypass the site's REST nonce protection mechanism. Consequently, an attacker co...

The Lightbox with PhotoSwipe plugin for WordPress prior to version 5.19.0 fails to adequately sanitize link titles and other caption sources before rendering them as HTML in the image lightbox. This oversight permits unauthenticated users to exploit the vulnerability and execute stored cross-site...

The Duplicate Post plugin for WordPress versions prior to 1.5.8 contains a serious access control vulnerability. It fails to verify if a user attempting to duplicate a post has sufficient permissions to edit the original content. When the slug takeover feature is activated, this oversight enables...

The Duplicate Post plugin for WordPress prior to version 1.5.8 has an authorization vulnerability that fails to properly verify a user's permissions when duplicating posts. This oversight allows users assigned roles with access to the plugin, such as Contributors, to create published posts. This ...

The Checkout Files Upload for WooCommerce plugin prior to version 2.4.1 lacks proper validation of uploaded files at the checkout process. This security gap enables unauthenticated users to upload malicious files, such as HTML files, disguising them as acceptable image formats. Consequently, thes...

The Swipe WordPress plugin prior to version 1.4 is vulnerable to an authentication bypass flaw. This vulnerability allows unauthorized attackers to gain access to the WordPress session of existing users, including administrators. By exploiting this flaw, attackers can issue a WordPress session co...

The 4Dem Email Marketing plugin for WordPress prior to version 2.0.5 is vulnerable due to the lack of proper authorization checks on several AJAX actions. This flaw enables unauthorized users to manipulate the plugin’s stored configuration and delete important records, which can lead to significa...

The Flatsome WordPress theme prior to version 3.20.13 is susceptible to an authorization bypass vulnerability. This flaw allows users with minimal permissions, such as Contributors, to publish their own content and modify its post type to something different, like a product. The lack of enforceme...

The Chargely Free Subscriptions for WooCommerce plugin prior to version 1.0 has a security concern where it fails to implement necessary authorization checks on a REST API endpoint. This oversight allows attackers without authentication to access sensitive configuration details, including the Woo...

The Duplicate Post plugin for WordPress versions prior to 1.5.8 has a flaw that lacks a proper capability check when saving global settings. This oversight allows users with access—potentially any role granted access by an administrator, including lower-level roles like Subscriber—to modify criti...

The Flatsome WordPress theme, prior to version 3.20.13, is vulnerable due to a lack of necessary capability or nonce checks on a specific AJAX action accessible to users without authentication. This oversight permits these unauthenticated users to retrieve unpublished content, including drafts an...

The Countdown, Coming Soon, Maintenance plugin for WordPress lacks critical authorization and nonce validation during the saving process of countdown data on posts. This weakness allows users with Author-level access and higher to inject arbitrary web scripts. The output-sanitization allowlist in...

The Countdown, Coming Soon, Maintenance WordPress plugin, up to version 3.0.8, lacks proper access control checks for user roles when handling AJAX requests. This flaw allows any authenticated user, including subscribers, to retrieve titles of published posts across various post types, even those...

The Email Marketing 4Dem plugin for WordPress, up to version 2.0.5, contains a significant authorization vulnerability. It fails to properly validate user permissions on multiple AJAX actions and REST routes. This oversight allows unauthenticated users to access sensitive configurations and data ...

The Apache JServ Protocol (AJP) Connector in Apache Tomcat allowed for misconfigured connections that could be exploited by attackers. By default, the AJP Connector is enabled, listening on all configured IP addresses. This elevated trust can lead to unauthorized access and manipulation of files ...

Chargemap is susceptible to a stored cross-site scripting (XSS) vulnerability that can be exploited by a remote, unauthenticated attacker. By injecting malicious code into the username field of the account registration page, attackers can create a new account linked to a victim's email address. O...

The vulnerability in the Booked plugin by Case-Themes allows attackers to bypass authentication mechanisms through alternate channels. This can lead to unauthorized access and potential abuse of user accounts. The affected versions of the plugin range from unrestricted to version 3.0.0. It is cri...

A vulnerability exists in Microsoft Office that allows attackers to manipulate untrusted inputs, enabling them to bypass critical security measures locally. This flaw can expose systems to unauthorized actions, compromising the integrity of sensitive data. It is crucial for users to apply the lat...

Poste Italiane's Postecert FIRMAOK! version 1.6.29 for Windows is susceptible to a local privilege escalation vulnerability due to an uncontrolled OpenSSL search path. This flaw allows an attacker with low privileges to create a non-existent, writable directory and plant malicious OpenSSL configu...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

Flowise version 3.1.4 is susceptible to a server-side request forgery vulnerability. The flaw allows authenticated users with specific permissions to bypass the Custom Function sandbox’s SSRF protections. By manipulating module subpaths in an allowlisted package (like axios or node-fetch), attack...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A critical vulnerability in Google Chrome prior to version 157.0.8103.50 allows remote attackers to execute arbitrary code within the browser's sandbox environment. This is achieved through a specially crafted HTML page that exploits a use after free situation in the XML parsing component, leadin...

MJML version 4.18.0 exposes a directory traversal vulnerability that allows attackers to test the existence of files and potentially read them, particularly in cases involving CSS files. This vulnerability arises from an incomplete resolution of a prior issue, which may lead to unauthorized acces...

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is subject to a PHP Object Injection vulnerability that arises from inadequate server-side authentication and lack of a class allowlist for deserialization. Any attacker can exploit this flaw through the ticket_label field in the URL-...

A vulnerability exists in PackageKit, specifically in versions 1.0.2 to 1.3.4, allowing unprivileged users to exploit a time-of-check time-of-use (TOCTOU) race condition. This flaw enables attackers to manipulate transaction flags, facilitating the installation of arbitrary RPM packages as root w...

Marimo, a reactive Python notebook, exhibits a significant security vulnerability prior to version 0.23.0. The terminal WebSocket endpoint (/terminal/ws) allows unauthenticated access, enabling attackers to gain a complete pseudo-terminal shell and execute arbitrary commands on the host system. U...

The Omnispace Agora Project version 26.10.0 is susceptible to a cross-site request forgery vulnerability, allowing attackers to perform unauthorized actions by forging requests without an anti-CSRF token. This exploitation occurs through the merging of $_GET and $_POST parameters, enabling the cr...

The Huatian Dynamic OA8000 collaborative office system is exposed to an unauthenticated path traversal vulnerability through the /OAapp/jsp/trace/ntkodownload.jsp endpoint. The vulnerability arises from the usage of the filename request parameter, which allows attackers to manipulate the file pat...

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a...

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

The Integra32 Security Management System version 5.1.11 R5.0 is susceptible to an unauthenticated deserialization flaw within its deprecated .NET Remoting service. This vulnerability is exposed through TCP port 2001 via the AxcvcLt.dll library. Attackers can exploit this by sending specially craf...

The SAP NetWeaver Application Server ABAP is susceptible to a memory corruption vulnerability due to logical errors in the DIAG protocol parsing. This flaw allows an unauthenticated attacker to manipulate the system, potentially leading to the disclosure of sensitive information or a system crash...

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

A vulnerability exists in Quay where the robot account listing function improperly handles user-defined namespace names. By crafting a namespace containing wildcard characters, an attacker can exploit this flaw to match and retrieve sensitive information, such as the robot accounts and their decr...

A security flaw in RubyGem Safemode allows authenticated attackers to bypass method call mediations when using compound assignment expressions in sandboxed code. This vulnerability can result in the execution of arbitrary no-argument methods on objects exposed to the template renderer. As a conse...

A vulnerability exists in Git that affects how configuration values are read and written, particularly regarding trailing carriage returns. When a submodule path includes a trailing carriage return, it is altered when read back, which can cause the submodule to be checked out to an incorrect loca...

A vulnerability exists in Git that affects how configuration values are read and written, particularly regarding trailing carriage returns. When a submodule path includes a trailing carriage return, it is altered when read back, which can cause the submodule to be checked out to an incorrect loca...

OpsTree BuildPiper prior to version 2.7.0 is susceptible to a privilege escalation vulnerability. This flaw allows project users to submit unrestricted manifests via the Additional Manifest feature, which can be exploited to gain Kubernetes cluster-admin privileges. By deploying a ClusterRoleBind...

OpsTree BuildPiper versions prior to 2.7.0 are susceptible to a path traversal vulnerability, enabling authenticated users with build configuration permissions to access sensitive files on the build worker. By providing unvalidated inputs for dockerfile_path and build context parameters, attacker...

OpsTree BuildPiper versions earlier than 2.7.0 are susceptible to a path traversal vulnerability. This flaw enables authenticated users to manipulate file paths using traversal sequences, such as ../../../../etc/passwd, thereby gaining unauthorized access to arbitrary files. Consequently, sensiti...

OpsTree BuildPiper versions prior to 2.7.0 are susceptible to a broken access control vulnerability, allowing authenticated users to gain unauthorized access to Git repositories that should be restricted to other projects. Through the GET /api/v1/git_repo/?all=true endpoint, attackers can enumera...

OpsTree BuildPiper versions prior to 2.7.0 have a vulnerability that permits authenticated users to bypass authorization controls, enabling them to create environments on Kubernetes clusters that are not assigned to their project. By manipulating the 'cluster_id' and 'namespaces' values in reques...