Publicly Disclosed
PoC Exploits

The out-of-bounds read vulnerability in Windows Paint enables unauthorized attackers to potentially execute arbitrary code within a network context. This flaw could allow malicious entities to manipulate the application, leading to unauthorized actions being performed on affected systems. Users a...

A vulnerability exists in the Linux kernel that concerns the handling of shared skb fragments during the decryption process in ESP-in-UDP packets. When pages are attached from a pipe directly to an skb using MSG_SPLICE_PAGES, the kernel marked these SKBs with SKBFL_SHARED_FRAG, which plays a cruc...

An improper encoding or escaping of output vulnerability in Synology DiskStation Manager affects multiple versions, enabling remote attackers to potentially read or write arbitrary files. This may lead to unauthorized access and could facilitate denial-of-service attacks, compromising the system'...

A vulnerability exists in Microweber versions prior to 1.1.20 that permits an unauthenticated user to access the database containing user information. This occurs through a specific POST request to the user files module, enabling the exposure of sensitive data without requiring authentication. Or...

A use-after-free vulnerability exists in the Android Binder service, which could allow attackers to elevate privileges from an application to the Linux Kernel. Exploitation of this vulnerability does not require any interaction from the user; however, it necessitates either the installation of a ...

Craft CMS versions 4.0.0 to 4.18.8 and 5.0.0 to 5.11.1 contain an unauthenticated SQL injection vulnerability in the element search endpoint. This occurs when the attribute parameter is unsanitized and concatenated into the SQL query, which permits remote attackers to execute arbitrary SQL comman...

A vulnerability in Python's SSL module arises from the ssl.SSLContext.wrap_bio() not enforcing a valid server_hostname when hostname validation is enabled. This oversight can lead to a situation where certificate verification appears successful, despite being improperly configured. Without a vali...

The SQL::Abstract for Perl, prior to version 2.000003, contains a vulnerability that allows an attacker to exploit SQL injection through arrayref column values during insert and update operations. With the default configuration disabling the array_datatypes option, these operations can treat an u...

An out-of-bounds write vulnerability has been identified in Apple iOS and macOS products, leading to potential memory corruption when processing maliciously crafted PDF files. The issue arises due to insufficient bounds checking, which may allow attackers to exploit the vulnerability and execute ...

A vulnerability in Jinher OA C6 affects the function within the ProjectAfficheManage.aspx file, allowing an attacker to exploit SQL injection through the argument ProjID. This flaw enables remote attackers to execute arbitrary SQL commands, leading to unauthorized access to the database. Despite ...

A vulnerability exists in the FlowCI flow-core-x product that exposes its LocalFileManager component to path traversal attacks. This issue arises from how the component handles the input for the fileName parameter within its functionalities, such as exist, save, read, and remove operations. Attac...

A vulnerability in FlowCI's flow-core-x component affects versions up to 1.23.49, specifically within the FileHelper.unzip function. This issue allows attackers to exploit path traversal, potentially leading to unauthorized file access from remote locations. The complexity of executing this attac...

A vulnerability within the Performance Events system of the Linux kernel permits a heap out-of-bounds write due to an overflow in the read_size of a perf_event. This flaw can potentially be exploited to escalate local privileges, highlighting the importance of timely updates. Users are advised to...

A critical vulnerability has been identified in FlowCI's flow-core-x product, specifically within the Groovy Script Evaluation component. This flaw is tied to the ConditionManagerImpl.run function, where improper manipulation of the condition argument can lead to code injection attacks. The vulne...

Certain versions of JFrog Artifactory (Self Hosted) are at risk of a privilege escalation vulnerability due to inadequate validation of token signatures and issuers. This weakness allows an attacker to exploit improper token validation, potentially leading to unauthorized access and elevated priv...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The out-of-bounds read vulnerability in Windows Paint enables unauthorized attackers to potentially execute arbitrary code within a network context. This flaw could allow malicious entities to manipulate the application, leading to unauthorized actions being performed on affected systems. Users a...

The Sync Post With Other Site plugin for WordPress prior to version 1.9.4 is susceptible to an improper authorization vulnerability. This flaw permits users with Contributor-level access or higher to create and modify arbitrary custom post types. Consequently, it poses risks including potential u...

The Userplace plugin for WordPress versions up to 1.2.0 contains a significant security issue where authorization checks are not enforced on specific AJAX actions. This flaw allows unauthenticated users to exploit the exposed nonce, enabling them to create an administrator account or manipulate s...

The Productive Commerce WordPress plugin, prior to version 1.1.54, contains a flaw where it fails to properly sanitize and escape user-supplied parameters in SQL statements. This oversight exposes the plugin to unauthorized SQL injection attacks, enabling attackers to manipulate database queries ...

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin allows unauthenticated attackers to exploit a security flaw by failing to properly verify the authenticity of incoming bank transfer payment notifications. This can lead to unauthorized marking of WooCommerce orders as paid, potentially resu...

The Razorpay for WooCommerce plugin for WordPress prior to version 4.8.9 is susceptible to SQL injection due to inadequate sanitization and escaping of values received from webhook requests. This vulnerability can potentially allow users with access to the webhook secret, specifically administrat...

The Ecommerce Affiliate WordPress plugin, up to version 1.0.0, contains a significant security flaw that allows attackers to issue and verify one-time passwords without proper authentication. This vulnerability permits unauthorized individuals to potentially seize control of any user account, inc...

The Turisbook Booking System plugin for WordPress, up to version 1.3.8, is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate authorization and Cross-Site Request Forgery (CSRF) checks. This oversight allows attackers to inject malicious scripts through unsanitized outpu...

The Razorpay for WooCommerce plugin for WordPress, prior to version 4.8.9, has a significant security flaw that allows unauthorized users to bypass authorization checks on specific REST routes. This vulnerability enables attackers to exploit the plugin by executing requests as different user acco...

The Pie Register WordPress plugin, up to version 3.8.4.15, lacks proper authorization checks in one of its AJAX actions. This oversight allows users with minimal privileges, such as contributors, the ability to alter administrator-created invitation code records. This vulnerability poses a signif...

The Razorpay for WooCommerce WordPress plugin versions preceding 4.8.9 is susceptible to an improper order verification issue. This vulnerability allows unauthenticated individuals to exploit the system by retrieving discount values linked to arbitrary customer orders without sufficient authoriza...

The Contact Form 7 plugin for WordPress versions prior to 6.2.4 has a critical flaw in its handling of file uploads. It fails to properly validate the type or extension of files uploaded through form fields. Furthermore, inadequate temporary file clean-up protocol leaves uploaded files on the ser...

The BackUpWordPress plugin, prior to version 3.15, is vulnerable due to a lack of necessary capability or nonce checks on specific AJAX actions. As a result, any authenticated user with a minimum role of Subscriber can exploit this weakness to delete crucial backup protection files and disrupt on...

The Secure Custom Fields plugin for WordPress lacks proper read-permission checks when displaying relational field values. This vulnerability allows users with post-editing capabilities, such as Contributors and above, to gain access to unpublished posts' titles and non-public statuses created by...

The Pie Register plugin for WordPress (versions up to 3.8.4.15) is vulnerable to an unauthenticated access flaw due to its failure to validate capabilities, nonce, or authentication on certain request handlers. This weakness enables attackers to modify the plugin settings, effectively resetting t...

The Secure Custom Fields plugin for WordPress versions prior to 6.9.8 fails to properly validate user permissions for editing target objects during bidirectional relationship synchronization. This weakness allows users with contributor-level access or higher to manipulate object references on pos...

The Secure Custom Fields plugin for WordPress prior to version 6.9.8 is vulnerable to JavaScript injection attacks. This vulnerability arises from the failure to properly sanitize persisted field definitions, allowing users with configuration permissions to inject malicious scripts as HTML attrib...

The Secure Custom Fields plugin for WordPress, prior to version 6.9.8, contains a flaw that allows users with contributor-level access and above to bypass restrictions and create custom fields typically reserved for administrators. This happens because the plugin fails to re-apply its field-group...

The Antom Payments WordPress plugin, specifically version 2.0.11, lacks essential authorization checks when providing confirmation links for customer orders. This oversight permits unauthenticated users to access sensitive information such as customer names, addresses, phone numbers, and email ad...

The WP Recipe Maker plugin for WordPress prior to version 10.9.2 contains a vulnerability that allows unauthorized users to access the complete content of recipes embedded in password-protected posts. This occurs due to the plugin's failure to verify whether the post containing the recipe is secu...

The FV Flowplayer Video Player plugin for WordPress is vulnerable due to a lack of authorization checks on specific AJAX actions. This flaw enables authenticated users, regardless of their role, to execute a site-wide content rewrite. As a result, even users with minimal permissions can modify po...

The Pronamic Pay WordPress plugin and its Mollie extension prior to their respective versions are vulnerable to unauthorized access. This issue stems from insufficient restrictions on stored form submissions accessible via the REST API. As a result, unauthenticated users may exploit this weakness...

The Event Tickets Manager for WooCommerce plugin prior to version 1.6.0 lacks proper authorization checks and nonce validations on its ticket-transfer functionality. This flaw permits unauthenticated users to transfer tickets meant for legitimate attendees to any email address of their choice. Co...

The DBCPConnectionPool and HikariCPConnectionPool services in Apache NiFi versions 0.0.2 through 1.21.0 are susceptible to a vulnerability that allows an authenticated and authorized user to configure a Database URL leveraging the H2 driver, leading to potential execution of custom code. The reco...

A security flaw in certain versions of SaltStack's Salt product allows remote users to bypass authentication for method calls. This weakness stems from improper validation in the salt-master process's ClearFuncs class, enabling attackers to execute commands on salt minions or retrieve sensitive u...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

The Contact Form 7 plugin prior to version 5.3.2 for WordPress is susceptible to an unrestricted file upload vulnerability. This issue arises from improper handling of filenames that may contain special characters, potentially allowing attackers to upload malicious files. If successfully exploite...

The TOTOLINK CA300-PoE 6.2c.884 is susceptible to a buffer overflow vulnerability in the UploadCustomModule function located in the cgi-bin/cstecgi.cgi file. An attacker can exploit this issue by manipulating the File argument, potentially allowing for remote execution of arbitrary code. Given th...

A security vulnerability has been identified in the TOTOLINK CA300-PoE device related to the function setWiFiWdsAddConfig located in /cgi-bin/cstecgi.cgi. This vulnerability arises from inadequate input validation in the ApCliKeyStr argument, enabling a potential buffer overflow exploit. This fla...

A buffer overflow vulnerability exists in the 'setWiFiRepeaterConfig' function of the TOTOLINK CA300-PoE firmware version 6.2c.884. An adversary could exploit this flaw by manipulating the 'ApCliKeyStr' argument, potentially leading to unauthorized access or control over the device. This issue is...

A significant security flaw has been identified in the TOTOLINK CA300-PoE device affected by a buffer overflow in the setWiFiMultipleConfig function located within /cgi-bin/cstecgi.cgi. This vulnerability allows an attacker to manipulate the Key1Str1 argument, potentially leading to unauthorized ...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability in the SililaWijesinghe Food Ordering System allows for unauthorized exposure of sensitive information through directory listing. This issue arises from improper processing of files within the admin directory, enabling attackers to potentially access data remotely. The lack of ver...

A vulnerability exists in the Tenda AC19 router, specifically in the function saveParentControlInfo located in the /goform/saveParentControlInfo file. This vulnerability arises from improper handling of the deviceId argument, leading to a potential heap-based buffer overflow. The issue allows for...