Publicly Disclosed
PoC Exploits

This vulnerability occurs in several versions of Microsoft Windows where LDAP authentication is improperly managed. It allows attackers to exploit the way group-policy updates are processed. By manipulating this data stream within a domain controller, an attacker can escalate privileges, potentia...

A security flaw exists in the FaviconServlet.java component of Openfire, allowing attackers to exploit the Server Side Request Forgery (SSRF) vulnerability. This enables unauthorized HTTP GET requests to be sent, potentially exposing sensitive data or enabling further attacks on the network. User...

The miniOrange 2FA plugin for WordPress prior to version 6.3.1 and 19.3 allows an attacker with knowledge of a victim's password to bypass authentication limits. This occurs because the plugin does not properly associate second-factor authentication attempt limits with user accounts, enabling unl...

The zipMoney Payments Plugin for WooCommerce prior to version 2.4.0 contains a flaw that allows unauthenticated users to bypass authorization checks. This vulnerability enables unauthorized deletion of WordPress options which can compromise site configuration and access controls. Attackers could ...

The miniOrange 2FA WordPress plugin prior to version 6.3.1 and version 19.3 is susceptible to an authentication bypass vulnerability. This flaw allows unauthenticated users to delete site options via unvalidated transaction inputs. As a consequence, any visitor can potentially remove critical set...

The Site Reviews WordPress plugin prior to version 8.3.0 is vulnerable to a serious deserialization flaw that allows unauthenticated users to inject arbitrary PHP objects. This vulnerability arises from the plugin's failure to properly secure request data during deserialization. It computes a key...

The WooCommerce plugin for WordPress, prior to version 1.1.3, contains a vulnerability in its Registration Form functionality. It fails to properly validate the legitimacy of the registration form, inadvertently allowing users with post-creation capabilities (Contributors and above) to register w...

The Ultimate Gift Cards for WooCommerce plugin prior to version 3.2.10 lacks necessary authorization checks, enabling unauthorized users to access sensitive gift card information. This vulnerability permits retrieval of attached gift cards from arbitrary orders, exposing significant customer pers...

The Notiqoo WordPress plugin prior to version 1.4.14 contains a security flaw that lacks proper capability checks on several AJAX actions. This vulnerability permits users, even those with minimal roles like 'contributor', to manipulate WordPress options via user input. By exploiting this flaw, a...

The Ultimate Gift Cards for WooCommerce plugin, prior to version 3.2.10, contains a vulnerability where it fails to properly match the issued gift card coupon values with the actual transaction amounts at checkout. This oversight allows unauthenticated users to exploit the system, effectively obt...

The WP Fastest Cache plugin for WordPress is susceptible to a SQL injection vulnerability due to inadequate sanitization and escaping of user-supplied data in SQL statements. This flaw enables unauthenticated attackers to execute arbitrary SQL queries, potentially compromising the integrity of th...

The affected versions of cPanel and WHM contain a serious authentication bypass flaw in the login flow. This vulnerability enables unauthenticated remote attackers to bypass authentication mechanisms, allowing them to gain unauthorized access to the control panel. Users of the specified versions ...

A vulnerability has been identified in the Rizwan17 inventory management system that permits cross site scripting (XSS) attacks through the manipulation of the 'msg' argument in the index.php file associated with the Login Page component. This flaw allows attackers to execute code remotely, poten...

A SQL injection vulnerability has been identified in the Rizwan17 inventory-management-system, specifically within the storeCustomerOrderInvoice function located in the includes/manage.php file. An attacker can exploit this vulnerability by manipulating the 'pro_name[]' argument, thereby executin...

A security vulnerability exists in the Rizwan17 inventory-management-system, specifically in the invoice generation component. The issue pertains to the file includes/invoice_bill.php, where improper handling of the arguments order_date and invoice_no allows for missing authentication. This weakn...

A cross-site scripting (XSS) vulnerability has been detected in the Rizwan17 inventory-management-system, particularly in the file includes/DBOperation.php used by the List Handler component. By manipulating the parameters such as category_name, brand_name, or product_name, an attacker can execut...

A security flaw has been identified in the Rizwan17 inventory management system affecting the DBOperation.addCategory function within includes/process.php. The vulnerability arises due to insufficient authentication checks, specifically related to the manipulation of the 'userid' argument. This a...

A vulnerability exists in the Rizwan17 inventory management system due to improper input validation in the update_record function located within includes/manage.php. This flaw allows an attacker to manipulate the arguments update_category, cid, update_brand, and update_product, leading to SQL inj...

MikroTik RouterOS contains a vulnerability in its SSH authentication mechanism, which fails to fully compare RSA public keys. While it checks the key type and modulus, the exponent is overlooked. An attacker with knowledge of an authorized RSA modulus can exploit this flaw by supplying a crafted ...

Gogs, an open-source Git service, has a significant directory traversal vulnerability in its codebase. Specifically, the issue arises from the editFilePost function located in internal/route/repo/editor.go. This vulnerability allows an attacker to access arbitrary directories and files on the ser...

A vulnerability in cPanel's EmailTrack component enables mail-enabled accounts to execute remote code with root privileges through an SQL injection exploit. This security flaw allows unauthorized users to manipulate SQL queries, leading to potential system compromise and disruption of services. S...

The Fortishield.sys driver in Fortinet's FortiClient prior to version 5.2.4 contains vulnerabilities that allow local users to execute arbitrary code with kernel privileges. This is achieved by manipulating the callback function via specific ioctl calls, namely 0x220024 and 0x220028. Unauthorized...

A vulnerability in cPanel's EmailTrack component enables mail-enabled accounts to execute remote code with root privileges through an SQL injection exploit. This security flaw allows unauthorized users to manipulate SQL queries, leading to potential system compromise and disruption of services. S...

MaxSite CMS, in versions up to 109.6, is vulnerable to a PHP object injection flaw due to the improper handling of the ci_session cookie. This vulnerability allows unauthorized attackers to manipulate session cookies leveraging a hardcoded encryption key, enabling them to exploit magic methods an...

MaxSite CMS versions up to 109.6 contain a significant vulnerability where a hardcoded session encryption key is embedded in 'application/config/config.php'. This constant key is never altered during installation, rendering the system vulnerable to authentication bypass by unauthenticated attacke...

MaxSite CMS versions 0.94 through 109.6 are plagued by a cross-site scripting vulnerability located within the admin_page upload handler. This flaw permits any authenticated user to upload HTML files, which may contain malicious scripts. Once these files are placed in the uploads/_pages/ director...

MaxSite CMS versions up to 109.6 are susceptible to a local file inclusion vulnerability that can be exploited via the ajax and require-maxsite dispatchers. This security flaw enables unauthenticated attackers to perform path traversal by providing base64-encoded sequences, allowing them to bypas...

The vulnerability lies in the InCallController.java file, specifically within the serviceClassExists function. This flaw allows for arbitrary code execution due to a logic error, enabling local escalation of privileges without the need for additional execution rights. The issue can be exploited w...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...

Certain KGUARD DVR devices with outdated firmware exhibit a serious vulnerability, exposing a system command execution service on all network interfaces without authentication. This flaw enables remote attackers to execute arbitrary commands, potentially compromising the device entirely. Exploits...

The Windows Cloud Files Mini Filter Driver contains a vulnerability due to missing authentication for critical functions. This flaw allows an unauthorized attacker to perform local tampering, which can impact the integrity of files and data within the affected operating systems, such as Windows 1...

The KeePass password manager, specifically versions 2.35 through 2.61.1, contains a vulnerability that stems from inadequate validation of KDBX header field sizes during memory allocation. This flaw allows attackers to create specially crafted KDBX files that specify excessively large header fiel...

The WooCommerce WordPress plugin prior to version 2.0.2 is susceptible to a file upload vulnerability due to its failure to validate the types of files that can be uploaded when its accepted-types setting is left empty. This lack of validation opens the door for unauthenticated attackers to uploa...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The Contact Form 7 Captcha plugin for WordPress contains a vulnerability that allows unauthenticated users to exploit the shortcode parser functionality. Specifically, earlier versions of the plugin, prior to 0.1.9, process the entire Contact Form 7 form’s output, which includes user-submitted da...

The WP Express Checkout plugin for WordPress prior to version 2.5.0 is susceptible to a significant security flaw that fails to properly validate the completion of payment transactions on the server-side. This oversight allows unauthorized users to simulate the payment process, marking orders as ...

The CleanTalk WordPress plugin prior to version 6.87 is susceptible to an arbitrary shortcode execution vulnerability. This flaw allows unauthenticated users to submit comment content that is processed by the WordPress shortcode engine. As a result, malicious visitors can register and execute arb...

The Hustle plugin for WordPress prior to version 7.8.14.2 contains a security flaw that permits unauthenticated users to execute shortcodes through form submissions. The plugin fails to sufficiently sanitize shortcodes in user-provided input, allowing potential attackers to exploit this weakness ...

The WPLP Cookie Consent plugin for WordPress prior to version 4.4.2 suffers from an access control weakness due to the absence of nonce and capability checks on various AJAX actions. This flaw permits any authenticated user, including those with minimal privileges such as subscribers, to gain una...

The Orbit Fox plugin for WordPress, prior to version 3.0.9, is susceptible to a Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate validation of user-supplied HTML tag names within specific Beaver Builder widgets. As a result, users possessing contributor-level access or h...

The Kirki WordPress plugin, prior to version 6.3.0, contains a vulnerability that allows unauthenticated users to access private content. This issue arises because the plugin fails to verify whether a requester is authorized to view certain pages, including those marked as private, draft, or tras...

The Sunshine Photo Cart plugin for WordPress prior to version 3.7 is susceptible to a vulnerability that arises due to insufficient validation of client-supplied price identifiers. This flaw allows unauthenticated users to manipulate price information during the cart process, enabling them to pur...

The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.2, is susceptible to an improper authentication vulnerability. This flaw stems from the inadequate implementation of nonce and capability checks in a specific AJAX action related to its cookie scanner functionality. As a result, a...

The Quentn WP plugin for WordPress prior to version 1.2.15 is vulnerable due to improper sanitization and escaping of user input in SQL queries. This flaw can allow high privilege users, such as administrators, to execute malicious SQL commands, potentially compromising the integrity of the datab...

The Quentn WP WordPress plugin, prior to version 1.2.15, has a critical vulnerability that arises from improper escaping of request parameters in SQL queries. This flaw enables unauthenticated attackers to exploit the plugin, allowing them to perform SQL injection attacks. As a consequence, they ...

The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.2, is vulnerable due to the lack of capability and nonce checks in its A/B testing actions. This oversight allows authenticated users, including those with minimal privileges like subscribers, to alter the cookie banner settings t...

The Sina Extension for Elementor, a popular WordPress plugin, is vulnerable to Stored Cross-Site Scripting due to inadequate escaping of HTML attributes in the Table widget settings. This flaw could be exploited by users with Contributor roles or higher to inject malicious scripts, potentially co...

The Masteriyo LMS WordPress plugin prior to version 3.4.0 is susceptible to improper access control, as it fails to verify user authorization before disclosing course enrollment records through its REST API. This vulnerability enables unauthorized users to access sensitive information, including ...

The SupportCandy WordPress plugin prior to version 3.5.3 contains a vulnerability that fails to validate submitted authorization codes for individual support tickets. As a result, unauthenticated users can read the confidential content of any support ticket without proper authorization. This flaw...

The Groundhogg WordPress plugin, before version 4.7.2, is susceptible to an improper redirect vulnerability. This flaw allows attackers to manipulate the email preference confirmation flow, leading to the potential redirection of unsuspecting users to arbitrary external URLs. By crafting maliciou...