Publicly Disclosed
PoC Exploits

A remote SQL injection vulnerability is present in the Code-Projects Simple Inventory System 1.0, specifically in the /delete.php file. By manipulating the argument ID, an attacker can execute unauthorized SQL commands against the database, potentially leading to unauthorized data exposure or mod...

A security vulnerability exists within the liftoff-sr CIPster product that affects the TCP Encapsulation Receive Path. Specifically, an unknown function in the source file source/src/enet_encap/encap.cc allows for out-of-bounds reading due to improper input validation. This flaw can be exploited ...

A vulnerability has been identified in the Liftoff-sr CIPster, specifically in the function CipConnMgrClass::forward_open located in cipconnectionmanager.cc. This can be exploited through manipulation of the product_code_ argument, leading to potential out-of-bounds read conditions. The vulnerabi...

A significant vulnerability has been identified in the liftoff-sr CIPster's Generic Attribute Logic, specifically in the CipAttribute::GetAttrData and CipAttribute::SetAttrData functions located in the ciptypes.h file. This flaw can lead to memory corruption through manipulation, enabling potenti...

The Kirki WordPress plugin, prior to version 6.2.3, features a vulnerability where file validation for user-uploaded archives is inadequate. Users with the Editor role can upload malicious files, as the plugin fails to securely handle these uploads by not correctly removing all unnecessary files ...

The JSON Options WordPress plugin prior to version 0.0.4 contains a significant security flaw that lacks proper capability checks and nonce verification. This oversight permits unauthenticated users to trigger actions that alter arbitrary WordPress options on every request. By exploiting this vul...

The Admin and Site Enhancements (ASE) plugin for WordPress prior to version 9.0.1 presents a significant security risk due to inadequate sanitization of uploaded SVG files. This vulnerability allows users who have been granted upload permissions to store malicious files that can execute JavaScrip...

The Royal Addons for Elementor plugin for WordPress prior to version 1.7.1066 contains a critical vulnerability that fails to properly sanitize custom widget markup when writing to a file. This oversight can be exploited by users with the manage_options capability, and in WordPress Multisite envi...

The GutenKit WordPress plugin prior to version 2.5.0 is vulnerable due to inadequate sanitization of uploaded SVG files, particularly on various upload paths. This flaw allows users with file upload permissions, such as Authors, to upload malicious SVG files. Consequently, these files can initiat...

The Depicter — Popup & Slider Builder WordPress plugin, prior to version 4.8.0, is susceptible to a file upload vulnerability. The plugin does not appropriately validate the type of files uploaded through its import feature, allowing users with editor-level access to upload malicious files, inclu...

The GutenKit plugin for WordPress, prior to version 2.5.0, lacks adequate capability verification on certain REST API endpoints. This oversight allows users with Contributor privileges and higher to access sensitive mailing-list audience metadata linked to the site's marketing account. Without pr...

A vulnerability exists in DeDeCMS 3 that allows an attacker to manipulate the 'uploadfile' argument within the /include/dialog/select_media_post.php file. This flaw can result in unrestricted file uploads, which can be exploited remotely. The availability of this exploit has been documented, rais...

A vulnerability in the Login Registration System version 1.0 from Code-Projects has been identified, impacting the SQL Database Backup Handler. This issue allows unauthorized access to files or directories through manipulation of the /loginsystem/database/login_registration_system.sql file. The v...

A vulnerability in Halo version 2.25.4 permits remote attackers to execute arbitrary code. This security flaw arises from the PluginEndpoint.java and installFromUri method, along with the DefaultPluginApplicationContextFactory components. Exploitation of this vulnerability could enable unauthoriz...

A critical vulnerability has been identified in the PullMD product from AeternaLabsHQ, specifically within the REST API Endpoint feature. The issue arises from the improper handling of the 'url' argument in the API, which can be exploited for server-side request forgery (SSRF). This allows attack...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...

A security flaw in amirsanni's Mini-Inventory-and-Sales-Management-System version 0.1 has been identified, specifically in the function Transaction::getAll located in application/models/Transaction.php. This vulnerability arises from improper handling of the argument orderBy/orderFormat, allowing...

A security vulnerability has been identified in DeDeCMS version 53_1_UTF8, particularly in the advancedsearch.php file. This issue allows attackers to manipulate SQL queries through arguments, enabling unauthorized access to the database. The exploit can be executed remotely, putting systems at r...

The Forminator Forms plugin for WordPress is susceptible to an arbitrary file upload attack due to inadequate file type validation in the handle_file_upload function. Attackers can exploit this vulnerability by using specially crafted MIME types that bypass the system's dangerous-extension blockl...

A vulnerability has been identified in version 3.1.0 of mruby, specifically within the udiv function found in bigint.c. This flaw allows for incorrect operator usage during floating point comparisons, creating potential opportunities for remote attacks. It's crucial for users to apply the necessa...

An exploitable vulnerability exists in the Oracle Internet Directory component of Oracle Fusion Middleware. This issue permits an unauthenticated attacker with network access via LDAP to potentially compromise the Oracle Internet Directory, enabling them to take control over the system. Notably, ...

A serious SQL injection vulnerability has been identified in the Code-Projects Assessment Management tool, specifically affecting version 1.0. The flaw exists in the unknown function located within the file /welcome.php, where improper handling of the 'userid' argument allows for remote exploitat...

A security flaw has been found in the Management API of chenhg5 cc-connect, specifically in the shellExecCommand function located in core/engine.go. This vulnerability allows an attacker to manipulate the exec argument, leading to OS command injection. The exploit can be executed remotely, raisin...

A code injection vulnerability exists in the chenhg5 cc-connect software up to version 1.4.1, specifically within the Authenticate function of core/webhook.go. This vulnerability allows attackers to manipulate the argument 'exec', potentially enabling remote code execution. The vulnerability has ...

A security flaw has been identified in the TRENDnet TEW-755AP wireless access point, specifically impacting the 'log_email_server' functionality within the '/cgi-bin/email.cgi' component, identified as 'ssi'. This vulnerability allows attackers to execute arbitrary commands on the device remotely...

The affected versions of cPanel and WHM contain a serious authentication bypass flaw in the login flow. This vulnerability enables unauthenticated remote attackers to bypass authentication mechanisms, allowing them to gain unauthorized access to the control panel. Users of the specified versions ...

A stack-based buffer overflow vulnerability exists in the TRENDnet TEW-755AP that affects the ssi component, specifically through the '/cgi-bin/wan.cgi' functionality. By manipulating the 'cameo.wan.wan_pppoe_password_00' argument, an attacker can exploit the vulnerability remotely. Publicly avai...

A vulnerability has been identified in the TRENDnet TEW-755AP that allows for a stack-based buffer overflow due to improper handling of the SSID argument in the /sbin/mycli file, specifically within the FUN_401000 function. This security flaw can potentially be exploited remotely, enabling attack...

A vulnerability in the TRENDnet TV-IP751WIC webcam can be exploited through an insecure file index at /cgi-bin/admin/set_time.cgi, specifically within the alphapd component. The flaw allows an attacker to manipulate the 'Currenttime' argument, leading to a stack-based buffer overflow. This remote...

A command injection vulnerability exists in the TRENDnet TEW-821DAP due to improper handling of the 'ipaddr' argument in the /cgi-bin/ping.cgi script within the ssi component. This flaw allows attackers to execute arbitrary system commands remotely, posing a significant risk to users. As the expl...

A path traversal vulnerability exists in the RuoYi-Vue framework affecting versions up to 3.9.2. This security flaw is located within the fileDownload/resourceDownload function of the Common Download Endpoint, specifically in CommonController.java. By manipulating the fileName/resource arguments,...

A vulnerability exists in the Hospital Information System version 1.0, specifically in the User::login function within the UsersController.php file. This flaw permits attackers to manipulate the email argument, thereby leading to SQL injection vulnerabilities. The exploitation of this issue can b...

A security vulnerability exists in Spring Tools that enables attackers to execute arbitrary code remotely via JMX when live information mode is enabled. This affects users of Spring Tools for Eclipse version 5.2.0 and earlier, as well as Spring Tools for VSCode, Cursor, and Theia version 2.2.0 an...

The ISPConfig Remote API is susceptible to an authenticated SQL injection vulnerability stemming from improper handling of the primary_id parameter in SQL queries. This flaw allows users with low-privilege permissions to manipulate SQL queries directly, enabling the injection of malicious payload...

Vim, a widely used open-source command line text editor, is susceptible to a heap overflow vulnerability due to improper handling of certain spell file sections. Specifically, prior to version 9.2.0846, the function set_sofo() failed to reset values in sl_sal_first[], which can lead to under-coun...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The cgltf library, up to version 1.15, is prone to an integer overflow vulnerability within the cgltf_validate() function. This vulnerability can be exploited by remote attackers who supply specially crafted .gltf or .glb files with malicious accessor count values. The flawed bounds check allows ...

Security researchers have discovered critical vulnerabilities in Citrix Virtual Apps and Desktops that could potentially allow remote code execution (RCE) attacks. The vulnerabilities tracked as CVE-2024-8068 and CVE-2024-8069 affect the Session Recording component of Citrix Virtual Apps and Desk...

A vulnerability exists in PostgreSQL that enables a user to manipulate the behavior of database queries for others. An attacker with a valid user account can exploit this flaw to execute code with superuser privileges, potentially compromising the integrity and security of the database system. Th...

A vulnerability has been identified in Apache Tomcat that arises from missing encryption mechanisms for sensitive data, which could lead to data exposure. This issue was introduced as a result of the fix for another vulnerability, allowing the EncryptInterceptor to be bypassed. Users running vers...

A schema validation bypass in the Fastify web framework can allow unvalidated request bodies to reach the application logic. Affected versions prior to 5.12.1 fail to replace the root request body with a coerced value when a request body schema targets a top-level primitive. This allows invalid d...

The KiviCare WordPress plugin, prior to version 4.5.4, lacks sufficient checks to ensure that users are authorized to modify appointments. This flaw allows authenticated patients to manipulate other patients' appointments by canceling or rescheduling them without proper permissions. As a result, ...

The KiviCare WordPress plugin, versions prior to 4.5.4, is susceptible to an unrestricted file download vulnerability. This security flaw arises from the plugin's failure to properly verify if an authenticated user has the right to access specific media files. As a result, patient-level users may...

The SAML Single Sign On WordPress plugin, prior to version 5.4.7, contains a serious security flaw that fails to adequately verify the signature of SAML responses before storing the accompanying certificate. This oversight allows an admin-level user to inadvertently promote an unverified certific...

The Membership for WooCommerce plugin prior to version 3.1.2 lacks adequate validation to ensure an API consumer secret is generated before allowing access to its REST API routes. This oversight permits unauthenticated attackers to exploit the API, potentially revealing sensitive user membership ...

The WPS Bidouille plugin for WordPress prior to version 1.33.5 lacks adequate authorization checks in an AJAX action, potentially allowing any authenticated user—such as a subscriber—to access and retrieve the email addresses of all registered users. This vulnerability raises significant privacy ...

The TrueBooker WordPress plugin, prior to version 1.2.7, contains a security flaw that lacks appropriate authorization checks in one of its AJAX actions. This vulnerability enables unauthenticated users to potentially delete any appointment records, along with related booking items and payment da...

The ProSolution WP Client plugin for WordPress contains a reflected Cross-Site Scripting (XSS) vulnerability that can be exploited by attackers. The issue arises from the plugin's failure to adequately sanitize and escape numerous parameters before incorporating them into HTML attributes on publi...

The Broken Link Checker plugin for WordPress, prior to version 2.4.12, is susceptible to a serious security vulnerability. This issue arises from the lack of restrictions on the query variables that the plugin accepts from user input on sites employing plain permalinks. As a result, unauthenticat...

The Easy Appointments plugin for WordPress, prior to version 4.0.1, is affected by a vulnerability that permits users with contributor-level access to read and retrieve all appointment records through an unsecured REST endpoint. This oversight exposes sensitive information, including customer nam...