Publicly Disclosed
PoC Exploits

The Wavlink WL-WN530BE1-A firmware version M30BE1_V251117 is susceptible to an OS command injection vulnerability located in the ioos binary's sub_23B54 function. This vulnerability arises from the unsanitized handling of the file_id parameter in requests made to /protocol.csp?opt=ovpn_file, part...

A vulnerability affecting aaPanel versions up to 8.25.0 has been identified, specifically in the GetClientIp function within the common.py file. This flaw arises from mishandling of the X-Real-Ip argument, allowing unauthorized users to bypass access controls, making it possible for remote attack...

A security flaw exists in the aaPanel software, specifically within the File Manager component. The vulnerability arises from improper handling of user-supplied data in the ExecShell function located in the common.py file. This flaw allows for OS command injection, enabling an attacker to execute...

A flaw in aaPanel's Download Endpoint allows an attacker to manipulate the 'filename' argument in the send_file function within BTPanel/routes/v2.py. This path traversal vulnerability can be exploited remotely, granting unauthorized access to sensitive files on the server. Authentication is requi...

A vulnerability in Stirling-PDF versions 2.13.2 through 3.2.0 allows authenticated administrators to bypass H2 database import restrictions. This occurs due to an incomplete denylist in the DatabaseService.validateSqlContent() method, enabling the execution of unauthorized SQL commands when a cra...

Stirling-PDF versions 3.0.0 to 3.2.0 are vulnerable to an authorization bypass that allows authenticated users to access and manipulate other users' files. By targeting the server's storage directory through a crafted request to the processing folder API, attackers can list files belonging to vic...

A vulnerability exists within MinIO's Embedded Console related to the globalDeploymentID and SessionTokenAuthenticate function located in cmd/common-main.go. The flaw arises from the presence of a hard-coded cryptographic key, which poses a risk of remote exploitation. Attackers may leverage this...

A vulnerability exists in Nerimity Desktop versions up to 2.2.2, where the function shell.openExternal in src/mainWindow.js fails to properly authorize the handling of custom URL schemes. This flaw allows for remote exploitation, as it allows unauthorized actions through manipulated URL arguments...

A command injection vulnerability exists in the DrayTek Vigor2960 router, specifically targeting the 'ruequest_certificate' function within the IPsec Handler. This flaw allows remote attackers to manipulate request parameters and execute arbitrary commands on the affected device. The vulnerabilit...

A command injection vulnerability exists in the DrayTek Vigor2960 router within the rename_table function of the Rename Table Handler. This flaw allows attackers to manipulate arguments sent to the endpoint, which can lead to unauthorized command execution. The vulnerability can be exploited remo...

A vulnerability has been identified in the DrayTek Vigor2960 router where the function cgiEscape in the file /cgi-bin/mainfunction.cgi allows for path traversal through the manipulation of the multipart argument. This flaw can be exploited remotely, potentially leading to unauthorized access of s...

A vulnerability has been detected in the DrayTek Vigor2960 router, specifically in the setSWMProfile function located within /cgi-bin/mainfunction.cgi. This flaw allows attackers to manipulate input arguments leading to path traversal attacks. Such vulnerabilities can be exploited remotely, poten...

A vulnerability exists in the DrayTek Vigor2960 router that allows attackers to exploit the file processing system in /cgi-bin/mainfunction.cgi of the commonupload component. By manipulating the parameters upload_path and upload_name, an attacker may perform an unrestricted upload of malicious fi...

A vulnerability has been identified in the DrayTek Vigor2960 router, specifically affecting the /cgi-bin/mainfunction.cgi file within the Apmupload component. This vulnerability allows for path traversal attacks, which can be executed remotely. The manipulation of the action argument exposes sens...

A command injection vulnerability exists in DrayTek Vigor2960 routers, specifically in version 1.5.1.6 Revision 8218. The issue is located in the uploadlangs function of the /cgi-bin/mainfunction.cgi file within the Upload Endpoint component. This vulnerability allows attackers to manipulate the ...

A significant vulnerability has been identified in the DrayTek Vigor2960 firmware version 1.5.1.6. This issue resides in a function within the CGI Interface, specifically sub_182B0 in the file /cgi-bin/mainfunction.cgi. By manipulating certain arguments, such as usefile, uscript, or option, an at...

A command injection vulnerability exists in the DrayTek Vigor2960 router firmware version 1.5.1.6 Revision 8218 within the set_table function of the CGI Process. This vulnerability allows attackers to manipulate the 'sectiontype' argument, potentially leading to unauthorized command execution. Th...

A security flaw exists in the Open Source Social Network (OSSN) that allows for code injection through the input manipulation of the Cache Settings component. Specifically, the vulnerability is found in the actions/administrator/cache/dynamic.php file and can be exploited remotely by altering the...

A vulnerability in the LeeDrOiD Labs Shortcutter 2 App version 9.0.48 affects Android's export mechanism of application components through improper handling in the ToggleGeneric.java file's Class.forName function. This vulnerability requires local access for exploitation, posing a risk where mali...

LavaLite CMS versions up to 10.1.2 are vulnerable due to a missing authentication mechanism in the Filer module. This flaw permits unauthorized attackers to exploit the filer/download and filer/display routes, enabling them to download sensitive files stored within the application. By providing a...

DokuWiki versions prior to 2026-07-14c are susceptible to a PHP object injection vulnerability within the Draft::getDraftText() method. This issue arises due to the lack of restrictions on allowed classes when passing draft file contents to the unserialize() function. Authenticated users with edi...

An out-of-bounds write vulnerability exists in Fortinet's FortiOS and FortiProxy products across multiple versions, which allows attackers to potentially execute unauthorized code or commands. This type of vulnerability arises when the software fails to properly restrict the writing of data to a ...

A security issue has been identified in the mcollina mcp-ripgrep Advanced Search Tool affecting versions up to 0.4.0. This vulnerability allows for OS command injection through improper handling of the fileType argument within the src/index.ts file. The underlying problem stems from a CWE-78 over...

The Easy Property Listings WordPress plugin, prior to version 3.5.27, is susceptible to an authorization bypass vulnerability. This flaw permits any authenticated user, even those with the minimal role of subscriber, to access and read confidential CRM data, including contact and lead records alo...

The Easy Property Listings plugin for WordPress prior to version 3.5.28 suffers from a security flaw that permits unauthenticated users to access sensitive information through the public REST API. This vulnerability occurs due to a lack of restrictions on which listing fields are made publicly av...

The SMBv1 protocol in various Microsoft Windows operating systems contains a vulnerability that enables remote attackers to execute arbitrary code by sending specially crafted packets to the server. This issue affects multiple versions of Windows, including desktop and server editions, allowing e...

A vulnerability in the Apache Camel HTTP component arises from the improper handling of case sensitivity in request headers. This issue allows an attacker to bypass suppression mechanisms by altering the case of HTTP header names, leading to potential response-splitting and cache-poisoning attack...

A vulnerability in the Apache Camel HTTP component allows sensitive information to be exposed to unauthorized actors. Because of a flaw in the handling of redirect responses, credentials may be inadvertently sent to a malicious server during HTTP redirects when the `followRedirects` flag is true....

Letta versions up to 0.16.8 contain an information disclosure flaw where the LocalSandbox subprocesses have access to the full server environment. This allows malicious users executing tools via POST requests to read sensitive server secrets, including LETTA_PG_URI, POSTGRES_PASSWORD, and provide...

The Letta platform, up to version 0.16.8, is susceptible to an authentication bypass vulnerability that enables API callers to impersonate other users. By modifying the 'user_id' HTTP header, attackers can specify the ID of another tenant, allowing unauthorized access to sensitive information rel...

The Letta application, up to version 0.16.8, features a configuration flaw that results in a lack of secure server settings, leading to severe security implications. Specifically, the default settings in the compose.yaml file do not activate the LETTA_SERVER_SECURE option, resulting in all API ro...

Coze Studio, up to version 0.5.1, includes a vulnerability in the workflow.go file that permits authenticated users to exploit insecure direct object references. By manipulating workflowIDs, an attacker can gain unauthorized access to workflows belonging to other tenants. This allows potential ac...

DB-GPT versions up to 0.8.2 have a severe vulnerability due to hardcoded credentials within its default docker-compose.yml configuration. This includes a static MYSQL_ROOT_PASSWORD and exposes port 3306 on all interfaces, allowing unauthorized access. Attackers capable of accessing port 3306 or c...

Coze Studio prior to version 0.5.0 has a serious flaw that stems from its default configuration, allowing registered users to execute commands through running workflow code in an unsandboxed Python3 subprocess. This enables threat actors to manipulate the system by bypassing import filters, leadi...

DB-GPT versions up to 0.8.2 are susceptible to an unauthenticated remote code execution vulnerability, allowing unauthorized attackers to exploit the /api/v1/chat/react-agent endpoint. This exploitation results from a flaw in the mock get_user_from_headers function, which erroneously assigns admi...

EvoScientist version 0.1.0 and prior is susceptible to an approval bypass vulnerability that permits attackers to execute host shell commands. This is achieved by delegating tasks to async sub-agents that bypass essential security controls. Attackers can embed malicious instructions within ingest...

Aix-DB 1.2.4 is susceptible to a remote code execution vulnerability that permits authenticated non-admin users to execute operating system commands via the ChatBI common agent's execute tool. By crafting specific chat inputs or uploading documents containing malicious text, attackers could invok...

The Langchain-Chatchat software, up to version 0.3.1.3, exposes a vulnerable API endpoint (/tools/call) that allows remote attackers to execute arbitrary operating system commands without authentication. This flaw stems from the capability of the endpoint to invoke any registered tool by name, th...

JoySafeter versions prior to 1.0.0 are vulnerable to a remote code execution flaw that enables authenticated users to execute arbitrary operating system commands. By leveraging an unsandboxed execute tool in the Copilot standard mode, attackers who can self-register may exploit the WebSocket chat...

The vulnerability in OpenSRE allows adversaries to bypass the approval gate mechanism, enabling them to execute arbitrary shell commands without user confirmation. Due to a flaw in the execution_allowed() function, which consistently returns true, attackers can inject malicious instructions into ...

LangAlpha, up to version 2026.09.07, contains an improper isolation vulnerability that allows authenticated users within their own sandbox containers to connect to other tenants' containers. This occurs due to the shared default bridge network in Docker, which enables inter-container communicatio...

The piflow software, versions 2.0.0 and 2.0.1, features a significant remote code execution vulnerability within its DeepAgents chat agent. The endpoints for POST /chat and POST /chat/stream do not require authentication, allowing potential attackers to exploit this lack of security. They can ins...

A stack-based buffer overflow vulnerability has been identified in the H3C Magic NX15, specifically within the function sub_416874 located in the /usr/bin/usrlist file. This flaw allows for remote exploitation, potentially enabling unauthorized access or malfeasance. The vulnerability has been pu...

A vulnerability exists in the Apache Camel XPath component due to improper handling of the XML document type InputSource. This flaw allows external entities specified in XML payloads to be processed, potentially granting an attacker access to files on the host or enabling requests to arbitrary ho...

A vulnerability exists in H3C Magic NX15 V100R017 that allows remote attackers to exploit the 'importprofile' function in the /api/upload file. This flaw enables manipulation of the 'fileName' argument, leading to path traversal, which can result in unauthorized access to filesystem data. Publicl...

A vulnerability in Spring Security allows malformed X.509 certificate CN values to be incorrectly processed, potentially leading to unauthorized user impersonation. By exploiting this flaw, an attacker could present a specially crafted certificate that misrepresents another user's identity, posin...

A code injection vulnerability has been identified in the H3C Magic NX15, specifically affecting the write function within the RPC interface at /api/esps. By manipulating the argument path, an attacker can execute arbitrary code remotely. Public disclosure of this exploit has issued a warning for...

A significant security flaw has been identified in H3C Magic NX15, specifically within the function sub_416874 located in the /usr/bin/usrlist file. This vulnerability allows an attacker to manipulate commands, potentially leading to unauthorized execution of arbitrary OS commands. The threat of ...

The vulnerability in Apache Camel’s Tika component arises from improper input validation, allowing attacker-controlled document metadata to be injected as headers into the Exchange. This can lead to a serious breach where the document's metadata influences downstream processing, potentially compr...

A logic vulnerability has been identified in the Transsion mobile application 'Com.Transsion.AppLock', which may allow unauthorized users to bypass the application’s password protection mechanism. This flaw arises from improper handling of input verification, potentially exposing sensitive user d...