Publicly Disclosed
PoC Exploits

A vulnerability exists in the Linux kernel's vsock/virtio implementation regarding zerocopy completion for multi-segment sends. If a large message is fragmented into multiple skbs, only the last skb has the zerocopy user argument (uarg) allocated, leaving non-final skbs with pinned user pages tha...

A vulnerability in the Linux kernel has been identified which affects the BPF Just-In-Time (JIT) allocation. The issue involves a potential exploitation vector related to JIT spraying while mitigating the Spectre version 2 attack. To enhance security, the introduction of an Indirect Branch Predic...

A flaw exists in the cifs-utils, enabling a local user to perform privilege escalation. This vulnerability occurs when a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file. The lack of proper input sanitization allows unauthorized mount o...

The WooCommerce plugin for WordPress prior to version 3.3.2 is susceptible to a security issue where it fails to perform appropriate capability checks during its calendar view AJAX actions. As a result, users with relatively low privileges, such as those assigned the Contributor role, can access ...

The Smush plugin for WordPress, prior to version 4.3.4, has an access control vulnerability that permits individual site administrators within a multisite network to modify settings that should be restricted to network administrators. This misuse of access permissions could potentially lead to un...

The OTP Login & Register WooCommerce plugin for WordPress, prior to version 2.7.3, is susceptible to a brute-force attack due to inadequate limitations on one-time-password verification attempts. This is a critical flaw as it allows an unauthenticated attacker to manipulate the attempt limit by s...

The Affiliate Toolkit WordPress plugin, prior to version 3.8.9, has a critical flaw where user-inputted sort values are not validated against an allowlist prior to their use in database queries. This oversight undermines security, permitting users with editor-level access and higher to execute SQ...

The MB Custom Post Types & Custom Taxonomies plugin for WordPress prior to version 2.12.2 is susceptible to a vulnerability that permits authenticated users, even those with minimal permissions such as subscribers, to execute uncontrolled migration actions. This can result in the creation of publ...

The Salon Booking System WordPress plugin prior to version 10.31.9 is susceptible to an authorization bypass vulnerability. This flaw allows unauthenticated attackers to create bookings under any user’s name, modify stored contact information, and change booking statuses to paid or confirmed, all...

The Salon Booking System plugin prior to version 10.31.3 has a vulnerability that permits any authenticated user, including subscribers, to access endpoints of the booking REST API without proper authorization. This oversight allows these users to view all customer bookings and associated persona...

The Salon Booking System plugin for WordPress versions prior to 10.31.9 contains a security flaw that stems from the insecure generation of booking-API access tokens. The tokens are derived from a hardcoded value within the plugin combined with the timestamp of their issuance, rather than from a ...

The Salon Booking System plugin for WordPress prior to version 10.31.9 includes a vulnerability that compromises the integrity of REST API request verification. This issue arises from the plugin's failure to adequately authenticate requests, as it neglects to implement WordPress's nonce verificat...

The Visual Form Builder WordPress plugin prior to version 3.1 lacks necessary authorization checks, enabling any authenticated user from Subscriber level and above to access recent form submissions displayed in a dashboard widget. This loophole can lead to unauthorized disclosure of sensitive use...

The Mobile Builder WordPress plugin prior to version 1.4.2 has a significant vulnerability due to the improper sanitization and escaping of a parameter in its SQL statements. This flaw enables unauthenticated users to execute SQL injection attacks, compromising the integrity of the database on si...

The Document Gallery WordPress plugin prior to version 5.1.1 lacks essential capability and ownership checks, enabling unauthorized users to generate galleries on demand. This vulnerability permits these users to disclose sensitive information, such as titles, descriptions, and direct URLs of med...

The Visual Form Builder plugin for WordPress versions up to 3.1 lacks proper authorization and nonce validation when users attempt to reorder form fields. This security oversight enables any authenticated user, including those with Subscriber roles, to modify the structure of forms on the site. S...

The Coinsnap Bitcoin Crowdfunding WordPress plugin, up to version 1.2.0, contains an access control vulnerability that fails to adequately restrict access to the secret key used for authenticating its payment gateway webhook. This oversight allows unauthorized users to access sensitive informatio...

The Subscribe to Comments Plugin for WordPress, before version 2.3.3, suffers from a serious cookie validation flaw. This vulnerability allows unauthenticated attackers to exploit the lack of signing or validation on a trusted cookie used to identify commenters. As a result, an attacker can poten...

The WX Subscribe WordPress plugin, through version 1.2.1, contains a vulnerability due to improper sanitization and escaping of input parameters before processing them in SQL statements. This flaw allows unauthenticated attackers to exploit the vulnerability to perform SQL injection attacks, part...

A vulnerability exists in the Neterbit NW-431F embedded web server that allows an attacker to remotely access sensitive information by exploiting an insecure function in the /sms.json file. This manipulation could lead to unauthorized data exposure, compromising user privacy while revealing sensi...

A local security flaw has been identified in the AutoBackend Model Loading component of the ImprintLab Medical-SAM-Adapter. Specifically, the issue lies within the function session.get_modelmeta.custom_metadata_map in the file models/MobileSAMv2/ultralytics/nn/autobackend.py. The vulnerability ar...

A vulnerability in the Linux kernel related to posix CPU timers can lead to a use-after-free condition due to a race in non-leader exec() scenarios. When a timer associated with a process is deleted while concurrently executing an exec() command, it can cause access to freed memory. Specifically,...

Aureus ERP versions up to 1.6.0 have a stored cross-site scripting vulnerability found in the HolidayAction.php file. This issue arises when authenticated users are able to input unescaped holiday names, which are then rendered as HtmlString. Attackers who are authorized to create Public Holidays...

The Jooan JA-A12 IP cameras with specific firmware versions are vulnerable to a remote code execution issue that enables attackers to gain unauthorized control. By exploiting hard-coded credentials, unauthorized users can send crafted requests to the device, triggering the jooandiag daemon to exe...

A significant vulnerability in Ivanti Connect Secure version 22.8R2.4 allows attackers to exploit issues in the way DSCache configuration data is handled by the dsinvoked broker. This flaw can lead to unauthorized privilege escalation to root level. Exploits for this vulnerability have already be...

MaxKB, an open-source AI assistant designed for enterprise use, is susceptible to a command injection vulnerability in versions prior to 2.10.5-lts. This flaw arises from the misuse of the SandboxShellBackend, which improperly exposes an execute shell tool and neglects to implement necessary secu...

LightLLM version 1.2.0 presents a denial of service vulnerability that enables unauthenticated attackers to disrupt the inference worker. By sending a carefully crafted request to the /generate endpoint that includes the internal pd_kv_trans_params field, an attacker can trigger a failure in the ...

The libewf product by libyal contains a vulnerability that allows attackers to exploit a heap out-of-bounds read condition in the function libewf_lef_extended_attribute_read_data(). This issue arises due to improper validation of UTF-16 name and value sizes prior to being doubled. By crafting a m...

EarthScope libmseed versions up to 3.5.4 are vulnerable to a heap out-of-bounds read issue in the ms3_detect() function located in parseutils.c. Exploitation of this vulnerability allows attackers to supply a buffer of 40 to 47 bytes, potentially leading to an over-read of up to 8 bytes beyond th...

SoX versions up to 14.4.2 are susceptible to a heap out-of-bounds write vulnerability located in the function lsx_ms_adpcm_block_expand_i() within the file src/adpcm.c. This issue arises from the processing of WAV files with an anomalous samplesPerBlock value in the fmt chunk. Attackers can explo...

libTiMidity versions up to 0.2.8 contain a vulnerability in the init_soundfont() function, located in src/sndfont.c, which can lead to out-of-bounds memory access. This allows attackers to exploit unvalidated SF2 preset header bank and preset values. By crafting a malicious .sf2 file with indexes...

Game Music Emu (libgme) versions prior to 0.6.5 are prone to a global out-of-bounds read vulnerability within the Classic_Emu::mute_voices_ method. This flaw enables attackers to induce application crashes by supplying crafted NSF files with a voice count exceeding the predefined 16-entry voice-t...

OpenJPH, up to version 0.32.0, features a vulnerability in the HTJ2K cleanup-pass decoder that permits an attacker to execute a heap out-of-bounds write. This is achievable by supplying a specially crafted .j2c or .jph codestream with small precinct sizes, leading to memory corruption as the deco...

The libvgm library developed by ValleyBell exhibits a heap out-of-bounds read vulnerability within its PCM data-block decompressor. An attacker can exploit this flaw by crafting a specially designed .vgm file that utilizes a type 0x7F table containing wider compressed values. This manipulation le...

The libsidplayfp library is vulnerable to a heap out-of-bounds read, allowing attackers to manipulate PSID/RSID files by supplying unchecked data offsets. This vulnerability permits attackers to exceed the file size limitations, which enables the resolveAddrs() function to attempt reading up to 6...

A heap out-of-bounds read vulnerability exists in FreeImage (danoli3 fork) versions up to 3.19.23 within the Unpack32Bits() function of the PluginPICT.cpp file. This issue arises because the rowBytes parameter is not validated against the PixMap width, allowing attackers to craft PICT files with ...

Libyal Libesedb through version 20260704 is affected by a heap out-of-bounds read vulnerability within the function libesedb_record_get_multi_value(). This issue allows attackers to read past allocated buffers by exploiting unbounded multi-value offset tables. By supplying a specially crafted ESE...

The ytnef library version 2.1.2 and earlier contains a heap out-of-bounds read vulnerability within the MAPIPrint() function. Attackers can exploit this vulnerability by providing specially crafted winmail.dat files that contain compressed RTF properties lacking a NUL terminator. This can lead to...

The libansilove library versions 1.3.0 through 1.4.2 exhibit a NULL pointer dereference vulnerability within the ansilove_xbin() function. This issue arises when an attacker supplies a specially crafted XBIN file, which can lead to application crashes. Specifically, if the 512-character flag is s...

The libregf library through version 20260526 is susceptible to a heap out-of-bounds read due to improper handling of value data sizes in its function libregf_value_item_read_value_data(). An attacker can create a malicious version 1.0/1.1 REGF hive that, when processed, can lead to the exposure o...

The libnsbmp library, used by the NetSurf browser, contains an out-of-bounds read vulnerability in the bmp_decode_mask() function. By supplying a specially crafted ICO file with a bitmap width that is not a multiple of 8, attackers can exploit this flaw to read one byte past the image buffer. Thi...

The libsmi library, up to version 0.5.0, contains a critical out-of-bounds write vulnerability in the smiValueAsString() function located in lib/smi.c. This flaw allows attackers to exploit a fixed 1024-byte buffer. By supplying a maliciously crafted Management Information Base (MIB) that include...

CFITSIO versions through 4.7.0 contain a vulnerability that allows for a heap-based out-of-bounds read via the HCOMPRESS tile decoder. By crafting a specially designed FITS file that declares oversized tile geometry, an attacker may exploit this flaw through the input_nnybble function in fits_hde...

Aureus ERP version up to 1.6.0 is susceptible to a stored cross-site scripting vulnerability. This issue arises due to the lack of proper input validation, allowing authenticated users to inject malicious scripts through unescaped input fields for Operation Type and Location names. When warehouse...

AdPlug, through version 2.4, is affected by a heap out-of-bounds read vulnerability in the CdmoLoader::load() function located in src/dmo.cpp. This issue occurs when attackers exploit a vulnerability that allows reading beyond allocated memory by supplying a truncated TwinTeam DMO file. Specifica...

The SimplePie library, up to version 1.9.0, is vulnerable to a local file read attack. This occurs when malicious feed servers can exploit the library's handling of file redirects or autodiscovery links using file:// URLs. By manipulating the Location header or feed link to point to a file path, ...

A reflected cross-site scripting vulnerability exists in the pfSense CE web interface, specifically within the firewall_rules.php script. This vulnerability enables remote attackers to execute arbitrary scripts by enticing users with elevated firewall rules privileges to click on a specially craf...

Netgate pfSense CE versions 2.3.0 through 2.9.0 are susceptible to a stored cross-site scripting (XSS) vulnerability. This issue allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject malicious scripts via the separator color field in the WebGUI. Attackers explo...

Netgate pfSense CE through version 2.9.0 is susceptible to an authorization bypass that enables read-only WebGUI users to manipulate the config.xml file. This occurs due to the negligence of 'User - Config: Deny Config Write' privilege within the config_restore() and config_install() functions. I...

A command injection vulnerability exists in pfSense CE versions 2.7.0 through 2.9.0, impacting the Captive Portal functionality. Users with the Captive Portal HA privilege can exploit this flaw to execute arbitrary commands with root privileges. This vulnerability arises when an attacker manipula...