Publicly Disclosed
PoC Exploits

An unauthenticated attacker can exploit a vulnerability in WordPress that allows `get_page_template()` to inadvertently resolve and include a chosen local `.php` file located outside of the active theme directories. When specific server conditions and configurations of the active theme are met, t...

An unauthenticated attacker can exploit a vulnerability in WordPress that allows `get_page_template()` to inadvertently resolve and include a chosen local `.php` file located outside of the active theme directories. When specific server conditions and configurations of the active theme are met, t...

The MasterStudy LMS plugin for WordPress, specifically versions 1.9 through 3.7.50, is susceptible to a serious vulnerability that allows unauthorized course enrollment. The flaw arises because the plugin fails to verify whether a member's requested course aligns with their membership plan. As a ...

The wpForo Forum plugin for WordPress versions 3.0.0 to 3.1.5 has a vulnerability that fails to adequately verify client-supplied IP address headers. This flaw enables unauthenticated attackers to manipulate these headers, thereby bypassing established rate limits on paid AI requests. As a result...

The Bookly WordPress plugin prior to version 28.3 is susceptible to a vulnerability where it fails to adequately verify the identity of customers when they attempt to update their stored details. This oversight allows unauthorized attackers who have knowledge of a customer's primary identifier to...

An out-of-bounds write vulnerability has been identified in the libavcodec library of FFmpeg, particularly within the MagicYUV decoder. This flaw may lead to denial-of-service conditions and has the potential to be exploited for remote code execution. The issue arises from improper handling of ce...

The Link Library plugin for WordPress prior to version 7.9.6 suffers from a security flaw due to improper URL validation. When a user submits a URL, the plugin may revert to making requests to potentially unsafe internal network resources if the input is deemed unsafe. This lack of validation ena...

The Link Library WordPress plugin prior to version 7.9.6 contains a flaw that permits unauthorized users with the Contributor role and higher to create directories and manipulate image files on the server. This vulnerability arises due to a lack of proper sanitation of user-supplied input, allowi...

The Link Library WordPress plugin prior to version 7.9.6 is vulnerable due to inadequate escaping of certain parameters when generating links for its front-end directory pages. This oversight allows for the exploitation of Reflected Cross-Site Scripting attacks, affecting any visitor to the site,...

A significant vulnerability exists in Sanluan PublicCMS, affecting versions up to 6.202506.e. This flaw is found in the CmsContentAdminController, specifically in the exportExcel/exportData functionality. An attacker can exploit this vulnerability to bypass authorization controls by manipulating ...

Pangolin versions prior to 1.22.0 have a security flaw that permits unauthorized users to bypass authentication mechanisms. This vulnerability arises when an attacker manipulates URL parameters for the share-link authentication endpoint, leading to unauthorized access to various protected resourc...

The Visual Composer Website Builder plugin for WordPress allows local file inclusion through the `vcv-template` parameter in all versions up to and including 45.16.0. This vulnerability enables unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to ...

Prior to the versions 2026.2.7, 2026.5.7, and 2026.8.2, Authentik had a privilege escalation vulnerability whereby accounts with delegated group management permissions could grant superuser status without proper authorization. This issue affected only deployments where non-administrators were giv...

A cross site scripting vulnerability exists in the ningzichun student-management-system due to improper handling of user input in the echo function of admin/fun/addLog.php. This flaw allows an attacker to manipulate the 'reason' and 'detail' arguments, potentially leading to the execution of mali...

The Visual Composer Website Builder plugin for WordPress allows local file inclusion through the `vcv-template` parameter in all versions up to and including 45.16.0. This vulnerability enables unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to ...

A significant vulnerability exists within the ningzichun student-management-system, specifically in the file example_lite.sql, allowing attackers to exploit an unknown functionality. This flaw facilitates the use of default credentials, enabling unauthorized remote access. Although the issue has ...

A cross-site request forgery vulnerability has been identified in the Ningzichun Student Management System, affecting versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This flaw allows attackers to execute unauthorized commands on behalf of users without their consent, enabling remote expl...

The vulnerability in Apache OFBiz arises from an outdated XML-RPC component, which has not been maintained and poses a risk of pre-authentication remote code execution. This issue specifically affects Apache OFBiz versions before 18.12.10, highlighting the necessity for users to upgrade to the la...

A security vulnerability has been identified in the ningzichun Student Management System, specifically affecting versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. The issue resides in an undisclosed function within editLog.php, which allows for the manipulation of parameters such as sid, a...

A vulnerability in the chillzhuang SpringBlade framework has been identified, affecting the UserServiceImpl.userInfo function. This weakness allows an attacker to manipulate userId arguments, leading to unauthorized access to user information. The exploitable endpoint can be accessed remotely, ra...

Copyparty's SFTP front end is vulnerable to a volume restriction bypass, allowing authenticated users to create, delete, or modify files outside their permitted volume boundaries. By exploiting specific handlers (_mkdir, _rmdir, and _chattr), attackers can craft destination paths without proper a...

A vulnerability in jhen0409 React Native Debugger versions up to 0.14.0 allows for OS command injection via the openDevTools function in the electron/window.js file. By manipulating the host argument, an attacker can launch commands on the target system remotely. This exploit has been publicly re...

The MountDev AI MCP Connector for WordPress allows unauthorized users to exploit a vulnerability that bypasses the necessary authorization checks. Attackers can register arbitrary OAuth clients via a public registration endpoint and gain access to secure functionalities of the plugin. This includ...

A vulnerability has been identified in Songxinjianqwe Chat, specifically in the chat-server component located in the ChatServer.java file. This weakness allows for server-side request forgery (SSRF), enabling attackers to potentially initiate remote exploitation. The affected version is up to ac6...

DJI drones possess a vulnerability that allows attackers within Bluetooth range to send unauthenticated DUML commands. This flaw enables unauthorized modifications to critical Wi-Fi settings, including SSID and PSK, providing attackers potential access to control interfaces of the drone. Conseque...

A cross-site scripting vulnerability has been discovered in the volotat Anagnorisis application, specifically within the html function of PlaylistManager.js. This issue arises due to the manipulation of the 'file_path' argument, which can lead to unauthorized script execution by an attacker. Sinc...

A significant vulnerability exists in the Volotat Anagnorisis product, specifically in the functions responsible for handling file operations, such as get_file_content, save_file_content, and move_files. This flaw allows attackers to manipulate file paths, leading to unauthorized access to sensit...

A vulnerability has been identified in the Socket.IO Connect Interface of volotat Anagnorisis versions up to 0.4.0, specifically within the 'app.py' file. This flaw allows for missing authentication, enabling unauthorized users to exploit the system remotely. As this exploit has been publicly dis...

HFS2 versions 2.4.0 and earlier are susceptible to a denial of service vulnerability that allows unauthenticated attackers to disrupt service. By sending a specially crafted request, an attacker can cause a serving thread to enter a busy loop, leading to a complete unresponsiveness of the file se...

HFS2 version 2.4.0 and earlier has a vulnerability that allows unauthenticated attackers to gain unauthorized access to files. This weakness is due to the macro dispatcher's insufficient authorization checks and the path resolver's failure to restrict absolute paths. As a result, attackers can re...

HFS2 versions 2.4.0 and earlier are susceptible to a template injection vulnerability located in the multipart upload handler. This issue allows unauthenticated attackers to execute arbitrary commands on the host system by embedding malicious template syntax within a crafted filename. By manipula...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A security vulnerability has been identified in the halo-dev Halo application, specifically affecting versions up to 2.25.4/2.26.1. The issue resides in the ReplyNotificationSubscriptionHelper.java file, where the component's SpEL Handler fails to properly neutralize certain elements. This flaw c...

A security flaw has been identified in the O2OA product that affects its Cipher Connection Handler. This vulnerability arises from improper handling of the 'fileUrl' parameter within the file located at o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnection...

An out-of-bounds access issue in Apple's macOS products could allow a malicious SMB server to exploit the vulnerability, leading to unexpected system terminations or potential corruption of kernel memory. This flaw highlights the importance of proper bounds checking in software designed to handle...

The D-Link DAP-1360 experiences a significant security flaw that allows unauthenticated remote code execution via its web management interface. An attacker can exploit this vulnerability by sending specially crafted requests, enabling them to execute arbitrary commands with root privileges. This ...

An unauthenticated attacker can exploit a vulnerability in WordPress that allows `get_page_template()` to inadvertently resolve and include a chosen local `.php` file located outside of the active theme directories. When specific server conditions and configurations of the active theme are met, t...

The Events Manager plugin for WordPress prior to version 7.4.5 is vulnerable to improper access control. This vulnerability allows low-privileged users to manipulate owner values in event and location searches. As a result, these users can access unpublished, pending, or trashed content from othe...

The Events Manager WordPress plugin, before version 7.4.5, is susceptible to a vulnerability that allows users managing tickets for a single event to execute unauthorized updates. This flaw permits the overwriting and reassignment of tickets to different events, which can lead to unauthorized acc...

The WPeMatico RSS Feed Fetcher WordPress plugin prior to version 2.8.26 has a security weakness where it fails to authenticate user ownership or authorization before disclosing sensitive campaign configuration and execution logs. This vulnerability allows users with contributor-level access and h...

The WPeMatico RSS Feed Fetcher plugin for WordPress prior to version 2.8.26 allows attackers to exploit a lack of proper sanitization and escaping in a campaign configuration field. This vulnerability permits users with Contributor roles and higher to execute Stored Cross-Site Scripting (XSS) att...

The MasterStudy LMS WordPress plugin, prior to version 3.7.50, contains a vulnerability that compromises the enrollment verification process. It permits any authenticated user, including those with subscriber-level accounts, to inaccurately record lesson completions for courses they are not enrol...

The MasterStudy LMS WordPress plugin prior to version 3.7.50 lacks necessary capability and nonce checks during an administrative maintenance action. This oversight allows any authenticated user, including those with the lowest privilege levels like subscribers, to create published content on the...

The WPeMatico RSS Feed Fetcher plugin for WordPress prior to version 2.8.26 fails to adequately sanitize and escape content retrieved from user-supplied sources. This oversight can enable contributors to exploit the vulnerability and execute Stored Cross-Site Scripting attacks, affecting higher-p...

The MasterStudy LMS WordPress Plugin prior to version 3.7.50 has a significant vulnerability where it fails to verify if user registration is enabled on the WordPress site. This oversight permits unauthenticated users to create accounts via the plugin's front-end registration processes, even when...

The MasterStudy LMS WordPress Plugin prior to version 3.7.50 is vulnerable due to improper validation of display-style settings. This flaw permits users with Contributor roles or above to include and execute arbitrary local PHP files on the server. Notably, a similar path issue was addressed in a...

The Masteriyo LMS plugin for WordPress prior to version 3.4.2 exhibits an improper access control vulnerability. This flaw permits authenticated users, including self-registered subscribers, to access and read other users' course-progress records. Specifically, the plugin fails to properly verify...

The Masteriyo LMS plugin for WordPress presents a significant access control weakness, allowing authenticated users, including students, to retrieve the correct answers to quizzes. This vulnerability occurs due to improper access restrictions, enabling users to access answer keys for quizzes acro...

The Post Grid WordPress plugin versions prior to 7.9.5 suffer from an HTML injection vulnerability due to inadequate restrictions on the allowed HTML elements. This flaw permits users with Contributor roles and higher to insert iframe, style, and input elements that are typically removed from con...

The 10Web Booster plugin for WordPress prior to version 2.34.0 contains an access control vulnerability that allows unauthenticated users to gain access to the routine responsible for issuing the shared secret for cloud connections. This flaw enables unauthorized users to not only view the shared...