Publicly Disclosed
PoC Exploits

A vulnerability identified in the SparkJava framework up to version 2.9.4 relates to the `staticFiles.externalLocation` function. This issue allows an attacker to exploit the symlink following behavior within the `ExternalResourceHandler` component. The flaw can be exploited remotely, posing a si...

A vulnerability exists in the mf-yang Openclaw-CN application, specifically within the Browser Control HTTP API. The flaw, located in the clickViaPlaywright function of the agent.act.ts file, allows attackers to carry out server-side request forgery (SSRF) attacks. This means that by manipulating...

A security vulnerability exists in the mf-yang openclaw-cn software, specifically in the function assertBrowserNavigationAllowed within the Scheme Handler component. This flaw can potentially lead to information disclosure when the argument 'url' is manipulated. The issue can be exploited remotel...

A flaw in the function handleAddMcpServer of NanoClaw, specifically in the file src/modules/self-mod/request.ts, allows for improper authorization. This vulnerability enables attackers to potentially manipulate access controls, leading to unauthorized actions. The vulnerability is remotely exploi...

A vulnerability exists in the NanoClaw product by Nanocoai, specifically impacting the `createChatSdkBridge.setup` function within the `src/channels/chat-sdk-bridge.ts` file of the MCP Server Approval component. This flaw allows for unauthorized actions due to improper access control measures, ma...

A command injection vulnerability exists in Microsoft Bing Images that allows unauthorized attackers to execute arbitrary code over a network. This weakness arises from improper handling of special elements in commands, potentially exposing sensitive data or system integrity to exploitation. User...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...

A security issue has been identified in NousResearch's hermes-agent, specifically within the SimpleX Gateway Authorization component. The vulnerability arises from the improper handling of the contactId argument in the file hermes-agent/plugins/platforms/simplex/adapter.py. This flaw may allow un...

A vulnerability in Oracle WebLogic Server's Core component permits low-privileged attackers with network access to exploit SAML, potentially compromising the server's functionality. This can lead to unauthorized access, impacting not only the WebLogic Server but also additional interconnected pro...

A remote code execution vulnerability exists in fastjson versions 1.2.68 to 1.2.83, allowing attackers to execute arbitrary code remotely without the need for AutoType enablement or classpath gadgets. This vulnerability can be exploited in the default configuration, which poses a significant risk...

Microweber CMS, up to version 2.0.20, has a significant path traversal flaw in its static file controller. This vulnerability allows remote, unauthenticated attackers to exploit the failure of the normalize_path() function. By supplying specially crafted directory traversal sequences in the path ...

The Oj Ruby gem, a JSON parser and object marshaller, is susceptible to a heap corruption issue when using create_id enabled with JSON object keys of exactly 65,535 bytes. This flaw arises from an integer truncation during the parsing process, leading to a negative-size argument being passed to t...

The vulnerability allows an attacker to send specially crafted payloads to Microsoft Office SharePoint, potentially resulting in unauthorized remote code execution. This security flaw occurs due to the improper handling of untrusted data. If exploited, it could enable malicious actors to execute ...

The SonicWall Single Sign-On (SSO) Agent is found to have a vulnerability due to its default configuration, which utilizes NetAPI to probe associated IP addresses within a network. This probing method can be exploited by an attacker to capture the password hash of users with privileged access. Co...

The TripSpark VEO Transportation and NovusEDU products are vulnerable due to improper handling of user inputs in POST body parameters. This allows malicious users to inject arbitrary SQL commands into the 'Student Busing Information' search queries. The lack of sanitization on server-side logic m...

An SQL Injection vulnerability exists in the SearchTextBox parameter of Fortra's DeliverNow software versions prior to 1.2.18. This flaw allows attackers to manipulate SQL queries, potentially enabling them to execute arbitrary code, escalate user privileges, and access sensitive information stor...

The ASUS Router App contains a vulnerability that allows a malicious third-party application on the same device to initiate a crafted Intent. This can lead to the ASUS Router App opening a specified URL without proper validation, potentially compromising user privacy and security. For more detail...

An unauthenticated Insecure Direct Object Reference (IDOR) vulnerability exists in the Easy Appointments plugin, affecting versions up to 3.12.27. This vulnerability allows attackers to access and manipulate sensitive data without proper authentication, potentially leading to unauthorized access ...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows unauthenticated attackers to chain two API endpoints. This exploitation can occur via the /api/v1/auto_login endpoint, which generates SUPERUSER tokens for any caller, in conjunction with the /api/v1/validate/code endpoint...

A vulnerability exists within Node.js HTTP servers that permits attackers to send specially crafted HTTP requests utilizing chunked encoding. This manipulation can lead to resource exhaustion, as the server is induced to read an unbounded number of bytes from a single connection. The flaw takes a...

The Natural Language Toolkit (NLTK) version 3.9.3 and earlier are susceptible to an eval injection vulnerability within the nltk.collocations module. This security flaw arises when command-line arguments are directly passed to the eval() function in the __main__ block of collocations.py, lacking ...

A vulnerability exists in the Pizzafy Ecommerce System 1.0, specifically within the get_cart_count function located in the /admin/ajax.php file. This flaw allows attackers to manipulate the ID argument, enabling them to execute SQL injection attacks remotely. Exploiting this vulnerability could l...

The sysPass application, specifically version 3.2.11, is susceptible to an OS command injection flaw. This vulnerability allows authenticated administrators to exploit the backup functionality by maliciously altering the backup path. When the FileBackupService concatenates this input to construct...

The vulnerability in sysPass version 3.2.11 arises from insufficient authorization checks during public link creation, enabling users with the PUBLICLINK_CREATE profile flag to exploit this flaw. An attacker can trigger unauthorized decryption of vault account passwords by invoking the saveCreate...

The sysPass version 3.2.11 vulnerability arises from a missing object-level authorization in its JSON-RPC API. This flaw permits API token holders to improperly enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without necessary per-account access contro...

The sysPass application version 3.2.11 has a vulnerability that enables authenticated users to exploit insecure direct object references. By manipulating file IDs through various actions such as download, view, delete, upload, and list, attackers can gain unauthorized access to account file attac...

Likeshop versions up to 3.0.5 are susceptible to an authenticated SQL injection vulnerability that allows admin users to extract arbitrary data from the database. The flaw occurs in the adjustAccount endpoint, where unsanitized POST parameters are processed without proper validation or parameter ...

Microweber CMS up to version 2.0.20 contains a vulnerability allowing authenticated administrators to execute arbitrary operating system commands. This occurs through the injection of Twig expressions into unsanitized mail templates. Due to the absence of necessary security mechanisms like Sandbo...

The Suna messaging API in versions prior to 0.9.102 is susceptible to a broken access control vulnerability, enabling authenticated attackers to exploit inadequate isolation measures. Attackers can gain unauthorized access to message queues belonging to other users, which allows them to read pend...

The vulnerability in Hugging Face Datasets allows attackers to exploit the file_name metadata field in folder-based dataset builders. Due to inadequate validation, an attacker can input crafted values that include directory traversal sequences. As a result, this could lead to unauthorized access ...

The lakeFS product by Treeverse contains an authentication bypass vulnerability located at the /setup_comm_prefs endpoint. This flaw allows unauthenticated attackers to overwrite critical operator metadata, including sensitive information like email, name, and company details, after the setup pha...

The Jan API Server possesses a CORS misconfiguration that allows network-adjacent attackers to bypass trusted host restrictions via a flaw in the server’s handling of user-configured trusted hosts. This issue enables attackers to manipulate the server, replacing user-defined trusted hosts with a ...

BlenderMCP prior to commit 30a3308 features a path traversal vulnerability within the download_polyhaven_asset method. This flaw enables attackers to write arbitrary files by injecting harmful traversal sequences into API response keys. If an attacker successfully executes a MITM (Man-In-The-Midd...

A vulnerability in Oracle WebLogic Server's Core component permits low-privileged attackers with network access to exploit SAML, potentially compromising the server's functionality. This can lead to unauthorized access, impacting not only the WebLogic Server but also additional interconnected pro...

The WowOptin: Next-Gen Popup Maker plugin for WordPress, prior to version 1.4.38, is vulnerable due to insufficient authorization checks on a REST endpoint. This flaw allows unauthenticated users to disable all opt-in forms across the site and to inject new template-based opt-in entries into the ...

The Project Management, Bug and Issue Tracking Plugin for WordPress, prior to version 5.1.0, is susceptible to SQL injection due to inadequate sanitization and escaping of user-supplied input in SQL queries. This vulnerability allows unauthenticated attackers to manipulate database queries, poten...

The CAFEHAUS API WordPress plugin prior to version 1.0.0 is vulnerable to an authentication bypass issue that permits attackers to reset user passwords without any form of authentication or authorization. This flaw enables attackers to gain unauthorized access to any user's account, including tho...

The ProfileGrid plugin for WordPress contains a vulnerability related to its license management functionality. This flaw arises from the absence of a proper capability check, as it solely relies on a nonce that is accessible to any logged-in user. Consequently, this allows authenticated users wit...

The Paid Membership Plugin for WordPress prior to version 4.16.18 fails to consistently enforce role restrictions in its front-end registration process. This vulnerability arises because the role options presented to users and the roles accepted by the registration handler are evaluated by differ...

The ProfileGrid WordPress plugin prior to version 5.9.9.7 is susceptible to an improper input validation vulnerability. This flaw allows unauthenticated attackers to exploit the plugin's handling of PayPal Instant Payment Notification (IPN) messages. By forging a valid PayPal notification, an att...

The ProfileGrid WordPress plugin prior to version 5.9.9.7 contains a significant authorization flaw that enables authenticated users with Subscriber-level access and higher to interact maliciously with others' private-message threads. This includes the ability to soft-delete threads, alter metada...

A security feature bypass vulnerability exists in Microsoft Windows, referred to as 'YellowKey.' This flaw could allow unauthorized access to restricted features, compromising system integrity. A proof of concept has been publicly released, contrary to established security practices. Users are ad...

A serious backdoor vulnerability was discovered in vsftpd 2.3.4, affecting downloads made between June 30 and July 3, 2011. This vulnerability allows an attacker to exploit the software and open a remote shell on port 6200/tcp, granting unauthorized access to the system. It poses significant risk...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...

Immutable.js exhibits a vulnerability in its data structures, specifically in Immutable.Map and Immutable.Set. Prior to versions 4.3.9 and 5.1.8, these structures use a linear search method in a HashCollisionNode bucket containing keys with the same 32-bit hash. An attacker controlling the input ...

Flowise versions prior to 3.1.3 suffer from a vulnerability due to improper validation of Custom MCP standard input/output environment variables against a denylist. The case-sensitive nature of the comparison allows an authenticated user to exploit this flaw on Windows systems where environment v...

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a...

A vulnerability has been identified in Ne-Lexa's php-zip library versions up to 4.0.2. It occurs within the ZipFile::extractTo function located in src/ZipFile.php, where inadequate validation of the entryName argument allows for malicious path traversal attacks. This vulnerability can be exploite...