Publicly Disclosed
PoC Exploits

A vulnerability has been identified in the Rizwan17 inventory management system that permits cross site scripting (XSS) attacks through the manipulation of the 'msg' argument in the index.php file associated with the Login Page component. This flaw allows attackers to execute code remotely, poten...

A SQL injection vulnerability has been identified in the Rizwan17 inventory-management-system, specifically within the storeCustomerOrderInvoice function located in the includes/manage.php file. An attacker can exploit this vulnerability by manipulating the 'pro_name[]' argument, thereby executin...

A security vulnerability exists in the Rizwan17 inventory-management-system, specifically in the invoice generation component. The issue pertains to the file includes/invoice_bill.php, where improper handling of the arguments order_date and invoice_no allows for missing authentication. This weakn...

A cross-site scripting (XSS) vulnerability has been detected in the Rizwan17 inventory-management-system, particularly in the file includes/DBOperation.php used by the List Handler component. By manipulating the parameters such as category_name, brand_name, or product_name, an attacker can execut...

A security flaw has been identified in the Rizwan17 inventory management system affecting the DBOperation.addCategory function within includes/process.php. The vulnerability arises due to insufficient authentication checks, specifically related to the manipulation of the 'userid' argument. This a...

A vulnerability exists in the Rizwan17 inventory management system due to improper input validation in the update_record function located within includes/manage.php. This flaw allows an attacker to manipulate the arguments update_category, cid, update_brand, and update_product, leading to SQL inj...

MikroTik RouterOS contains a vulnerability in its SSH authentication mechanism, which fails to fully compare RSA public keys. While it checks the key type and modulus, the exponent is overlooked. An attacker with knowledge of an authorized RSA modulus can exploit this flaw by supplying a crafted ...

Gogs, an open-source Git service, has a significant directory traversal vulnerability in its codebase. Specifically, the issue arises from the editFilePost function located in internal/route/repo/editor.go. This vulnerability allows an attacker to access arbitrary directories and files on the ser...

A vulnerability in cPanel's EmailTrack component enables mail-enabled accounts to execute remote code with root privileges through an SQL injection exploit. This security flaw allows unauthorized users to manipulate SQL queries, leading to potential system compromise and disruption of services. S...

The Fortishield.sys driver in Fortinet's FortiClient prior to version 5.2.4 contains vulnerabilities that allow local users to execute arbitrary code with kernel privileges. This is achieved by manipulating the callback function via specific ioctl calls, namely 0x220024 and 0x220028. Unauthorized...

A vulnerability in cPanel's EmailTrack component enables mail-enabled accounts to execute remote code with root privileges through an SQL injection exploit. This security flaw allows unauthorized users to manipulate SQL queries, leading to potential system compromise and disruption of services. S...

MaxSite CMS, in versions up to 109.6, is vulnerable to a PHP object injection flaw due to the improper handling of the ci_session cookie. This vulnerability allows unauthorized attackers to manipulate session cookies leveraging a hardcoded encryption key, enabling them to exploit magic methods an...

MaxSite CMS versions up to 109.6 contain a significant vulnerability where a hardcoded session encryption key is embedded in 'application/config/config.php'. This constant key is never altered during installation, rendering the system vulnerable to authentication bypass by unauthenticated attacke...

MaxSite CMS versions 0.94 through 109.6 are plagued by a cross-site scripting vulnerability located within the admin_page upload handler. This flaw permits any authenticated user to upload HTML files, which may contain malicious scripts. Once these files are placed in the uploads/_pages/ director...

MaxSite CMS versions up to 109.6 are susceptible to a local file inclusion vulnerability that can be exploited via the ajax and require-maxsite dispatchers. This security flaw enables unauthenticated attackers to perform path traversal by providing base64-encoded sequences, allowing them to bypas...

The vulnerability lies in the InCallController.java file, specifically within the serviceClassExists function. This flaw allows for arbitrary code execution due to a logic error, enabling local escalation of privileges without the need for additional execution rights. The issue can be exploited w...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...

Certain KGUARD DVR devices with outdated firmware exhibit a serious vulnerability, exposing a system command execution service on all network interfaces without authentication. This flaw enables remote attackers to execute arbitrary commands, potentially compromising the device entirely. Exploits...

The Windows Cloud Files Mini Filter Driver contains a vulnerability due to missing authentication for critical functions. This flaw allows an unauthorized attacker to perform local tampering, which can impact the integrity of files and data within the affected operating systems, such as Windows 1...

The KeePass password manager, specifically versions 2.35 through 2.61.1, contains a vulnerability that stems from inadequate validation of KDBX header field sizes during memory allocation. This flaw allows attackers to create specially crafted KDBX files that specify excessively large header fiel...

The WooCommerce WordPress plugin prior to version 2.0.2 is susceptible to a file upload vulnerability due to its failure to validate the types of files that can be uploaded when its accepted-types setting is left empty. This lack of validation opens the door for unauthenticated attackers to uploa...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The Contact Form 7 Captcha plugin for WordPress contains a vulnerability that allows unauthenticated users to exploit the shortcode parser functionality. Specifically, earlier versions of the plugin, prior to 0.1.9, process the entire Contact Form 7 form’s output, which includes user-submitted da...

The WP Express Checkout plugin for WordPress prior to version 2.5.0 is susceptible to a significant security flaw that fails to properly validate the completion of payment transactions on the server-side. This oversight allows unauthorized users to simulate the payment process, marking orders as ...

The Hustle plugin for WordPress prior to version 7.8.14.2 contains a security flaw that permits unauthenticated users to execute shortcodes through form submissions. The plugin fails to sufficiently sanitize shortcodes in user-provided input, allowing potential attackers to exploit this weakness ...

The CleanTalk WordPress plugin prior to version 6.87 is susceptible to an arbitrary shortcode execution vulnerability. This flaw allows unauthenticated users to submit comment content that is processed by the WordPress shortcode engine. As a result, malicious visitors can register and execute arb...

The Orbit Fox plugin for WordPress, prior to version 3.0.9, is susceptible to a Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate validation of user-supplied HTML tag names within specific Beaver Builder widgets. As a result, users possessing contributor-level access or h...

The WPLP Cookie Consent plugin for WordPress prior to version 4.4.2 suffers from an access control weakness due to the absence of nonce and capability checks on various AJAX actions. This flaw permits any authenticated user, including those with minimal privileges such as subscribers, to gain una...

The Kirki WordPress plugin, prior to version 6.3.0, contains a vulnerability that allows unauthenticated users to access private content. This issue arises because the plugin fails to verify whether a requester is authorized to view certain pages, including those marked as private, draft, or tras...

The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.2, is susceptible to an improper authentication vulnerability. This flaw stems from the inadequate implementation of nonce and capability checks in a specific AJAX action related to its cookie scanner functionality. As a result, a...

The Sunshine Photo Cart plugin for WordPress prior to version 3.7 is susceptible to a vulnerability that arises due to insufficient validation of client-supplied price identifiers. This flaw allows unauthenticated users to manipulate price information during the cart process, enabling them to pur...

The Quentn WP plugin for WordPress prior to version 1.2.15 is vulnerable due to improper sanitization and escaping of user input in SQL queries. This flaw can allow high privilege users, such as administrators, to execute malicious SQL commands, potentially compromising the integrity of the datab...

The Masteriyo LMS WordPress plugin prior to version 3.4.0 is susceptible to improper access control, as it fails to verify user authorization before disclosing course enrollment records through its REST API. This vulnerability enables unauthorized users to access sensitive information, including ...

The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.2, is vulnerable due to the lack of capability and nonce checks in its A/B testing actions. This oversight allows authenticated users, including those with minimal privileges like subscribers, to alter the cookie banner settings t...

The Sina Extension for Elementor, a popular WordPress plugin, is vulnerable to Stored Cross-Site Scripting due to inadequate escaping of HTML attributes in the Table widget settings. This flaw could be exploited by users with Contributor roles or higher to inject malicious scripts, potentially co...

The Quentn WP WordPress plugin, prior to version 1.2.15, has a critical vulnerability that arises from improper escaping of request parameters in SQL queries. This flaw enables unauthenticated attackers to exploit the plugin, allowing them to perform SQL injection attacks. As a consequence, they ...

The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.2, is susceptible to an authorization flaw, lacking necessary CSRF checks when handling visitor consent states. This vulnerability allows unauthenticated attackers to manipulate site-wide options, posing a significant risk by over...

The Groundhogg WordPress plugin, before version 4.7.2, is susceptible to an improper redirect vulnerability. This flaw allows attackers to manipulate the email preference confirmation flow, leading to the potential redirection of unsuspecting users to arbitrary external URLs. By crafting maliciou...

The SupportCandy plugin for WordPress prior to version 3.5.3 lacks sufficient authorization checks for its ticket attachment download functionality. This oversight permits unauthorized attackers to access and download sensitive customer-uploaded attachments by simply enumerating the sequential id...

The SupportCandy WordPress plugin prior to version 3.5.3 contains a vulnerability that fails to validate submitted authorization codes for individual support tickets. As a result, unauthenticated users can read the confidential content of any support ticket without proper authorization. This flaw...

The Ultimate Gift Cards for WooCommerce WordPress plugin lacks a robust mechanism to ensure that gift card redemptions are performed by the rightful recipients. This vulnerability permits any authenticated user, including subscribers, to redeem gift cards that belong to other users. As a result, ...

A security flaw in the Payment Plugins for Stripe WooCommerce WordPress plugin prior to version 4.0.12 allows unauthenticated users to access sensitive billing information. This vulnerability arises from insufficient validation of the order key, which enables attackers to iterate through order id...

The WP Travel plugin for WordPress versions prior to 12.0.2 is susceptible to an authorization bypass vulnerability. This issue allows unauthenticated attackers to cancel payment transactions linked to customer bookings through specific front-end payment-message handlers. As a result, any unautho...

The Payment Plugins for PayPal WooCommerce plugin, prior to version 2.0.26, lacks proper validation of the order key when adding order data to the JavaScript configuration output on the front end. This oversight allows unauthenticated users to access sensitive information by sequentially iteratin...

The Payment Plugins for PayPal WooCommerce WordPress plugin prior to version 2.0.26 suffers from an improper authorization vulnerability. This flaw allows any authenticated user, including subscribers, to link another user's stored payment method to their own account without adequate verification...

The Loops & Logic plugin for WordPress, prior to version 4.3.0, contains a vulnerability that fails to restrict access to its public template-data action. This design flaw enables unauthenticated users to gain access to sensitive user data, including email addresses and roles, as well as arbitrar...

The ELEX WooCommerce Request a Quote plugin before version 2.4.1 contains a vulnerability that arises from improper sanitization and escaping of parameters in an SQL query. This flaw allows unauthenticated attackers to execute SQL injection attacks, potentially gaining unauthorized access to sens...

The WP Travel plugin for WordPress, prior to version 12.0.2, contains a vulnerability that fails to securely verify the owner of a booking when a bank-deposit slip submission is made. This flaw enables unauthenticated attackers who are aware of a target customer's email address to manipulate the ...

The WP Travel plugin for WordPress contains a security flaw that permits an unauthorized individual to reset a customer's booking payment status to unpaid. By exploiting the vulnerability, attackers, equipped with only the target customer's email address, can bypass proper authorization checks in...

The Content Mask plugin for WordPress prior to version 1.8.5.6 is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate sanitization and escaping of content submitted through posts. This vulnerability enables users with minimal privileges, such as Contributors, to inject malicious sc...