Publicly Disclosed
PoC Exploits

The Abandoned Cart Pro for WooCommerce plugin is susceptible to an authentication bypass due to insecure encryption practices implemented in all versions up to 10.8.0. This vulnerability arises from the use of MAC-free AES-CTR encryption for cart-recovery link tokens. The mechanism fails to enfor...

A type confusion vulnerability has been identified in the V8 JavaScript engine of Google Chrome. Prior to version 152.0.7977.82, this flaw allows malicious attackers to execute arbitrary code within the browser's sandbox environment by crafting a specially designed HTML page. This vulnerability p...

A type confusion vulnerability exists in the V8 engine of Google Chrome, affecting versions prior to 142.0.7444.175. This flaw enables attackers to potentially exploit heap corruption by crafting malicious HTML content. If successfully exploited, it may lead to unexpected behavior within the brow...

This vulnerability arises from a type confusion issue within the V8 JavaScript engine used in Google Chrome, potentially granting remote attackers the ability to execute arbitrary code. Exploitation can occur when a user is tricked into visiting a specially crafted HTML page, which executes malic...

A remote code execution vulnerability, CVE-2024-2887, was discovered in Google Chrome prior to version 123.0.6312.86, which allowed a remote attacker to execute arbitrary code via a crafted HTML page. The update to Chrome version 123.0.6312.86/.87 addresses this vulnerability, along with several ...

A type confusion vulnerability has been identified in Apple's operating systems that could allow attackers to execute arbitrary code by processing specially crafted web content. Improved checks have been implemented in the latest versions of iOS, iPadOS, macOS, and tvOS to address this issue. App...

A significant vulnerability exists in various Apple products that utilize the WebKit component. This flaw permits remote attackers to execute arbitrary code or initiate a denial of service through a specially crafted website. The vulnerability impacts multiple platforms including iOS, Safari, iCl...

The SimpleForm plugin for WordPress is vulnerable due to improper checks in the AJAX handler which allows unauthenticated attackers to create an Administrator-level account. This vulnerability arises from the absence of capability checks during role assignment and flaws in the handling of user me...

Nexent versions up to 2.7.0 exhibit a vulnerability in the check_file_access function, allowing authenticated users to bypass tenant restrictions. This issue enables users to access other tenants' knowledge-base files, potentially exposing sensitive information. In a multi-tenant deployment, atta...

Blinko versions up to 1.8.8 are exposed to a broken access control vulnerability in the /api/file route. This flaw enables authenticated users to unjustly access private attachments belonging to other users. Through a flawed owner check, attackers can exploit this vulnerability by supplying the f...

GrowChief version 0.3.0 contains a vulnerability in the getAllUsers handler, where missing authorization checks enable authenticated users to list all users across different organizations. This oversight allows attackers, even with low privileges such as self-registered accounts, to exploit the G...

The Sure product versions from 0.7.0 to 0.7.6-alpha.6 expose a vulnerability whereby authenticated users with limited permissions can exploit the BulkUpdatesController#create method. This allows them to manipulate transaction information for other users, including changing dates, notes, and categ...

The Shopizer e-commerce platform, up to version 3.2.5, is susceptible to an authorization bypass vulnerability that enables authenticated customers to post reviews under the identities of other customers. By manipulating the customerId field in requests sent to the review submission API, maliciou...

Databasus versions 3.7.0 through 3.61.0 have a flaw that allows attackers to bypass authentication during the password reset process. By exploiting this vulnerability, an attacker can request a six-digit password reset code linked to a known email address and attempt to brute-force the code witho...

holaOS, through version 2026.822.1, contains a missing authorization flaw in its channel-gateway connectors. This vulnerability allows any user of the messaging platform to submit agent tasks because the system's #isAllowed check indiscriminately accepts all senders when the default allowFrom lis...

Gitingest versions up to 0.3.1 are susceptible to a symlink following vulnerability that permits unauthenticated attackers to access sensitive server files. By exploiting this flaw, attackers can submit symlink blob URLs, effectively redirecting the server to return files that the service user ca...

Colanode Server versions up to 0.4.7 are vulnerable to a path traversal issue, allowing authenticated users to gain unauthorized access to .jpeg files. This can be exploited by using encoded traversal sequences in the avatarId parameter. By sending specially crafted GET requests that navigate bey...

FlexPrice versions up to 2.1.38 have a significant security flaw in their payment processing system specifically related to the QuickBooks Webhook integration. This vulnerability arises when the intuit-signature header is omitted, allowing unauthenticated attackers to bypass signature verificatio...

AstronRPA versions up to 1.1.6 are susceptible to an insecure direct object reference vulnerability, specifically found in the /file/download endpoint. This flaw allows authenticated users to gain unauthorized access to files belonging to other tenants by merely specifying the fileId. Attackers c...

The Lamp-Boot OAuth module is vulnerable to an insecure direct object reference, specifically within the /anyone/findDeptByCompany endpoint. This flaw allows authenticated, low-privilege users to bypass URI permission checks, enabling them to enumerate employeeId values sequentially. As a result,...

A vulnerability has been identified in the D-Link DIR-868L router firmware version 2.01b05, which affects the functionality of the HNAP CGI Handler within the file /htdocs/cgibin. This security issue allows attackers to execute arbitrary operating system commands by manipulating the SOAPACTION ar...

A significant vulnerability has been identified in Apple’s macOS Sonoma and older versions of iOS, where improperly handled web content could allow for arbitrary code execution. Users of macOS Sonoma 14 and earlier versions of iOS should be aware that this issue may have been actively exploited. ...

A zero-day vulnerability, CVE-2023-2033, has been discovered in Google Chrome, which allows remote attackers to potentially exploit heap corruption through a type confusion issue in the V8 JavaScript engine. The vulnerability is being actively exploited, and Google has released an emergency out-o...

A type confusion issue in the V8 engine's Turbofan compiler within Google Chrome versions prior to 100.0.4896.127 can be exploited by a remote attacker. By leveraging a specially crafted HTML page, attackers can trigger heap corruption, potentially leading to unauthorized access and other adverse...

A vulnerability in the V8 engine of Google Chrome allows remote attackers to potentially exploit heap corruption through specially crafted HTML pages. This issue emerges from an inappropriate implementation within the V8 framework, which can lead to unexpected behavior when processing malicious c...

A type confusion vulnerability in V8 component of Google Chrome prior to version 90.0.4430.212 allows remote attackers to potentially exploit heap corruption. This is achieved through specially crafted HTML pages, which can manipulate the memory allocation, leading to unexpected behaviors and pos...

A remote code execution vulnerability arises from inadequate handling of objects in memory by the Chakra scripting engine within Microsoft Edge. This flaw could allow an attacker to execute arbitrary code on the targeted system, potentially compromising user data and system integrity. It's essent...

A buffer overflow vulnerability exists in the PCMan FTP Server prior to version 2.0.7. This weakness is associated with an unknown function within the PORT command handler, which may allow remote attackers to execute arbitrary code or crash the service. The exploit is publicly available, highligh...

The Portkey AI Gateway versions 1.14.0 through 1.15.2 are susceptible to a server-side request forgery (SSRF) vulnerability. This issue arises from improper validation of localhost-style hosts when the TRUSTED_CUSTOM_HOSTS setting is absent. Unauthenticated attackers can exploit this vulnerabilit...

The TurboDocx html-to-docx tool, up to version 1.23.1, contains a server-side request forgery vulnerability that can be exploited by attackers. By supplying crafted HTML with specific img src attributes, malicious users can trick the server into fetching internal URLs. This includes potential acc...

The Janus WebRTC Server, through version 1.4.3, is susceptible to a path traversal vulnerability identified in the Record&Play plugin. This flaw permits unauthenticated attackers to manipulate file paths and write files outside the intended recordings_path directory via specially crafted filename...

Unshield, a tool developed by TwoGood, is susceptible to a heap out-of-bounds read vulnerability present in versions up to 1.6.2. This flaw is triggered by the unshield_get_file_table() function when it processes unchecked cabinet header offsets, potentially allowing attackers to read beyond allo...

The libsmb2 library, specifically versions up to and including 6.2, contains an integer underflow vulnerability in its decode_acl function. This flaw allows malicious SMB servers to craft specific security descriptors that trigger heap out-of-bounds reads. By sending an AclSize value below 8 in a...

The MuJS JavaScript engine, specifically version 1.3.6 and earlier, contains a vulnerability that allows attackers to exploit a heap out-of-bounds read and write via Array.prototype.sort. By manipulating the length of a dense array in JavaScript, a malicious actor can cause the sorting algorithm ...

vgmstream version r2117 is susceptible to a stack out-of-bounds read vulnerability in its G.722.1/Siren14 decoder. This vulnerability arises from the bit reader's failure to verify the bounds of the data_u32 array while refilling during the decoding process. Attackers can leverage this flaw by su...

CGNS versions up to 4.5.2 are susceptible to a stack out-of-bounds read vulnerability within the ADFI_read_node_header function. This flaw allows attackers to produce specially crafted .cgns or .adf files with non-NUL-terminated end tags, which can result in the ADFI_stridx_c function reading bey...

The ELFIO library, up to version 3.12, contains a vulnerability that allows attackers to exploit a NULL pointer dereference through the relocation_section_accessor's get_entry() function. By sending a specially crafted ELF file with an unvalidated sh_link index, an attacker can cause affected app...

Sofia-SIP versions prior to 1.13.18 are susceptible to a heap out-of-bounds read vulnerability found in the msg_multipart_parse() function. This flaw enables unauthenticated remote attackers to crash the Sofia-SIP process by supplying oversized MIME boundaries in an INVITE request. The vulnerable...

The miniupnpc library, up to version 2.3.3, is susceptible to a heap out-of-bounds read issue in the minixml parseelt function. This vulnerability occurs due to insufficient buffer checks when processing namespace prefixes, allowing a malicious or spoofed Universal Plug and Play (UPnP) gateway on...

Khronos NNEF-Tools, including versions up to 1.0.10 and nnef-tools up to 1.0.11, are susceptible to a path traversal vulnerability. This issue arises when an attacker provides crafted variable labels, allowing the execution of '../' sequences or absolute paths within a graph.nnef file. By exploit...

libzvbi versions up to 0.2.45 are susceptible to an out-of-bounds write vulnerability within the Teletext decoder. By supplying unvalidated DRCS pixel-mode values in X/28/3 packets, attackers can manipulate memory allocation. When a crafted Teletext stream is decoded via vbi_decode, setting each ...

An expression language injection vulnerability exists in Apache Struts that enables attackers to craft specific requests to inject OGNL expressions, potentially leading to remote code execution. This primarily affects applications using the legacy RESTful action mapper when the OGNL allowlist is ...

The MyReport Updater up to version 2.1.1 is susceptible to a local privilege escalation vulnerability that potentially allows low-privileged users to exploit the SYSTEM updater service. This vulnerability can be exploited via the UpdaterManager.exe tool over gRPC, enabling an attacker to specify ...

The Responsive Blocks plugin for WordPress, prior to version 2.3.0, is vulnerable to an HTML injection issue. This flaw arises because the plugin fails to properly sanitize or escape user-submitted values in its Form block, which are then included in HTML notification emails sent to site administ...

The Tickera WordPress plugin prior to version 3.6.0.4 is susceptible to a serious vulnerability that fails to adequately verify the integrity of incoming payment notifications. This weakness allows unauthenticated attackers to bypass verification processes, as the validated signature does not enc...

The WPForms Lite plugin for WordPress, prior to version 2.0.2.2, contains a significant vulnerability that allows unauthenticated users to submit forms using the PayPal Commerce gateway without completing the payment process. This flaw results in the possibility of users receiving confirmation me...

The Visma Pay for WooCommerce plugin prior to version 1.2.2 is susceptible to an improper authentication vulnerability. This flaw allows attackers to bypass verification of payment gateway return requests due to the lack of a merchant secret when credentials are not set. As a result, malicious ac...

The WPCode plugin for WordPress, prior to version 2.4.0, is susceptible to a vulnerability due to its failure to properly verify requests for the login screen. This oversight allows unauthenticated users to activate snippet safe mode, enabling them to disable all of the automatically inserted sni...

isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to...

The Paymentfor Gateway for WooCommerce plugin, prior to version 1.0.6, has a critical issue where it fails to properly verify the authenticity of inbound payment notifications. This vulnerability allows malicious users to mark orders as paid without completing any actual payment, potentially lead...