Publicly Disclosed
PoC Exploits

This vulnerability allows unauthorized command execution in the GPU micronode, leading to potential memory corruption when a specific sequence of commands is executed. Attackers could exploit this weakness to disrupt system functionality or gain access to sensitive areas of memory, posing risks t...

The Clean Login WordPress plugin prior to version 1.19 suffers from an authentication bypass vulnerability due to inadequate verification of the registration CAPTCHA. When the session value is empty, unauthorized users can exploit this flaw to bypass the anti-automation controls on the registrati...

The Clean Login WordPress plugin version prior to 1.19 contains a vulnerability that fails to verify if user registration is enabled before allowing account creation. This flaw permits unauthenticated individuals to create accounts on websites where account registration functionalities should be ...

The Hide My WP Ghost plugin for WordPress prior to version 7.0.11 is susceptible to a loopback security flaw, which fails to adequately verify security-check requests when disabling login and URL protection features. This shortcoming allows unauthorized users to manipulate the verification values...

The All Bootstrap Blocks plugin for WordPress before version 1.3.32 contains a local file inclusion vulnerability due to improper validation of block attributes used to construct filesystem paths at render time. This flaw enables users with contributor-level access and above to manipulate file pa...

The Hide My WP Ghost plugin for WordPress prior to version 7.0.11 contains a vulnerability that permits unauthenticated attackers to disable critical security features. By exploiting a flaw where the plugin does not confirm the validity of WooCommerce requests, attackers can manipulate request pa...

The Breeze Cache WordPress plugin prior to version 2.5.15 is susceptible to a vulnerability that allows unauthenticated attackers to exploit cached pages. The plugin fails to account for a specific set of tracking-related query parameters in its page-cache key. As a result, when a page is cached ...

The Generate PDF using Contact Form 7 WordPress plugin, prior to version 4.2.2, contains a significant design flaw that fails to restrict the destination of image fetches initiated by its PDF renderer. This vulnerability allows unauthenticated users to exploit the system by making requests to int...

The Filter Gallery WordPress plugin prior to version 1.1.5 is susceptible to a security issue due to the absence of nonce verification in its AJAX handlers. This oversight permits low-privileged users to manipulate post content and erase settings related to the stored gallery options, thus compro...

The Bookit — Booking & Appointment Calendar plugin for WordPress prior to version 2.6.0.5 has a critical flaw that bypasses necessary authorization checks on appointment retrieval actions. This defect allows users with lower privileges to access sensitive information belonging to other users, inc...

The All Bootstrap Blocks WordPress plugin prior to version 1.3.31 contains a vulnerability where it fails to adequately escape a block attribute before rendering it in an HTML tag-name context. This security oversight permits users with Contributor-level access and higher to inject malicious web ...

The Bookit — Booking & Appointment Calendar WordPress plugin, prior to version 2.6.0.5, contains a critical flaw that permits users assigned the low-privileged custom Staff role to delete any appointment without proper capability checks. This deficiency can lead to unauthorized removal of importa...

The MasterStudy LMS WordPress Plugin prior to version 3.7.50 is susceptible to a vulnerability that fails to properly verify if a requesting user owns a particular course. This allows users with the Instructor role to gain unauthorized access to sensitive information, specifically revealing the n...

The Really Simple Security plugin for WordPress, prior to version 9.8.3, contains a vulnerability that allows unauthenticated attackers to exploit unvalidated input. By providing a client-supplied address value as a storage key, an attacker can manipulate the plugin's functionality, leading to ex...

The Easy Appointments WordPress plugin prior to version 4.0.2.2 is vulnerable due to the lack of an unguessable token for authorizing mail-link actions related to appointment cancellation and confirmation. The token is derived from a hardcoded salt and the appointment's creation timestamp, which ...

The iGMS Direct Booking plugin for WordPress prior to version 2.0 has a critical authorization issue that permits unauthenticated users to manipulate the widget settings. This flaw allows these users to inject arbitrary web scripts, which may execute within the context of an administrator's view,...

The Easy Appointments plugin for WordPress prior to version 4.0.2.2 is susceptible to an authorization bypass vulnerability. This issue arises from the lack of proper ownership checks on its unauthenticated appointment-reservation endpoint. Attackers can exploit this vulnerability to modify exist...

The Tz Weekly Radio Schedule plugin for WordPress, up to version 1.8.1, is susceptible to SQL injection attacks. This vulnerability arises from insufficient sanitization and escaping of parameters in AJAX actions, which are accessible to unauthenticated users. As a result, attackers can exploit t...

The Tz Weekly Radio Schedule Plugin for WordPress, versions up to and including 1.8.1, is vulnerable to SQL injection due to improper sanitization and escaping of input parameters. This vulnerability allows unauthenticated attackers to manipulate SQL queries through an AJAX action, potentially le...

The Price Drop Alert for Woo Commerce plugin for WordPress, up to version 1.1, is vulnerable to SQL injection due to improper sanitization and escaping of parameters used in an AJAX action. This vulnerability allows unauthenticated attackers to exploit the plugin and execute arbitrary SQL queries...

The Question and Answer WordPress plugin, up to version 1.1.0, fails to properly sanitize and escape input parameters before incorporating them into SQL queries executed via AJAX actions. This flaw allows unauthenticated attackers to exploit the vulnerability by executing SQL injection attacks, p...

The wp Shortcut Link and Advertisement Banner Plugin, up to version 1.2.0, is susceptible to SQL injection due to inadequate sanitization and escaping of parameters in an AJAX action accessible to unauthenticated users. This flaw can enable attackers to manipulate SQL queries, leading to unauthor...

The Easy Form Builder plugin by WhiteStudio for WordPress suffers from a vulnerability due to insufficient validation of submitted values. Specifically, prior to version 4.2.0, it allows unauthenticated users to store arbitrary content. This content is rendered unescaped in an admin page, which c...

The Easy Form Builder plugin by WhiteStudio prior to version 4.2.0 is susceptible to an authentication bypass. Due to insufficient validation of input values against stored configurations for specific form types, unauthenticated users can create WordPress accounts even on sites where registration...

The VikBooking Hotel Booking Engine & PMS plugin for WordPress preceding version 1.8.15 has a vulnerability that allows unauthenticated users to upload files through the live chat feature. This plugin fails to properly restrict the types of files that can be uploaded or to sanitize their contents...

The UpsellWP plugin for WordPress suffers from a vulnerability that permits unauthenticated users to add products to their cart using the Frequently Bought Together campaign feature. This flaw does not verify if the products selected belong to the valid campaign, enabling users to exploit the dis...

The King Addons for Elementor plugin prior to version 51.1.81 lacks adequate object-level authorization checks during the process of importing template content. This oversight enables users with contributor-level permissions and higher to modify Elementor page content indiscriminately, including ...

The All-in-One WP Migration and Backup plugin for WordPress exhibits a significant security flaw, wherein it fails to enforce proper capability checks across several AJAX actions. This shortcoming is due to the reliance on an installation-wide secret, which is accessible to any user authorized to...

The AF Companion WordPress plugin is susceptible to a file upload vulnerability that allows users with low-privileged store-management roles to upload arbitrary files. This flaw stems from inadequate validation of file types in one of its import features, potentially enabling the execution of mal...

The King Addons for Elementor plugin for WordPress, prior to version 51.1.81, fails to implement appropriate per-object authorization checks for various image optimization actions. This oversight permits authenticated users with author-level access or higher to bypass security measures, potential...

The King Addons for Elementor plugin for WordPress prior to version 51.1.81 features a critical flaw that neglects to enforce checks for capability, post-status, and password before displaying the contents of user-generated posts. As a result, users with Contributor-level access or higher can unl...

The RestroPress plugin for WordPress through version 3.4.6 includes a significant flaw in its payment recovery process. This vulnerability allows unauthorized attackers to exploit the payment-recovery flow by submitting a request with a specific order identifier without verifying ownership. As a ...

The MasterStudy LMS WordPress Plugin prior to version 3.7.50 exhibits inadequate access control measures when interacting with its REST API. Specifically, users with the Instructor role can bypass necessary ownership and capability checks, enabling them to alter any order on the system. This flaw...

Spinnaker, a multi-cloud continuous delivery platform, is vulnerable to arbitrary command execution in specific versions. An attacker can exploit this vulnerability by executing arbitrary commands on clouddriver pods. This could lead to credential exposure, file deletion, or unauthorized resource...

An integer overflow vulnerability has been identified in Freedesktop Poppler, specifically in the function FoFiTrueType::mapCodeToGID within the file fofi/FoFiTrueType.cc. This vulnerability arises from a manipulation of the argument segCnt, leading to potential security risks when exploited. The...

A critical vulnerability has been identified in Freedesktop Poppler that allows an attacker to exploit the JBIG2Stream::readCodeTableSeg function. By manipulating this function, an integer overflow can occur, potentially enabling remote exploitation of the software. This vulnerability was made pu...

A flaw exists in Freedesktop Poppler version 26.07.0, specifically in the JBIG2Stream::rewind function located in poppler/JBIG2Stream.cc. This vulnerability allows for a null pointer dereference, which can be exploited remotely, potentially leading to unexpected application behavior or crashes. U...

A vulnerability has been identified within the Freedesktop Poppler library, specifically affecting the SampledFunction component. This issue arises due to an integer overflow triggered by improper handling of the BitsPerSample argument in the SampledFunction::SampledFunction function. As a result...

A vulnerability exists in the O-RAN-SC SMO OAM's VES Collector that can be exploited remotely, potentially leading to the unauthorized allocation of resources. This issue has been made publicly known, and while the project was alerted to the problem through an early bug report, there has been no ...

The Aureus ERP system version 1.6.0 is susceptible to stored Cross-Site Scripting (XSS) via the Payment Term note field. An authenticated user possessing the permission to create payment terms can submit unvalidated JavaScript code, which is stored in the database and executed in the browsers of ...

A significant vulnerability has been identified in the VES Collector component of O-RAN-SC SMO OAM, allowing for potential abuse of resource allocation. This vulnerability can be exploited remotely, enabling attackers to manipulate the system without the need for local access. Despite a bug repor...

A command injection vulnerability in Windows Active Directory allows an unauthorized attacker to execute arbitrary commands over the network. This security flaw arises from improper handling of special elements within command inputs, potentially leading to unauthorized access and exploitation of ...

An authorization flaw exists in JFrog products, where improper validation of refresh token signatures allows non-admin users to acquire a signed administrator token. This vulnerability could lead to unauthorized access and can potentially compromise the integrity of sensitive operations within th...

A memory allocation vulnerability has been identified in the O-RAN-SC SMO OAM's VES Collector component. The flaw arises from the manipulation of the argument additionalFields.padding, leading to uncontrolled memory allocation. This vulnerability can be exploited remotely, posing significant risk...

A vulnerability exists in the Dromara Mayfly-go product, specifically within the RunMachineScript function located in server/internal/machine/api/machine_script.go. This vulnerability can be exploited through argument manipulation, resulting in OS command injection. The exploitation of this flaw ...

A vulnerability in SourceCodester's Drug Recommendation System version 1.0 allows for unauthorized information disclosure through the manipulation of the /db/drug_recommendor.sql file. This issue is exploitable remotely, making it a significant risk for users of the platform. The exploit has been...

Verizon Cloud for Android is affected by a path traversal vulnerability that allows malicious applications on the same device to write unauthorized data outside the designated staging directory. By manipulating the _display_name value with path traversal sequences, attackers can exploit exported ...

A significant SQL injection vulnerability has been identified in Code-Projects' Matrimonial System version 1.0, particularly affecting the `writepartnerprefs` function within the `partner_preference.php` file. Attackers can manipulate the 'education' parameter, allowing them to execute remote SQL...

A vulnerability has been discovered in Azuriom CMS versions up to 1.2.12, affecting the money transfer functionality in the ProfileController. This weakness allows a remote attacker to manipulate the time-of-check time-of-use condition, potentially leading to unauthorized financial operations. Th...

Metabase, an open-source business intelligence and embedded analytics tool, suffers from a deserialization vulnerability in versions prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4. When configured with an H2 database connection, including the default sample database, this flaw permits authenti...