Publicly Disclosed
PoC Exploits

BMC Helix Network Management prior to version 26.3.01 suffers from an authentication bypass vulnerability when configured with SAML single sign-on. This flaw allows unauthorized users to gain access as the local administrator by submitting an arbitrary password along with the administrator userna...

The ThirstyAffiliates plugin for WordPress versions prior to 3.12.1 contains a vulnerability in its link redirect tracking handler. This flaw allows unauthenticated users to bypass security controls, leading to the exposure of unpublished affiliate link URLs. Additionally, the lack of proper vali...

The ACF Frontend Admin plugin for WordPress, up to version 3.29.13, suffers from an improper authentication flaw that allows unauthenticated users to submit forms and overwrite critical site-wide option values in the global ACF options store. This vulnerability arises from the absence of adequate...

The WP User Manager plugin for WordPress suffers from a vulnerability that permits unauthenticated users to create functional accounts without completing the payment process during payment-gated registration. Specifically, if the payment step fails, the plugin fails to revert the account creation...

The ACF Frontend Admin plugin by DynamiApps prior to version 3.29.13 allows for PHP object injection due to inadequate restrictions on PHP class instantiation during the deserialization of stored post content. This vulnerability facilitates high-privilege users, like administrators, to inject mal...

The WP Data Access plugin for WordPress, prior to version 5.5.88, exposes a security risk due to the lack of authorization and Cross-Site Request Forgery (CSRF) checks. This flaw allows any authenticated user to trigger actions that open connections to arbitrary hosts and ports. Consequently, an ...

The Patreon WordPress plugin prior to version 1.10.0 exhibits a security flaw where it fails to properly validate user-supplied redirect destinations. This oversight permits unauthenticated attackers to manipulate redirect links, leading users to arbitrary external URLs, which could be exploited ...

The PeachPay plugin for WooCommerce prior to version 1.120.70 lacks necessary capability and ownership checks when sending order secret keys in response to unauthenticated requests. This oversight allows potential attackers to access sensitive customer information, including names, email addresse...

The Ukr-To-Lat WordPress plugin, up to version 1.3.5, contains a security flaw that allows users with Contributor-level access or higher to execute SQL injection attacks. This vulnerability arises from the plugin's failure to properly sanitize and escape user-inputted term names when constructing...

The Contact Form 7 Signature Addon for WordPress, specifically up to version 4.2.2, is susceptible to a path traversal vulnerability. This occurs because the plugin fails to properly sanitize input from a signature field before using it to construct an email attachment path. Malicious users can e...

The Patreon WordPress plugin prior to version 1.10.0 is susceptible to a Cross-Site Request Forgery vulnerability that bypasses nonce verification. This weakness allows an attacker to create a malicious request that can manipulate a logged-in administrator's session. By leveraging this vulnerabil...

The Patreon WordPress Plugin, prior to version 1.10.0, lacks proper authorization checks for certain functionalities. This oversight allows unauthenticated users to enumerate the names of various taxonomies, including taxonomies that are not intended for public viewing. As a result, sensitive dat...

The BSK PDF Manager plugin for WordPress, up to version 3.8.1, is vulnerable to SQL injection due to improper sanitization and escaping of parameters in SQL statements. Authenticated users with contributor-level access or higher can exploit this issue to execute arbitrary SQL queries, potentially...

A vulnerability exists in Plex Media Server that allows for Server-Side Request Forgery (SSRF) through the '/player/timeline' endpoint. By exploiting this flaw, an attacker can manipulate the 'protocol' parameter using any X-Plex-Token value, enabling them to send POST requests to any external de...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A flaw within Librsvg is triggered when it processes SVG documents containing nested XML inclusions with duplicate entity declarations. This design oversight leads to a use-after-free error, whereby an XML entity that is still actively utilized by the parser is erroneously freed. This vulnerabili...

The Customer Email Verification for WooCommerce plugin is susceptible to a privilege escalation vulnerability due to improper use of activation codes. In versions up to and including 3.3.0, an attacker can exploit the `alg_wc_ev_verify_email` parameter alongside a misconfigured 'Encoding method' ...

The Wheels product version 4.1.2 is vulnerable to SQL injection attacks due to improper handling of request data in inline-literal paths. This vulnerability is particularly present when backslash escaping is enabled in MySQL/MariaDB configurations, allowing an attacker to manipulate queries by ex...

Frappe HRMS versions 14.x up to 14.38.2, 15.x up to 15.64.0, and 16.x up to 16.18.0 are susceptible to a SQL injection vulnerability that arises due to insufficient input validation. This flaw enables an attacker with authenticated access, even with limited privileges, to exploit specific endpoin...

The Squeeze WordPress plugin prior to version 1.8.1 has a serious flaw that lacks proper capability checks on specific AJAX actions. This oversight allows authenticated users with minimal roles, such as Subscribers, the ability to manipulate attachments. Specifically, they can revert any attachme...

The MAIO WordPress plugin, when deployed in versions earlier than 7.3.22, suffers from a flaw that permits unauthorized users to access its analytics data. This vulnerability arises from the plugin's failure to adequately restrict access, allowing an attacker to leverage a hardcoded API key in th...

A vulnerability exists in the Linux kernel's vsock/virtio implementation regarding zerocopy completion for multi-segment sends. If a large message is fragmented into multiple skbs, only the last skb has the zerocopy user argument (uarg) allocated, leaving non-final skbs with pinned user pages tha...

A vulnerability in the Linux kernel has been identified which affects the BPF Just-In-Time (JIT) allocation. The issue involves a potential exploitation vector related to JIT spraying while mitigating the Spectre version 2 attack. To enhance security, the introduction of an Indirect Branch Predic...

A flaw exists in the cifs-utils, enabling a local user to perform privilege escalation. This vulnerability occurs when a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file. The lack of proper input sanitization allows unauthorized mount o...

The Affiliate Toolkit WordPress plugin, prior to version 3.8.9, has a critical flaw where user-inputted sort values are not validated against an allowlist prior to their use in database queries. This oversight undermines security, permitting users with editor-level access and higher to execute SQ...

The WooCommerce plugin for WordPress prior to version 3.3.2 is susceptible to a security issue where it fails to perform appropriate capability checks during its calendar view AJAX actions. As a result, users with relatively low privileges, such as those assigned the Contributor role, can access ...

The OTP Login & Register WooCommerce plugin for WordPress, prior to version 2.7.3, is susceptible to a brute-force attack due to inadequate limitations on one-time-password verification attempts. This is a critical flaw as it allows an unauthenticated attacker to manipulate the attempt limit by s...

The Smush plugin for WordPress, prior to version 4.3.4, has an access control vulnerability that permits individual site administrators within a multisite network to modify settings that should be restricted to network administrators. This misuse of access permissions could potentially lead to un...

The MB Custom Post Types & Custom Taxonomies plugin for WordPress prior to version 2.12.2 is susceptible to a vulnerability that permits authenticated users, even those with minimal permissions such as subscribers, to execute uncontrolled migration actions. This can result in the creation of publ...

The Salon Booking System plugin for WordPress prior to version 10.31.9 includes a vulnerability that compromises the integrity of REST API request verification. This issue arises from the plugin's failure to adequately authenticate requests, as it neglects to implement WordPress's nonce verificat...

The Salon Booking System plugin prior to version 10.31.3 has a vulnerability that permits any authenticated user, including subscribers, to access endpoints of the booking REST API without proper authorization. This oversight allows these users to view all customer bookings and associated persona...

The Salon Booking System plugin for WordPress versions prior to 10.31.9 contains a security flaw that stems from the insecure generation of booking-API access tokens. The tokens are derived from a hardcoded value within the plugin combined with the timestamp of their issuance, rather than from a ...

The Salon Booking System WordPress plugin prior to version 10.31.9 is susceptible to an authorization bypass vulnerability. This flaw allows unauthenticated attackers to create bookings under any user’s name, modify stored contact information, and change booking statuses to paid or confirmed, all...

The Document Gallery WordPress plugin prior to version 5.1.1 lacks essential capability and ownership checks, enabling unauthorized users to generate galleries on demand. This vulnerability permits these users to disclose sensitive information, such as titles, descriptions, and direct URLs of med...

The Visual Form Builder WordPress plugin prior to version 3.1 lacks necessary authorization checks, enabling any authenticated user from Subscriber level and above to access recent form submissions displayed in a dashboard widget. This loophole can lead to unauthorized disclosure of sensitive use...

The Mobile Builder WordPress plugin prior to version 1.4.2 has a significant vulnerability due to the improper sanitization and escaping of a parameter in its SQL statements. This flaw enables unauthenticated users to execute SQL injection attacks, compromising the integrity of the database on si...

The Visual Form Builder plugin for WordPress versions up to 3.1 lacks proper authorization and nonce validation when users attempt to reorder form fields. This security oversight enables any authenticated user, including those with Subscriber roles, to modify the structure of forms on the site. S...

The Coinsnap Bitcoin Crowdfunding WordPress plugin, up to version 1.2.0, contains an access control vulnerability that fails to adequately restrict access to the secret key used for authenticating its payment gateway webhook. This oversight allows unauthorized users to access sensitive informatio...

The WX Subscribe WordPress plugin, through version 1.2.1, contains a vulnerability due to improper sanitization and escaping of input parameters before processing them in SQL statements. This flaw allows unauthenticated attackers to exploit the vulnerability to perform SQL injection attacks, part...

The Subscribe to Comments Plugin for WordPress, before version 2.3.3, suffers from a serious cookie validation flaw. This vulnerability allows unauthenticated attackers to exploit the lack of signing or validation on a trusted cookie used to identify commenters. As a result, an attacker can poten...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A vulnerability exists in the Neterbit NW-431F embedded web server that allows an attacker to remotely access sensitive information by exploiting an insecure function in the /sms.json file. This manipulation could lead to unauthorized data exposure, compromising user privacy while revealing sensi...

A local security flaw has been identified in the AutoBackend Model Loading component of the ImprintLab Medical-SAM-Adapter. Specifically, the issue lies within the function session.get_modelmeta.custom_metadata_map in the file models/MobileSAMv2/ultralytics/nn/autobackend.py. The vulnerability ar...

A vulnerability exists in the bitcoinj Payment Request Handler, specifically in the url.openConnection function within PaymentSession.java. This flaw enables an attacker to manipulate the pki_type argument, potentially leading to server-side request forgery. Remote exploitation is possible, and a...

A vulnerability in the Linux kernel related to posix CPU timers can lead to a use-after-free condition due to a race in non-leader exec() scenarios. When a timer associated with a process is deleted while concurrently executing an exec() command, it can cause access to freed memory. Specifically,...

Aureus ERP versions up to 1.6.0 have a stored cross-site scripting vulnerability found in the HolidayAction.php file. This issue arises when authenticated users are able to input unescaped holiday names, which are then rendered as HtmlString. Attackers who are authorized to create Public Holidays...

The Jooan JA-A12 IP cameras with specific firmware versions are vulnerable to a remote code execution issue that enables attackers to gain unauthorized control. By exploiting hard-coded credentials, unauthorized users can send crafted requests to the device, triggering the jooandiag daemon to exe...

A significant vulnerability in Ivanti Connect Secure version 22.8R2.4 allows attackers to exploit issues in the way DSCache configuration data is handled by the dsinvoked broker. This flaw can lead to unauthorized privilege escalation to root level. Exploits for this vulnerability have already be...

MaxKB, an open-source AI assistant designed for enterprise use, is susceptible to a command injection vulnerability in versions prior to 2.10.5-lts. This flaw arises from the misuse of the SandboxShellBackend, which improperly exposes an execute shell tool and neglects to implement necessary secu...

A cryptographic vulnerability identified in Qualcomm products permits the unauthorized modification of partition table entries, potentially altering the boot flow. This flaw compromises the integrity of the device's boot process, leading to the risk of malicious modifications and unauthorized sys...