Publicly Disclosed
PoC Exploits

Deskin versions up to 3.3.4.3 have a significant vulnerability in the com.deskin.service.installer XPC service. This flaw allows local unprivileged attackers to connect to the root-owned service without authentication, enabling them to execute arbitrary installer packages as the root user. By exp...

Intego Antivirus for Windows versions through 3.0.0.1 contains a vulnerability in its optimization module that permits local unprivileged users to delete arbitrary folders as the SYSTEM account. Exploitation occurs when an attacker alters the directory of a scanned duplicate file, leveraging a ju...

The vulnerability in WSO2 products relates to the JWT authentication mechanism, which improperly validates tokens signed with algorithms not explicitly configured or supported. This flaw enables an attacker to create a JSON Web Token (JWT) using an unsupported signing algorithm. If an attacker su...

The ONT/Beacon device by Nokia features a critical input handling flaw in its unified WEBUI application. This vulnerability allows low-privileged authenticated users to exploit insufficient validation of user-supplied data, enabling them to execute arbitrary commands on the device's operating sys...

A security flaw exists in the Keycloak Services component of Red Hat, specifically within the reset-credentials workflow. This vulnerability permits an attacker to initiate a password reset for any user without the need for email verification. As a consequence, it enables unauthorized users to as...

Craft CMS has a remote code execution vulnerability due to improper handling of user-controlled input in the conditions system prior to version 5.9.9 and 4.17.4. The affected method, BaseElementSelectConditionRule::getElementIds(), makes use of the unprotected renderObjectTemplate() function, all...

FFmpeg versions up to 9.0.2 have a vulnerability in the RTSP redirect handling within the ff_rtsp_connect() function in libavformat/rtsp.c. The flaw allows attackers with control over the RTSP server to send continuous 302 redirects to the same or a different server. This leads to an infinite loo...

FFmpeg versions prior to 8.1.3 contain a vulnerability in the HLS demuxer that can be exploited by remote attackers to create a denial of service condition. This occurs when the parse_playlist() function improperly handles Master Playlist tags embedded in Media Playlists. Attackers may deceive us...

The mJobTime application, specifically build 15.7.3.32, features an unauthenticated SQL execution vulnerability found in the Login.aspx admin panel. This flaw allows attackers to exploit the runQueryButton postback and exportSqlQuery_Server PageMethod, executing arbitrary SQL commands against the...

This vulnerability affects several Atlassian Data Center products, enabling an unauthenticated remote attacker to gain access to specific files within the web application root directory. Essential exploitation requires prior knowledge of the exact file names and paths, with no ability to enumerat...

The LMCache distributed mode introduces a vulnerability where an unauthenticated ZeroMQ ROUTER allows worker processes to register and share key-value cache blocks. This may lead to code execution as the user running the LMCache process, potentially with elevated privileges if running as root. It...

Integrics Enswitch versions 3.13 through 4.4 are affected by an authentication bypass vulnerability that enables unauthenticated attackers to change account passwords. This issue arises from a flaw in the /api/json/user/password/update/ endpoint, allowing attackers to circumvent authentication by...

The Wallet System for WooCommerce plugin suffers from an improper input validation flaw that allows authenticated attackers with Subscriber-level access to manipulate wallet transfer amounts. An attacker can exploit this vulnerability by minting wallet funds, as the system fails to ensure that tr...

The TutorStarter WordPress theme prior to version 4.0.4 contains a vulnerability where one of its AJAX registration handlers fails to respect the site's user registration setting. This weakness enables unauthenticated visitors to create user accounts on the WordPress site even when user registrat...

The Easy Digital Downloads plugin for WordPress prior to version 3.7.1 contains a security flaw that permits unauthenticated users to create accounts without properly checking the user registration settings of the site. This issue enables unauthorized account creation and grants the created accou...

The Airwallex Online Payments Gateway plugin for WordPress lacks proper verification of incoming payment notifications when a webhook secret is not configured. This issue enables attackers to forge notifications, potentially leading to unauthorized marking of orders as paid. Website owners using ...

An OS Command Injection vulnerability exists in the login.xgi CGI endpoint of Iskratel Innbox GPON ONT devices, allowing unauthorized remote attackers to execute arbitrary commands with root privileges using specific parameters. This security flaw poses a significant risk as it can lead to unauth...

The SMS Alert plugin for WordPress has a significant information disclosure flaw found in versions prior to 4.0.1. This vulnerability enables an unauthorized administrator within a multisite network to access and reveal the billing phone numbers of users across different sites. The issue arises f...

The Track Orders for WooCommerce plugin prior to version 1.2.7 contains a security flaw that allows unauthorized access to sensitive customer information. This vulnerability permits unauthenticated attackers to view critical personal details of users simply by providing their email addresses. As ...

The Wallet System for WooCommerce plugin for WordPress prior to version 2.8.0 contains an authorization flaw that allows authenticated users, such as subscribers, to make unauthorized withdrawal requests. This issue arises because the plugin fails to confirm that the specified wallet account for ...

The Wallet System for WooCommerce plugin for WordPress prior to version 2.8.0 contains a security flaw that permits authenticated users to execute wallet transfers without the necessary permissions. Specifically, this vulnerability allows any authenticated individual, including those with minimal...

The BackWPup plugin for WordPress, prior to version 5.7.7, is susceptible to a vulnerability that permits unauthenticated attackers to trigger backup jobs on the system. By exploiting this flaw, attackers can initiate any scheduled backup task regardless of its original trigger conditions or timi...

The Wallet System for WooCommerce plugin for WordPress versions prior to 2.8.0 lacks proper capability checks, allowing any authenticated user to access sensitive wallet transaction reports. This oversight can lead to unauthorized disclosure of sensitive user data, including customer names, email...

The BackWPup plugin for WordPress prior to version 5.7.7 has a security flaw that fails to adequately restrict the destination path for files extracted during backup restores. This issue arises when the fallback archive library is utilized, allowing high-privileged users to manipulate the backup ...

The Appointment Booking Plugin for WordPress versions earlier than 5.6.5 contains an authorization flaw that permits an authenticated user with a staff role to delete any order, customer, or transaction record. This happens even if the records belong to different staff members or exceed their des...

The BackWPup plugin for WordPress, prior to version 5.7.7, suffers from improper access control, allowing unauthorized users to access the plugin's working directory. This flaw enables unauthenticated attackers to download backup archives containing sensitive information like database dumps, site...

The Appointment Booking Plugin for WordPress, prior to version 5.6.9, contains an authorization vulnerability associated with the AI Abilities API. This flaw permits authenticated users with the LatePoint Agent role to bypass restrictions, allowing them to access, read, and even modify other agen...

The Appointment Booking Plugin for WordPress prior to version 5.7.3 contains an improper authentication vulnerability. This flaw allows unauthenticated users to access sensitive customer information such as names, contact details, and order confirmation codes by manipulating the order-item identi...

A security flaw has been identified in the Database Addon for WPForms plugin. The vulnerability arises from the lack of proper CSRF nonce verification and insufficient capability checks. As a result, attackers can potentially exploit this weakness to delete arbitrary stored form entries. This is ...

The Booking Calendar plugin for WordPress, prior to version 11.8.3, features inadequate restrictions allowing users with Editor roles and higher to access and disclose values of arbitrary WordPress options. This vulnerability can potentially expose sensitive configuration details of the WordPress...

The Easy Digital Downloads plugin for WordPress prior to version 3.7.1 is vulnerable due to inadequate restrictions on order data visibility. This flaw allows users with only subscriber-level access to view details of other customers' recent orders, including signed download links that provide un...

The Booking Calendar plugin for WordPress prior to version 11.8 is susceptible to a vulnerability that compromises the integrity of access hashes. This flaw arises from the generation of hashes that lack sufficient entropy, as they are based on low-entropy time-seeded values. An unauthenticated a...

The Image Photo Gallery Final Tiles Grid plugin prior to version 3.6.14 is susceptible to an authorization bypass vulnerability. This security flaw arises from improper verification of user permissions in multiple gallery and image management operations. The plugin erroneously checks ownership ag...

The Ultimate Multisite Plugin for WordPress, prior to version 2.17.0, contains a significant vulnerability that allows unauthenticated attackers to log into existing user accounts, including those of Network Super Admins. This exploit occurs when a checkout form is utilized without a password fie...

The Frontend Dashboard WordPress plugin prior to version 3.0.5 lacks proper authorization checks, allowing unauthenticated users to invoke arbitrary PHP functions or class methods. This vulnerability poses a significant risk as it enables attackers to perform actions that could lead to the takeov...

The Image Photo Gallery Final Tiles Grid plugin for WordPress prior to version 3.6.14 is susceptible to a JavaScript injection flaw. This vulnerability arises from inadequate sanitization of gallery configuration values that can be manipulated via the gallery shortcode. Users with contributor-lev...

The GPTranslate plugin for WordPress, prior to version 2.34.14, is susceptible to stored cross-site scripting attacks. This vulnerability arises from the plugin's failure to adequately restrict who can save translations. Furthermore, it does not correctly escape translations when rendering them o...

The User Private Files plugin for WordPress, prior to version 2.2.0, suffers from an access control issue on multisite installations. The plugin fails to enforce access restrictions on private files, as the essential rewrite rule for routing file requests and conducting access checks is not execu...

In Stump API versions up to 0.1.10, a flaw exists in the GraphQL mutations for updating and deleting smart lists. These mutations rely solely on the shared AccessSmartList permission, neglecting to verify the creator's identity of the smart list. This oversight allows any authenticated user with ...

The Heimdall application from LinuxServer is vulnerable to Server-Side Request Forgery (SSRF) due to its insufficient protection mechanisms. While the SafeUrlFetcher is intended to mitigate SSRF risks, it is only applied to the ItemController. Other endpoints, like POST /test_config and GET /get_...

iperf3, in versions earlier than 3.22, is susceptible to a denial of service vulnerability that allows remote, unauthenticated attackers to disrupt server functionality. By sending a specifically crafted control-channel parameter message followed by a single 16-byte UDP datagram, attackers can fo...

A vulnerability exists in the Ultimate Member plugin which allows attackers to bypass authorization controls via user-controlled keys. This flaw can lead to privilege escalation, enabling unauthorized access to user accounts and sensitive information. The affected versions range from n/a to 2.13....

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A type confusion vulnerability resides in the V8 engine of Google Chrome, making it possible for remote attackers to execute a malicious payload that could lead to heap corruption. By exploiting this vulnerability, an attacker can craft a specific HTML page that, when interacted with by a user, m...

A use-after-free vulnerability exists in the Android Binder service, which could allow attackers to elevate privileges from an application to the Linux Kernel. Exploitation of this vulnerability does not require any interaction from the user; however, it necessitates either the installation of a ...

A vulnerability exists in the Linux kernel that concerns the handling of shared skb fragments during the decryption process in ESP-in-UDP packets. When pages are attached from a pipe directly to an skb using MSG_SPLICE_PAGES, the kernel marked these SKBs with SKBFL_SHARED_FRAG, which plays a cruc...

A missing authentication flaw in the Kernel Memory Access Driver (PSKMAD) employed by WatchGuard endpoint security products enables local, authenticated attackers to circumvent the driver's access-control mechanisms. This can lead to the execution of unauthorized privileged commands, ultimately a...

LiteLLM is impacted by a vulnerability that permits attackers to utilize a valid JSON Web Token (JWT) from a designated identity provider to impersonate any existing user. The flaw arises from an email-based fallback lookup process in the authentication flow which bypasses verification of the ema...

A vulnerability has been reported in Open5GS versions up to 2.7.7 in the GTP-U Receive Path function ogs_pfcp_xact_local_create, which allows remote attackers to manipulate resource allocations. This issue can potentially be exploited without authentication, making it critical to address. Users a...

Gophish versions 0.11.0 to 0.12.1 are prone to a server-side request forgery vulnerability that can be exploited by authenticated low-privileged users. Through the endpoint POST /api/import/site, attackers are able to submit internal URLs that are not blocked by the default dialer deny list. This...