Publicly Disclosed
PoC Exploits

Elementor Pro has a vulnerability that allows attackers to upload files of dangerous types without restriction. This can lead to potential exploits where malicious files are executed on the server. It is essential for users of Elementor Pro, particularly versions from n/a to 4.2.1, to patch this ...

Elementor Pro has a vulnerability that allows attackers to upload files of dangerous types without restriction. This can lead to potential exploits where malicious files are executed on the server. It is essential for users of Elementor Pro, particularly versions from n/a to 4.2.1, to patch this ...

A buffer overflow vulnerability exists in the RMD Command Handler of PCMan FTP Server 2.0.7, potentially allowing remote attackers to execute arbitrary code. Once the vulnerability is exploited, it could lead to unauthorized access or compromise of the system. The exploit is publicly known, under...

Pixelfed, up to version 0.12.9, contains a flaw in its StoryComposeController, where it does not validate follower status for its react and comment endpoints. This oversight allows authenticated users to access follower-only stories without necessary permissions. By exploiting this vulnerability,...

The Pterodactyl Panel prior to version 1.14.1 has a vulnerability that arises from improper validation of action-specific permissions during the creation of scheduled tasks. This oversight allows subusers with merely the 'schedule.update' permission to execute arbitrary console commands. As a res...

NetBox versions through 4.7.0 contain a vulnerability where authenticated users can exploit unscoped querysets in REST and GraphQL API endpoints. This flaw allows unauthorized access to private user records, specifically in Notifications, Subscriptions, and Bookmarks. As a result, an authenticate...

NetBox version 4.7.0 exposes sensitive backend credentials, including Git and Amazon S3 plaintext passwords, through REST and GraphQL API responses. This vulnerability enables authenticated users with view-only permissions to access sensitive credentials, potentially leading to unauthorized acces...

The Actualizer software by Chew, Kean Ho prior to version 1.2.1 exhibits a significant fail-open vulnerability in its password validation processes. Specifically, the installer script Shell/debian-minbase-install.sh fails to validate the success of the mkpasswd command when generating yescrypt pa...

The EmbedPress plugin for WordPress, prior to version 4.6.4, suffers from an authorization flaw in its public review-loading action. This vulnerability allows unauthenticated users to execute repeated, unauthorized requests to billable third-party APIs using the site's API key. This can lead to c...

The JCH Optimize plugin for WordPress prior to version 6.0.1 contains a vulnerability that fails to adequately verify user capabilities during certain authenticated AJAX actions. This oversight permits any logged-in user, such as Subscribers, to import arbitrary settings from the plugin. As a con...

The HT Menu plugin for WordPress, prior to version 1.2.7, fails to validate user capabilities or object ownership when saving navigation menu-item settings. This oversight allows users with minimal permissions, such as Subscribers, to inject malicious JavaScript code. When this code is executed i...

The Video Player for YouTube plugin for WordPress, prior to version 2.1.0, fails to adequately sanitize and escape user-supplied input utilized in SQL statements. This oversight permits users with Contributor roles and above to conduct SQL injection attacks, thereby gaining unauthorized access to...

The VikWidgetsLoader plugin for WordPress prior to version 1.12.0 contains a significant code injection vulnerability. It fails to properly sanitize or escape a block attribute before including it in an inline script. This oversight allows users with Contributor permissions to insert arbitrary Ja...

The CatFolders Document Gallery & PDF Library plugin for WordPress prior to version 2.0.7 contains a vulnerability due to improper validation of block attributes. This flaw permits users with Author roles or higher to inject arbitrary web scripts, which can execute in the browsers of visitors vie...

The Joli Table Of Contents plugin for WordPress, prior to version 3.0.3, fails to properly sanitize or escape shortcode attribute values. This vulnerability allows users with author privileges or higher to inject arbitrary HTML attributes and JavaScript into posts. As a result, code executed in t...

The EmbedPress plugin for WordPress prior to version 4.6.4 lacks adequate authorization checks on its Google Reviews REST API routes. This deficiency permits users with Contributor roles and above to alter site-wide store configurations, including the ability to delete pre-existing entries set by...

The Eventin WordPress plugin is affected by a vulnerability that compromises authorization checks on several REST routes related to event management. Users with contributor-level access and higher can exploit this flaw to manipulate the site's front-page settings, changing them to events they do ...

The EmbedPress WordPress plugin prior to version 4.6.4 contains a flaw that allows authenticated users with contributor-level access or higher to access restricted Google Reviews REST routes. This vulnerability permits such users to view the site administrator's email address, a sensitive piece o...

The Kirki plugin for WordPress prior to version 6.3.0 lacks proper validation of user permissions when modifying comments on the page builder. This oversight allows users with only content-level access to alter comments made by others, even on pages that they do not have access to view. As a resu...

The Kirki WordPress plugin prior to version 6.3.0 is susceptible to an SQL injection vulnerability. This flaw occurs because the plugin does not properly sanitize user-supplied identifiers used in SQL queries. As a result, users with editor-level permissions and higher can manipulate queries to i...

The King Addons for Elementor WordPress plugin versions prior to 51.1.77 is susceptible to a Cross-Site Scripting (XSS) vulnerability. This issue arises due to inadequate escaping of widget display-style settings before rendering them in HTML attributes. As a result, users with Contributor-level ...

The Events Calendar plugin for WordPress prior to version 6.17.3.1 has a significant security flaw that allows users with low-privilege roles, such as contributors, to access non-public content through public REST archives. This weakness results in unauthorized disclosure of unpublished records, ...

The Eventin WordPress plugin allows users with contributor-level access and above to exploit a vulnerability in the template path validation mechanism. This flaw permits the inclusion and execution of arbitrary local PHP files, potentially compromising the security of the website. Users should up...

The Greenshift plugin for WordPress prior to version 13.2.0 contains a vulnerability that arises from inadequate escaping of block animation attributes output within HTML. This flaw allows users with contributor-level access or higher to inject arbitrary web scripts into the content, which get ex...

The Bold Page Builder plugin for WordPress, prior to version 5.9.8, contains a vulnerability that allows attackers to inject arbitrary web scripts. This occurs due to improper validation of link URLs, enabling users with roles as low as Contributor to execute malicious scripts when an affected li...

The Bold Page Builder WordPress plugin prior to version 5.9.8 allows users with Contributor roles and higher to exploit a lack of sanitization and escaping of shortcode attributes. This oversight permits the injection of arbitrary web scripts into HTML attributes, leading to potential execution o...

The Greenshift WordPress plugin prior to version 13.2.0 contains a vulnerability that permits users with contributor-level access or higher to provide unvalidated URLs for server-side fetching. This flaw enables these users to create unrestricted requests to arbitrary external hosts, which may ex...

The My Private Site plugin for WordPress, prior to version 4.2.3, fails to enforce proper access control on specific front-end elements. This oversight permits unauthenticated users to access restricted content, including posts, comments, and URLs, from sites that are intended to be private. Admi...

The Music Store plugin for WordPress, prior to version 1.4.5, is vulnerable to a SQL injection attack due to insufficient sanitization and escaping of user input. This security flaw allows unauthenticated users to manipulate SQL statements, potentially compromising the database integrity and expo...

The Accept Stripe Payments plugin for WordPress prior to version 2.1.4 lacks proper verification during the checkout process. Specifically, it does not ensure that the product fulfilled matches the actual purchase. Instead, it only checks if the amount paid meets or exceeds the product's price, w...

The Masteriyo LMS WordPress plugin prior to version 3.4.0 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper sanitization and escaping of certain course settings. This flaw allows users with a course-author role to inject malicious scripts into the output, which c...

The Accept Stripe Payments plugin for WordPress prior to version 2.1.4 contains a serious vulnerability where it fails to validate user-supplied URLs during redirection. This allows unauthenticated attackers to redirect visitors to arbitrary external websites, creating opportunities for phishing ...

The IPGP Visitors Origin plugin for WordPress fails to properly sanitize and escape user input before including it in the HTTP response. This oversight allows unauthenticated attackers to execute malicious scripts by tricking users into submitting crafted requests. As a result, an attacker could ...

The Smart Post WordPress plugin prior to version 4.0.8 is susceptible to an information disclosure vulnerability. This flaw allows unauthenticated users to access the content of password-protected posts and retrieve their associated passwords through an unauthenticated AJAX request. This poses si...

The SEO Flow by LupsOnline WordPress plugin has a security weakness in its API credential validation process. This flaw allows unauthenticated users to impersonate the site administrator, provided that the plugin is set up in a typical manner. It poses a risk of unauthorized access and potential ...

The Smart Post WordPress plugin before version 4.0.8 suffers from an improper access control vulnerability, allowing users with contributor privileges and higher to duplicate any private or password-protected posts. This unauthorized access can lead to exposure of sensitive content and metadata, ...

The RegistrationMagic plugin for WordPress fails to properly verify the application associated with a Facebook access token prior to accepting it for user authentication. This significant oversight allows unauthenticated attackers to either gain access to existing user accounts by obtaining valid...

The JetFormBuilder plugin for WordPress, prior to version 3.6.5.2, lacks adequate sanitization and escaping of form field values before populating them in HTML notification emails. This flaw enables unauthenticated users to inject arbitrary HTML, which may lead to harmful effects based on the rec...

The Search Atlas SEO WordPress plugin prior to version 2.6.24 is vulnerable due to insufficient security checks before processing settings updates. This flaw permits authenticated users, including those with the Subscriber role, to overwrite or delete the site's stored Google service-account cred...

The JetFormBuilder — Dynamic Blocks Form Builder for WordPress prior to version 3.6.5.2 lacks proper authorization checks during the resolution of request-derived data. This flaw allows unauthorized users to access sensitive information including user and post metadata, password hashes, as well a...

The Joli Table Of Contents WordPress plugin versions prior to 2.8.1 are susceptible to a Stored Cross-Site Scripting vulnerability. This flaw arises from the failure to properly sanitize and escape certain settings when rendering in the admin interface. As a result, users with elevated privileges...

The JCH Optimize WordPress plugin prior to version 5.0.1 allows high-privilege users, including administrators and multisite sub-site administrators, to exploit a weakness in the administrative image-browsing functionality. This vulnerability fails to properly restrict directory path inputs, enab...

A vulnerability has been identified in the Linux kernel's crypto subsystem, specifically within the algif_aead component. This issue arises from an unnecessary complexity in operating in-place, which has been reverted for improved security and performance. The change eliminates the need for in-pl...

A security vulnerability exists in PostgreSQL's logical decoding feature, where a non-superuser with REPLICATION privileges can exploit missing authorization. This flaw enables the execution of arbitrary code by allowing access to any file that is visible to the operating system account running t...

mcp-grafana allows an attacker to manipulate the X-Grafana-URL request header, which can direct outbound requests to unintended internal destinations, including sensitive network services and metadata endpoints. This oversight permits attackers to exploit the system for unauthorized data access, ...

A security flaw has been identified in the Ramon-Victor FreeGPT-WebUI, specifically in the Jailbreak Mode component. This vulnerability arises from a race condition in the getJailbreak function within the server/config.py file. Given its complexity, the attack can be executed remotely, posing sig...

A vulnerability exists in the Ramon-Victor FreeGPT-WebUI related to the Jailbreak Mode component. Specifically, a flaw in the getJailbreak function found in the server/backend.py file allows for remote manipulation, potentially leading to undesired allocation of system resources. This issue affec...

A security issue exists in the Ramon-Victor FreeGPT-WebUI that affects the Backend Conversation API, specifically the _conversation function in server/backend.py. This vulnerability allows an attacker to manipulate the model argument, which can result in missing authentication checks. The exploit...

A type confusion vulnerability has been identified in the V8 JavaScript engine of Google Chrome. Prior to version 152.0.7977.82, this flaw allows malicious attackers to execute arbitrary code within the browser's sandbox environment by crafting a specially designed HTML page. This vulnerability p...

A vulnerability exists in the ramon-victor freegpt-webui affecting the ChatCompletion.create function within the authentication check component found in g4f/__init__.py. This manipulation results in missing authentication, allowing remote attackers to exploit the flaw. The product operates under ...