Publicly Disclosed
PoC Exploits

The Seraphinite Accelerator plugin for WordPress is susceptible to a reflected cross-site scripting (XSS) vulnerability. This issue arises through improper validation of the 'seraph_accel_prep' parameter in versions 2.29.15 and earlier. Specifically, the CacheExtractPreparePageParams() function f...

A remote code execution vulnerability in Microsoft Outlook allows an attacker to run arbitrary code on a user's system. This can occur when the vulnerable version processes specially crafted email messages, which can result in unauthorized access or control over the affected system. Attackers can...

SeaweedFS, a distributed storage solution for object storage and Iceberg tables, has a vulnerability where specific URL patterns can bypass security measures. With the S3 API gateway and the Iceberg REST catalog gateway configured with path cleaning disabled, attackers can exploit this flaw using...

A vulnerability in WordPress allows for potential SQL Injection due to improper sanitization of the author__not_in parameter in WP_Query. When untrusted input is passed to this parameter via a plugin or theme, it could lead to unauthorized database queries. Affected versions include WordPress 6.8...

The Ajax Load More plugin for WordPress prior to version 8.0.1 suffers from a vulnerability where it inadequately sanitizes and escapes input parameters. This flaw can be exploited by attackers lacking authentication, enabling them to execute time-based blind SQL injection attacks. Such exploits ...

The IDX Plugin & MLS Plugin for Real Estate Listings for WordPress before version 7.0.4 lacks necessary authorization and Cross-Site Request Forgery (CSRF) checks within its AJAX actions. This oversight permits any authenticated user to gain unauthorized access to sensitive information, including...

The Contest Gallery plugin for WordPress, prior to version 30.0.7, contains a security flaw that allows attackers to bypass standard authentication mechanisms. By issuing an authentication cookie directly after verifying credentials, the plugin defeats the purpose of brute-force protections and t...

The miniOrange 2FA WordPress plugin prior to version 6.2.7 contains a security flaw that fails to correctly bind the second factor during the pre-login verification process. This allows an attacker, who knows a victim's password, to reconfigure the victim's second factor to an address controlled ...

The OTP Login With Phone Number plugin for WordPress before version 1.8.71 is vulnerable as it lacks limitations on the number of OTP verification attempts. This oversight permits unauthorized users to continuously request login codes for any account without invalidating previous attempts. As the...

The WP 2FA plugin for WordPress, prior to version 4.1.0, contains a critical flaw that fails to validate the secondary authentication factor when one of the supported methods is chosen during the login process. This oversight allows an unauthorized individual who possesses the valid password of a...

The GeoDirectory WordPress plugin versions prior to 2.8.110 lacks adequate sanitization and escaping of input for the place-category setting on admin pages. This oversight allows users with high privileges, such as editors and above, to execute Stored Cross-Site Scripting (XSS) attacks, even in c...

The DHL Shipping Germany plugin for WooCommerce prior to version 4.0.1 has a significant vulnerability that allows attackers to exploit a lack of authorization checks on its shipping-label download endpoints. Without requiring any form of authentication or verification such as capability checks, ...

The YayPricing plugin for WordPress prior to version 3.5.7 contains a security flaw where it fails to enforce proper capability checks on various REST API endpoints. This oversight permits any authenticated user, including those with minimal privileges like subscribers, to manipulate the store's ...

The DHL Shipping for WooCommerce plugin prior to version 4.0.1 is susceptible to an access control vulnerability that allows unauthenticated users to access sensitive shipping labels. This flaw arises from inadequate protection of its shipping-label storage directory, depending solely on an Apach...

The Zportals WordPress plugin fails to adequately validate uploaded files, relying on the content type provided by the client and preserving the original file extension. This security oversight allows authenticated users with roles of Subscriber or higher to upload arbitrary PHP files, potentiall...

The WP Custom HTML Page plugin up to version 0.6.2 fails to properly sanitize HTML inputs through its custom page handlers. This vulnerability allows users with an Author role to store unfiltered JavaScript, leading to potential execution of malicious scripts at public URLs when accessed by any v...

The User Registration & Membership plugin for WordPress, prior to version 5.2.6, fails to respect the site's registration-disabled setting during the processing of registration form submissions. This oversight permits unauthenticated users to create new accounts, even if the WordPress administrat...

The MultiVendorX WordPress plugin, prior to version 5.0.11, contains a vulnerability in its REST API that fails to ensure proper ownership checks. This allows vendor-level users to access and disclose sensitive commission and financial data associated with other vendors, compromising user data in...

The GeoDirectory WordPress plugin, prior to version 2.8.168, contains a vulnerability that permits authenticated users with Contributor-level permissions or higher to exploit a user-search handler. This oversight allows these users to retrieve email addresses of all registered users, including th...

The Custom Fields WordPress plugin, prior to version 1.5.1, contains a security flaw that permits unauthenticated users to execute file deletion commands by failing to properly validate user-supplied file paths. This vulnerability can potentially allow attackers to delete critical files, includin...

The GDPR Cookie Compliance plugin for WordPress, prior to version 5.1.0, contains an authentication bypass vulnerability that allows an attacker to exploit cookie expiration functionality. Due to a lack of authentication checks, an unauthorized user can craft a link to log out any visitor and rem...

The Passster plugin for WordPress, prior to version 4.3.6, is susceptible to a vulnerability that exposes password-protected block content to unauthenticated users. This occurs because the plugin fails to properly verify the password before rendering the protected content in the public response. ...

A security flaw in the MultiVendorX WordPress plugin allows authenticated vendors (Store Owners and above) to exploit the REST API functionality without verifying ownership. This oversight enables them to view, take control of, permanently delete, or alter any other vendor's store on the marketpl...

The Orbit Fox WordPress plugin versions prior to 3.0.8 have a significant vulnerability that permits authenticated users to upload SVG files without proper sanitization. This lack of validation can lead to the injection of JavaScript code that executes within the site's context when the malicious...

The Passster WordPress plugin prior to version 4.3.6 contains a vulnerability that compromises category-based content protection. This flaw permits unauthenticated users to access the full content, titles, and excerpts of posts that are intended to be restricted through the WordPress REST API. As...

The Bit Form WordPress plugin prior to version 3.2.0 allows unauthenticated users to upload malicious SVG files that contain JavaScript code. When these files are viewed, the embedded code can execute within the context of the user’s browser session, potentially leading to unauthorized actions an...

The Passster plugin for WordPress prior to version 4.3.6 is vulnerable due to insufficient checks on post status when returning content from a REST endpoint. This flaw enables unauthorized users to access and disclose the content of private, draft, or pending posts on websites using a captcha pro...

The Sunshine Photo Cart plugin for WordPress, in versions prior to 3.6.12, lacks proper access control measures for certain AJAX actions. This oversight permits unauthenticated users to access and retrieve comments from images that are part of private, password-protected, or otherwise restricted ...

A vulnerability exists in YeQifu Warehouse, specifically within the processing of the FileController.java file. This flaw allows an attacker to manipulate the argument path, resulting in potential path traversal. As this exploit has been publicly disclosed, it exposes the affected systems to remo...

A command injection vulnerability exists in the H3C NX15 Router version V100R017. The issue arises from the improper handling of the 'my2P4key' argument in the esps.wan.repeater.set/repeaterproc function located in the /api/esps file. Remote attackers can exploit this vulnerability to execute arb...

A security vulnerability has been identified in the H3C NX15 V100R017, specifically within the service.add function of the Web API component located at /api/esps. This vulnerability exposes a dangerous routine that can be manipulated remotely, potentially allowing an attacker to execute arbitrary...

A vulnerability has been discovered in the H3C NX15 product, specifically in the Backend RPC component's file.exec function located at /api/esps. This flaw allows for remote command injection through manipulation of the argument File. Attackers may exploit this weakness to execute arbitrary comma...

A critical security flaw has been identified in the UTT HiPER 1200GW device, specifically affecting versions up to 2.5.3-170306. The vulnerability lies within the strcpy function located in the /goform/ConfigAdvideo file. Improper manipulation of the 'timestart' argument can lead to a stack-based...

A stack-based buffer overflow vulnerability has been identified in the UTT HiPER 1250GW router, specifically within the strcpy function of the /goform/getOneApConfTempEntry file. By manipulating the tempName argument, an attacker can exploit this flaw remotely, potentially compromising the device...

The Lavkush Maurya Student Registration System 1.0 contains a vulnerability that allows for SQL injection through improper handling of the 'oldpass' argument in the /student/changepass.php file. This weakness can be exploited remotely, leading to unauthorized access and manipulation of the databa...

A vulnerability exists in the UTT HiPER 1250GW, affecting versions up to 3.2.7-210907-180535. The flaw is found in the strcpy function within the /goform/APSecurity_5g file, which leads to a stack-based buffer overflow when the argument cipher is manipulated. This vulnerability allows for remote ...

A vulnerability has been discovered in the ESAFENET CDG product, where improper handling of the 'keyid' parameter in the file '/CDGServer3/ukey/usbkey;logindojojs' allows attackers to execute SQL injection attacks. This flaw exposes systems to potential unauthorized access and manipulation of the...

A security flaw has been identified in Poesis Rhymix CMS in versions up to 2.1.33, specifically in the procImporterAdminCheckXmlFile function found in the Data Import Module. This vulnerability makes the system susceptible to server-side request forgery (SSRF), potentially allowing remote attacke...

A vulnerability has been identified in epsilla-cloud vectordb versions up to 0.3.18, specifically affecting the Filter Parser component, notably in the SplitTokens and ShuntingYard functions located within the engine/query/expr/expr.cpp file. This vulnerability arises from improper checks for unu...

A serious security issue has been identified in RackTables, impacting versions up to 0.22.0. This vulnerability allows attackers to execute unauthorized commands on behalf of users without their consent due to a lack of cross-site request forgery (CSRF) prevention mechanisms. The exploit can be i...

The Odysseus platform, prior to commit 87babb5, is vulnerable to a server-side request forgery (SSRF) flaw that allows attackers with admin privileges to exploit the embedding endpoint configuration. This vulnerability permits the injection of arbitrary URLs without necessary validations, enablin...

The Odysseus platform, prior to commit 87babb5, is vulnerable to a server-side request forgery (SSRF) flaw that allows attackers with admin privileges to exploit the embedding endpoint configuration. This vulnerability permits the injection of arbitrary URLs without necessary validations, enablin...

A command injection vulnerability exists in the H3C NX15 Router (V100R017) affecting the reload.reload_config function exposed through /api/esps. This weakness allows attackers to remotely inject arbitrary commands, potentially leading to unauthorized system access and compromise. The exploit has...

A command injection vulnerability exists in the H3C NX15 V100R017 product. The flaw is located in the delete function of the /api/esps endpoint, where unsanitized input from the esps.apcm.version argument can be manipulated to execute arbitrary commands. This vulnerability allows attackers to ini...

A vulnerability has been identified in the H3C NX15 Router, specifically within the esps.ipv6.wan function of the /api/esps file. This flaw allows an attacker to manipulate the workMode argument, which could lead to command injection. The vulnerability can be exploited remotely, increasing the ri...

A security flaw exists in the H3C NX15 V100R017, located in the Add function of the /api/esps file. By manipulating the argument esps.filter.url, an attacker can execute arbitrary commands on the target system. This vulnerability can be exploited remotely, allowing unauthorized access and control...

A vulnerability has been identified in Systerel S2OPC versions up to 1.7.3, specifically affecting the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse function within the DeleteMonitoredItemsRequest Handler. This flaw leads to out-of-bounds read conditions, potentially allowing an attacker t...

A security flaw exists in GitHub Copilot CLI that allows for arbitrary code execution through the exploitation of malicious bare git repositories. Prior to version 1.0.43, when users execute git operations, the CLI could inadvertently run commands specified by attackers via git's automatic bare r...

A vulnerability exists in Trippo ResponsiveFilemanager that allows attackers to upload files without proper authentication through an unknown function in filemanager/dialog.php. This security issue can be exploited remotely, leading to potential unauthorized access or system compromise. Notably, ...

A vulnerability exists in Trippo ResponsiveFilemanager that allows attackers to upload files without proper authentication through an unknown function in filemanager/dialog.php. This security issue can be exploited remotely, leading to potential unauthorized access or system compromise. Notably, ...