Publicly Disclosed
PoC Exploits

The SourceCodester Drug Recommendation System version 1.0 has a critical security flaw in the User Management component. This vulnerability occurs in the file /drug_recommender/Admin/add_user, where improper handling of user-supplied input allows for cross-site scripting (XSS). Attackers can expl...

A vulnerability has been identified in itsourcecode Leave Management System version 1.0, specifically affecting the /module/department/index.php file. This flaw allows an attacker to manipulate the argument ID, enabling SQL injection attacks that can be executed remotely. The exploit has been mad...

A command injection vulnerability exists in the child_process.exec function of the src/auth/browser.ts file in the nexus_reauth component of the 0-Gaurav-0 nexus-mcp tool. This flaw allows an attacker to manipulate the argument URL to execute arbitrary commands remotely. Given that the product em...

A security vulnerability has been identified in the decode_bmp_pixel_data function of the BMPLoader component within SerenityOS's LibGfx library. This issue arises from an integer overflow caused by manipulation of the height argument during image processing. An attacker could exploit this vulner...

A vulnerability has been identified in the Mealie Recipes software in versions up to 3.25.1. This issue resides in the payload.model_dump function found in the controller_group_recipe_actions.py file. By manipulating the argument URL, an attacker can execute server-side request forgery attacks, w...

A security flaw has been identified in the SourceCodester Drug Recommendation System version 1.0, particularly affecting the /drug_recommender/Admin/add_symptom file. The vulnerability arises from improper handling of the 'txtname' argument, allowing attackers to inject malicious scripts, thereby...

A security flaw exists in the SourceCodester Drug Recommendation System 1.0 which allows an attacker to manipulate the argument ID in the /drug_recommender/Admin/edit_user.php file. This leads to SQL injection attacks that can be executed remotely. The availability of public exploits increases th...

A stack-based buffer overflow vulnerability has been identified in the Comfast CF-N1-S 2.6.0.1, specifically within the function get_css_path_from_uri located in the /cgi-bin/mbox-config file of its Web Management Interface. This vulnerability may allow attackers to execute remote exploits, poten...

A security flaw has been discovered in the SourceCodester Drug Recommendation System version 1.0, specifically in the file /Admin/edit_symptom.php. This vulnerability allows an attacker to manipulate the 'ID' argument, leading to SQL injection attacks. Such an exploit can be executed remotely, th...

A vulnerability in the Admin Login Form of the Internship Management System 1.0 allows unauthorized users to manipulate the Password argument in the /admin/login.php file. This manipulation can lead to SQL injection attacks, potentially exposing sensitive data or allowing an attacker to control t...

A security flaw has been identified in the Internship Management System version 1.0 developed by Code-Projects. This vulnerability resides in the login functionality located in the /employer/login.php file. By manipulating the Password parameter during login attempts, an attacker can execute SQL ...

A security vulnerability has been identified in the Internship Management System 1.0, specifically within the login.php file. This issue allows attackers to execute SQL injection attacks by manipulating the password argument. The exploit can be executed remotely, making it an accessible threat fo...

A cross-site scripting vulnerability exists in Code-Projects' Assessment Management version 1.0, specifically affecting the 'lecturer/add-single-mark.php' file. An attacker can manipulate the 'mark' argument to execute malicious scripts in the context of the user's session. This vulnerability all...

A cross-site scripting vulnerability has been identified in the code-projects Assessment Management application, specifically in the admin/add-user.php file. The vulnerability arises from improper handling of the 'level' parameter, allowing attackers to execute malicious scripts in the context of...

A cross-site scripting vulnerability has been identified in the Code-Projects Assessment Management application version 1.0, affecting the User Editing component. Specifically, the issue arises from the manipulation of parameters such as name, sname, email, username, password, and id within the a...

The SourceCodester Online Reviewer Management System 1.0 contains a SQL injection vulnerability within the file /reviewer_0/admins/assessments/databank/btn_functions.php. By manipulating the ID parameter in a specific request, an attacker can execute arbitrary SQL commands, potentially compromisi...

A vulnerability exists in the SourceCodester Online Reviewer Management System 1.0, specifically in the /reviewer_0/admins/assessments/subject/btn_functions.php file. This vulnerability allows an attacker to manipulate the 'ID' parameter during a remote request, resulting in SQL injection. The ex...

A security vulnerability has been identified within SourceCodester's Online Reviewer Management System version 1.0, specifically in the btn_functions.php file located in the /reviewer_0/admins/assessments/course/ directory. This vulnerability allows for SQL injection through manipulation of the c...

The Meow Gallery plugin for WordPress prior to version 5.5.5 lacks sufficient checks on user capabilities, allowing authenticated users with Author-level access or higher to view sensitive information. This includes titles, authors, dates, and statuses of other users' draft and private posts, pot...

The Sign-up Sheets WordPress plugin prior to version 2.4.0 contains a vulnerability where the CSRF nonce, which is essential for securing sign-up deletions, is not properly validated. This oversight allows attackers to exploit the system by sending forged requests through the session of a logged-...

The Meow Gallery WordPress plugin prior to version 5.5.5 is susceptible to improper input sanitization. An unauthenticated attacker can inject malicious payloads into shortcodes via user-supplied values. This allows them to execute arbitrary shortcodes and potentially expose sensitive gallery con...

The Import and Export Users and Customers plugin for WordPress prior to version 2.5.2 is susceptible to a user role elevation flaw. This vulnerability allows users with limited permissions, specifically those only assigned the 'create_users' capability, to alter the roles of existing users as wel...

The TikTok WordPress Plugin prior to version 1.4.2 exhibits a critical authorization oversight that enables any user to redeem a sign-in code directly through the URL without proper verification. This flaw allows unauthorized visitors to interact with the advertising platform using the site's cre...

A significant flaw in the Import and Export Users and Customers plugin for WordPress allows users with limited capabilities to manipulate user roles. Specifically, versions prior to 2.5.2 do not properly enforce the promote_users capability during CSV imports, enabling individuals with only the c...

The Tripzzy WordPress plugin prior to version 1.5.1 lacks essential capability and ownership checks for its booking management functionalities. As a result, these actions are mistakenly accessible to unauthenticated users. The plugin generates a token for any visitor, which can potentially be exp...

The Forminator Forms plugin prior to version 1.57.2.1 contains a significant vulnerability related to role validation. When a registration form is embedded within an imported quiz, the plugin fails to consistently enforce role validation. This flaw allows an individual importing quizzes to publis...

The Tripzzy WordPress plugin lacks proper authorization checks, allowing unauthenticated users to access an AJAX action. This security flaw enables malicious actors to permanently delete arbitrary comments from a website, posing a significant risk to content integrity and site management.

The Forminator Forms WordPress plugin prior to version 1.57.2.1 allows privileged users to instantiate arbitrary classes by deserializing values from XML-RPC requests. This issue can lead to arbitrary code execution, as it permits these users, typically even those below the administrator level, t...

The SAML Single Sign On WordPress plugin prior to version 6.0.0 fails to respect the configured criteria for linking incoming single sign-on identities to WordPress accounts. Instead, it always resolves the identity using the login name specified by the site. This flaw allows an attacker, capable...

The Photo Gallery, Sliders, Proofing plugin for WordPress prior to version 4.5.0 fails to properly validate user permissions when managing images within galleries. This vulnerability allows users who are granted gallery-management capabilities by an administrator to manipulate images across galle...

The Unlimited Elements For Elementor plugin for WordPress prior to version 2.0.20 suffers from a serious security flaw due to inadequate capability checks on an AJAX action, allowing authenticated attackers with minimal privileges, such as subscriber-level access, to inject arbitrary PHP objects ...

The Kirki WordPress plugin prior to version 6.3.1 contains a vulnerability that permits unauthorized upload of unvalidated SVG files. This flaw allows users with author-level access and higher to upload SVGs that include embedded JavaScript, which is then served from the site's origin. As a resul...

The Photo Gallery and Sliders plugin for WordPress prior to version 4.5.0 has a critical access control vulnerability. This issue arises when the plugin fails to verify whether users possess the necessary options capability before applying changes to image sizing settings. As a result, users who ...

The Photo Gallery, Sliders, and Proofing plugin for WordPress, prior to version 4.5.0, contains a flaw that allows any user with gallery-management capabilities, granted by an administrator, to overwrite the settings of any gallery on the site. This includes the ability to modify critical setting...

The Import and Export Users and Customers plugin for WordPress prior to version 2.4.5 lacks proper validation for user-supplied URLs during server-side requests for CSV imports. This oversight allows high-privileged users to perform Server-Side Request Forgery (SSRF) attacks, potentially leading ...

The Master Slider plugin for WordPress, up to version 3.11.2, contains a vulnerability due to improper sanitization and escaping of shortcode attributes. This weakness permits users with the Contributor role and above to execute Stored Cross-Site Scripting (XSS) attacks when an affected post is v...

The Photo Gallery, Sliders, Proofing WordPress plugin prior to version 4.5.0 lacks proper access control, allowing users with Contributor roles and above to access metadata for images stored on the site. This security flaw permits them to read sensitive EXIF data, such as camera make, model, and ...

The Photo Gallery, Sliders, and Proofing WordPress plugin prior to version 4.5.0 contains a significant flaw in its handling of file extensions from uploaded archives. A programming oversight, where a loop counter variable is reused, causes the file extension check to always succeed. This vulnera...

A vulnerability in NginxProxyManager versions up to 2.15.1 compromises the internalCertificate.validate function within backend/internal/certificate.js. This flaw allows for remote exploitation, as it enables unauthenticated attackers to process and echo submitted certificates without proper auth...

The Forminator Forms plugin for WordPress enables arbitrary shortcode execution when users can trigger actions without proper validation. This vulnerability affects all versions up to 1.57.2 and allows unauthenticated attackers to exploit the do_shortcode function, posing a significant risk to we...

A security vulnerability has been identified in the itsourcecode Leave Management System version 1.0, specifically in the controller.php file associated with departmental functions. An attacker can exploit this weakness by manipulating the DEPTID argument, enabling remote SQL injection attacks. T...

A vulnerability has been discovered in the Kamailio SIP Server specifically in the CDP Diameter Receiver module, affecting versions up to 5.8.8, 6.0.7, 6.1.4, and the 6.2.0-dev1 branch. The flaw resides in the shm_malloc function located in the source file src/modules/cdp/receiver.c, which can be...

A missing authentication vulnerability has been identified in the Pixelfed application, specifically within the OAuth Scope Handler's instancePeers function. This flaw allows an attacker to manipulate the argument ID, potentially leading to unauthorized access. The issue can be exploited remotely...

OpenIdentityPlatform's OpenAM, an access management solution, is susceptible to a pre-authentication Remote Code Execution vulnerability due to unsafe Java deserialization. This issue arises from the handling of the jato.clientSession HTTP parameter, allowing unauthenticated attackers to execute ...

The Online Reviewer Management System by SourceCodester is found to be vulnerable to SQL injection through improper handling of the 'Course' argument in the btn_functions.php file. This vulnerability allows attackers to execute arbitrary SQL code, potentially leading to unauthorized data access. ...

An authorization flaw exists in JFrog products, where improper validation of refresh token signatures allows non-admin users to acquire a signed administrator token. This vulnerability could lead to unauthorized access and can potentially compromise the integrity of sensitive operations within th...

A vulnerability has been identified in the D-Link R95 BE9500 router, specifically in the file /bin/ssi associated with the DHMAPI component. This issue arises from improper handling of the NTPServer argument, allowing for OS command injection. Exploitation of this vulnerability can occur remotely...

QloApps version 1.7.0 contains a path traversal vulnerability in the 'getEmailHTML' function of admin/ajax.php. This issue allows authenticated back-office users to perform unauthorized operations by supplying relative path sequences through the email parameter. As a result, attackers can bypass ...

A vulnerability in grimmory-tools' Download Endpoint allows an attacker to bypass authorization controls via manipulation of the bookId argument in the streamFileToResponse function of KoboController.java. This exploit can be initiated remotely, potentially exposing sensitive data or services to ...

The Concrete CMS Community Store prior to version 2.7.8 is vulnerable to a stored XSS issue where customer-supplied data in order fields, such as billing name, email, and phone number, is not properly sanitized. This flaw enables unauthenticated attackers to inject malicious scripts that execute ...