Publicly Disclosed
PoC Exploits

The Advanced Custom Fields: Extended and Extended PRO plugins for WordPress versions 0.9.2.4 to 0.9.2.7 have a vulnerability that arises from inconsistent disabling of shortcode processing in confirmation messages of front-end forms. This flaw exposes the server to arbitrary shortcode execution b...

The Profile Builder plugin for WordPress versions 4.0.0 to 4.0.4 has a significant security vulnerability that allows authenticated users to bypass the reCAPTCHA verification process designed to protect comment submissions. This flaw means that even if an administrator has implemented anti-spam m...

A vulnerability exists in the multer middleware used for handling multipart/form-data file uploads in Node.js. Specifically, in versions ranging from 2.0.0 up to 2.4.0, a misconfiguration with an asynchronous fileFilter can lead to a crash of the Node.js process. If a file upload request is abort...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

An integer overflow vulnerability exists in GitLab CE/EE that may allow an unauthenticated attacker to execute arbitrary code on the GitLab server. This issue affects all versions from 7.0 prior to 18.11.13, 19.0 prior to 19.0.10, and other specified versions up to 19.5.1. The exploitation arises...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The Advanced Custom Fields: Extended WordPress plugin lacks capability checks during post updates via front-end form actions. This oversight allows unauthenticated users to overwrite existing posts, including critical field definition storage, which risks arbitrary code execution on the server. T...

The Advanced Custom Fields: Extended plugin for WordPress prior to version 0.9.2.8 is susceptible to an arbitrary script execution vulnerability. This arises from improper validation and escaping of form shortcode attributes, allowing users with minimal privileges, such as a contributor, to injec...

A vulnerability in the Advanced Custom Fields: Extended and Extended PRO plugins for WordPress could allow unauthenticated users to bypass security measures, potentially enabling them to take control of the site administrator's account. This issue arises from inconsistent handling of update-user ...

The Advanced Custom Fields: Extended and Extended PRO plugins for WordPress prior to version 0.9.2.8 are susceptible to an authentication bypass error. This vulnerability allows unauthenticated users to exploit the front-end Forms module by modifying user account credentials of non-administrator ...

The LiteSpeed Cache plugin for WordPress, prior to version 7.9.2, features a significant security flaw where it fails to properly validate user capabilities when dismissing admin notices. This vulnerability allows low-privileged authenticated users, such as subscribers, to dismiss notices marked ...

The LiteSpeed Cache plugin for WordPress prior to version 7.9.2 contains a flaw that allows unauthenticated users to exploit an HTML rewriting routine. This vulnerability does not properly restrict its actions, enabling malicious users to inject arbitrary attributes that execute JavaScript within...

A vulnerability exists in the LiteSpeed Cache plugin for WordPress prior to version 7.9.2, which fails to restrict an HTML optimization routine to stylesheet content. This oversight allows for the deletion of closing markup attributes in the rendered output. When paired with unescaped output from...

The User Profile Builder plugin for WordPress, prior to version 4.0.5, is susceptible to a stored Cross-Site Scripting (XSS) vulnerability. This issue stems from improper sanitization and escaping of a shortcode attribute in redirect messages. Consequently, users with minimal privileges (as low a...

The Depicter – Popup & Slider Builder WordPress plugin versions prior to 4.8.2 exhibit a flaw in the file upload functionality. The plugin inadequately validates file uploads via its editor media-upload endpoint, relying solely on the client-reported MIME type and an improperly configured check f...

The Popup Builder plugin for WordPress prior to version 4.4.6 contains a security flaw that permits unauthorized users to bypass authorization checks during a maintenance routine. This vulnerability enables unauthenticated attackers to manipulate and delete popup content, as well as overwrite vit...

The User Profile Builder plugin for WordPress, prior to version 4.0.5, contains a flaw in its front-end Edit Profile form. This vulnerability fails to adequately verify user authorization when editing account details. An Administrator on a Multisite subsite can exploit this issue to change the em...

The Download Monitor plugin for WordPress, prior to version 5.3.5, features an improper access control vulnerability that allows subsite administrators on multisite installations to manage a list of filesystem locations. This misconfiguration grants untrusted users the ability to approve arbitrar...

The Otter Blocks plugin for WordPress, prior to version 3.2.8, is susceptible to a stored Cross-Site Scripting (XSS) vulnerability. This issue arises from improper bounding of a pattern utilized to rewrite dynamic-content tokens during block rendering. As a result, an attacker could inject unesca...

The Essential Addons for Elementor plugin for WordPress prior to version 6.8.7 lacks adequate verification for user account management, specifically concerning its login-approval feature. This oversight allows a subsite administrator within a WordPress Multisite setup to manipulate the approval a...

The Speed Optimizer plugin for WordPress, prior to version 7.8.5, has a significant flaw that fails to verify network-level privileges before allowing option modifications across the multisite network. This allows a regular site administrator, lacking Super Admin status, to alter or overwrite cri...

The Speed Optimizer WordPress plugin prior to version 7.8.5 is susceptible to a Stored Cross-Site Scripting vulnerability due to the failure to properly sanitize or escape certain settings before rendering them in the head section of front-end pages. This flaw can potentially allow high-privilege...

The Essential Addons for Elementor plugin for WordPress prior to version 6.8.7 is susceptible to an HTML tag injection vulnerability. This issue arises because the plugin fails to validate the HTML tag settings used by several widgets. Consequently, users with author privileges or higher can inje...

The Otter Blocks plugin for WordPress prior to version 3.2.8 is susceptible to a script injection vulnerability due to improper sanitization and escaping of user-supplied block styling values in inline stylesheets. This flaw enables users with contributor-level access and higher to inject arbitra...

The Otter Blocks WordPress plugin, prior to version 3.2.8, fails to properly enforce block visibility conditions when rendering published posts via the WordPress REST API. This oversight allows unauthenticated users to access content that should be restricted to specific user roles, such as site ...

The Otter Blocks WordPress plugin, prior to version 3.2.8, has a critical flaw in its REST API endpoint functionality. It fails to properly verify the visibility status of posts, leading to exposure of sensitive content. This includes manual excerpts from password-protected posts, the content of ...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The Google Agent Development Kit (ADK) has a significant vulnerability due to missing origin validation in WebSockets and a permissive cross-domain policy. This flaw allows unauthorized remote access by an attacker to a locally running agent on the developer's machine through a malicious web page...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

This vulnerability affects multiple configurations of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. It allows unauthenticated attackers with network access to compromise these platforms via various protocols. Successful exploitation can lead to unauthorized creation, deletion, ...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability in PHP allows for the possibility of remote code execution due to improper management of global state that can reference freed memory. In certain scenarios, the global state retains stale information from previous requests, potentially enabling an attacker to execute arbitrary cod...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...