Publicly Disclosed
PoC Exploits

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A flaw within Librsvg is triggered when it processes SVG documents containing nested XML inclusions with duplicate entity declarations. This design oversight leads to a use-after-free error, whereby an XML entity that is still actively utilized by the parser is erroneously freed. This vulnerabili...

The Customer Email Verification for WooCommerce plugin is susceptible to a privilege escalation vulnerability due to improper use of activation codes. In versions up to and including 3.3.0, an attacker can exploit the `alg_wc_ev_verify_email` parameter alongside a misconfigured 'Encoding method' ...

The Wheels product version 4.1.2 is vulnerable to SQL injection attacks due to improper handling of request data in inline-literal paths. This vulnerability is particularly present when backslash escaping is enabled in MySQL/MariaDB configurations, allowing an attacker to manipulate queries by ex...

Frappe HRMS versions 14.x up to 14.38.2, 15.x up to 15.64.0, and 16.x up to 16.18.0 are susceptible to a SQL injection vulnerability that arises due to insufficient input validation. This flaw enables an attacker with authenticated access, even with limited privileges, to exploit specific endpoin...

The Squeeze WordPress plugin prior to version 1.8.1 has a serious flaw that lacks proper capability checks on specific AJAX actions. This oversight allows authenticated users with minimal roles, such as Subscribers, the ability to manipulate attachments. Specifically, they can revert any attachme...

The MAIO WordPress plugin, when deployed in versions earlier than 7.3.22, suffers from a flaw that permits unauthorized users to access its analytics data. This vulnerability arises from the plugin's failure to adequately restrict access, allowing an attacker to leverage a hardcoded API key in th...

A vulnerability exists in the Linux kernel's vsock/virtio implementation regarding zerocopy completion for multi-segment sends. If a large message is fragmented into multiple skbs, only the last skb has the zerocopy user argument (uarg) allocated, leaving non-final skbs with pinned user pages tha...

A vulnerability in the Linux kernel has been identified which affects the BPF Just-In-Time (JIT) allocation. The issue involves a potential exploitation vector related to JIT spraying while mitigating the Spectre version 2 attack. To enhance security, the introduction of an Indirect Branch Predic...

A flaw exists in the cifs-utils, enabling a local user to perform privilege escalation. This vulnerability occurs when a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file. The lack of proper input sanitization allows unauthorized mount o...

The Smush plugin for WordPress, prior to version 4.3.4, has an access control vulnerability that permits individual site administrators within a multisite network to modify settings that should be restricted to network administrators. This misuse of access permissions could potentially lead to un...

The OTP Login & Register WooCommerce plugin for WordPress, prior to version 2.7.3, is susceptible to a brute-force attack due to inadequate limitations on one-time-password verification attempts. This is a critical flaw as it allows an unauthenticated attacker to manipulate the attempt limit by s...

The Affiliate Toolkit WordPress plugin, prior to version 3.8.9, has a critical flaw where user-inputted sort values are not validated against an allowlist prior to their use in database queries. This oversight undermines security, permitting users with editor-level access and higher to execute SQ...

The WooCommerce plugin for WordPress prior to version 3.3.2 is susceptible to a security issue where it fails to perform appropriate capability checks during its calendar view AJAX actions. As a result, users with relatively low privileges, such as those assigned the Contributor role, can access ...

The Salon Booking System plugin prior to version 10.31.3 has a vulnerability that permits any authenticated user, including subscribers, to access endpoints of the booking REST API without proper authorization. This oversight allows these users to view all customer bookings and associated persona...

The Salon Booking System plugin for WordPress prior to version 10.31.9 includes a vulnerability that compromises the integrity of REST API request verification. This issue arises from the plugin's failure to adequately authenticate requests, as it neglects to implement WordPress's nonce verificat...

The Salon Booking System plugin for WordPress versions prior to 10.31.9 contains a security flaw that stems from the insecure generation of booking-API access tokens. The tokens are derived from a hardcoded value within the plugin combined with the timestamp of their issuance, rather than from a ...

The Salon Booking System WordPress plugin prior to version 10.31.9 is susceptible to an authorization bypass vulnerability. This flaw allows unauthenticated attackers to create bookings under any user’s name, modify stored contact information, and change booking statuses to paid or confirmed, all...

The MB Custom Post Types & Custom Taxonomies plugin for WordPress prior to version 2.12.2 is susceptible to a vulnerability that permits authenticated users, even those with minimal permissions such as subscribers, to execute uncontrolled migration actions. This can result in the creation of publ...

The Mobile Builder WordPress plugin prior to version 1.4.2 has a significant vulnerability due to the improper sanitization and escaping of a parameter in its SQL statements. This flaw enables unauthenticated users to execute SQL injection attacks, compromising the integrity of the database on si...

The Document Gallery WordPress plugin prior to version 5.1.1 lacks essential capability and ownership checks, enabling unauthorized users to generate galleries on demand. This vulnerability permits these users to disclose sensitive information, such as titles, descriptions, and direct URLs of med...

The Visual Form Builder plugin for WordPress versions up to 3.1 lacks proper authorization and nonce validation when users attempt to reorder form fields. This security oversight enables any authenticated user, including those with Subscriber roles, to modify the structure of forms on the site. S...

The Visual Form Builder WordPress plugin prior to version 3.1 lacks necessary authorization checks, enabling any authenticated user from Subscriber level and above to access recent form submissions displayed in a dashboard widget. This loophole can lead to unauthorized disclosure of sensitive use...

The Coinsnap Bitcoin Crowdfunding WordPress plugin, up to version 1.2.0, contains an access control vulnerability that fails to adequately restrict access to the secret key used for authenticating its payment gateway webhook. This oversight allows unauthorized users to access sensitive informatio...

The WX Subscribe WordPress plugin, through version 1.2.1, contains a vulnerability due to improper sanitization and escaping of input parameters before processing them in SQL statements. This flaw allows unauthenticated attackers to exploit the vulnerability to perform SQL injection attacks, part...

The Subscribe to Comments Plugin for WordPress, before version 2.3.3, suffers from a serious cookie validation flaw. This vulnerability allows unauthenticated attackers to exploit the lack of signing or validation on a trusted cookie used to identify commenters. As a result, an attacker can poten...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A vulnerability exists in the Neterbit NW-431F embedded web server that allows an attacker to remotely access sensitive information by exploiting an insecure function in the /sms.json file. This manipulation could lead to unauthorized data exposure, compromising user privacy while revealing sensi...

A local security flaw has been identified in the AutoBackend Model Loading component of the ImprintLab Medical-SAM-Adapter. Specifically, the issue lies within the function session.get_modelmeta.custom_metadata_map in the file models/MobileSAMv2/ultralytics/nn/autobackend.py. The vulnerability ar...

A vulnerability exists in the bitcoinj Payment Request Handler, specifically in the url.openConnection function within PaymentSession.java. This flaw enables an attacker to manipulate the pki_type argument, potentially leading to server-side request forgery. Remote exploitation is possible, and a...

A vulnerability in the Linux kernel related to posix CPU timers can lead to a use-after-free condition due to a race in non-leader exec() scenarios. When a timer associated with a process is deleted while concurrently executing an exec() command, it can cause access to freed memory. Specifically,...

Aureus ERP versions up to 1.6.0 have a stored cross-site scripting vulnerability found in the HolidayAction.php file. This issue arises when authenticated users are able to input unescaped holiday names, which are then rendered as HtmlString. Attackers who are authorized to create Public Holidays...

The Jooan JA-A12 IP cameras with specific firmware versions are vulnerable to a remote code execution issue that enables attackers to gain unauthorized control. By exploiting hard-coded credentials, unauthorized users can send crafted requests to the device, triggering the jooandiag daemon to exe...

A significant vulnerability in Ivanti Connect Secure version 22.8R2.4 allows attackers to exploit issues in the way DSCache configuration data is handled by the dsinvoked broker. This flaw can lead to unauthorized privilege escalation to root level. Exploits for this vulnerability have already be...

MaxKB, an open-source AI assistant designed for enterprise use, is susceptible to a command injection vulnerability in versions prior to 2.10.5-lts. This flaw arises from the misuse of the SandboxShellBackend, which improperly exposes an execute shell tool and neglects to implement necessary secu...

A cryptographic vulnerability identified in Qualcomm products permits the unauthorized modification of partition table entries, potentially altering the boot flow. This flaw compromises the integrity of the device's boot process, leading to the risk of malicious modifications and unauthorized sys...

LightLLM version 1.2.0 presents a denial of service vulnerability that enables unauthenticated attackers to disrupt the inference worker. By sending a carefully crafted request to the /generate endpoint that includes the internal pd_kv_trans_params field, an attacker can trigger a failure in the ...

The libewf product by libyal contains a vulnerability that allows attackers to exploit a heap out-of-bounds read condition in the function libewf_lef_extended_attribute_read_data(). This issue arises due to improper validation of UTF-16 name and value sizes prior to being doubled. By crafting a m...

EarthScope libmseed versions up to 3.5.4 are vulnerable to a heap out-of-bounds read issue in the ms3_detect() function located in parseutils.c. Exploitation of this vulnerability allows attackers to supply a buffer of 40 to 47 bytes, potentially leading to an over-read of up to 8 bytes beyond th...

SoX versions up to 14.4.2 are susceptible to a heap out-of-bounds write vulnerability located in the function lsx_ms_adpcm_block_expand_i() within the file src/adpcm.c. This issue arises from the processing of WAV files with an anomalous samplesPerBlock value in the fmt chunk. Attackers can explo...

libTiMidity versions up to 0.2.8 contain a vulnerability in the init_soundfont() function, located in src/sndfont.c, which can lead to out-of-bounds memory access. This allows attackers to exploit unvalidated SF2 preset header bank and preset values. By crafting a malicious .sf2 file with indexes...

Game Music Emu (libgme) version 0.6.5 is susceptible to a heap out-of-bounds read due to an integer underflow in the AY loader’s get_data function. This flaw allows attackers to craft a ZXAYEMUL file featuring an oversized track table, enabling them to read beyond the intended file buffer. As a r...

OpenJPH, up to version 0.32.0, features a vulnerability in the HTJ2K cleanup-pass decoder that permits an attacker to execute a heap out-of-bounds write. This is achievable by supplying a specially crafted .j2c or .jph codestream with small precinct sizes, leading to memory corruption as the deco...

The libvgm library developed by ValleyBell exhibits a heap out-of-bounds read vulnerability within its PCM data-block decompressor. An attacker can exploit this flaw by crafting a specially designed .vgm file that utilizes a type 0x7F table containing wider compressed values. This manipulation le...

The libsidplayfp library is vulnerable to a heap out-of-bounds read, allowing attackers to manipulate PSID/RSID files by supplying unchecked data offsets. This vulnerability permits attackers to exceed the file size limitations, which enables the resolveAddrs() function to attempt reading up to 6...

A heap out-of-bounds read vulnerability exists in FreeImage (danoli3 fork) versions up to 3.19.23 within the Unpack32Bits() function of the PluginPICT.cpp file. This issue arises because the rowBytes parameter is not validated against the PixMap width, allowing attackers to craft PICT files with ...

Libyal Libesedb through version 20260704 is affected by a heap out-of-bounds read vulnerability within the function libesedb_record_get_multi_value(). This issue allows attackers to read past allocated buffers by exploiting unbounded multi-value offset tables. By supplying a specially crafted ESE...

The ytnef library version 2.1.2 and earlier contains a heap out-of-bounds read vulnerability within the MAPIPrint() function. Attackers can exploit this vulnerability by providing specially crafted winmail.dat files that contain compressed RTF properties lacking a NUL terminator. This can lead to...

The libansilove library versions 1.3.0 through 1.4.2 exhibit a NULL pointer dereference vulnerability within the ansilove_xbin() function. This issue arises when an attacker supplies a specially crafted XBIN file, which can lead to application crashes. Specifically, if the 512-character flag is s...

The libregf library through version 20260526 is susceptible to a heap out-of-bounds read due to improper handling of value data sizes in its function libregf_value_item_read_value_data(). An attacker can create a malicious version 1.0/1.1 REGF hive that, when processed, can lead to the exposure o...