Publicly Disclosed
PoC Exploits

The vulnerability in iTerm2 affects versions prior to 3.7.7beta2 and is characterized by an argument injection flaw in the x-man-page URL handler. An attacker can exploit this vulnerability by convincing a user to open a specially crafted URL, which allows the execution of arbitrary commands usin...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

The Event Tickets with Ticket Scanner WordPress plugin fails to adequately escape user input when executing SQL queries in its admin interface. This flaw permits authenticated users—typically admins or those granted specific permissions—to conduct SQL injection attacks, potentially leading to una...

The iLeads SMS Gateway plugin for WordPress, prior to version 2.0.0, contains a vulnerability due to insufficient validation for AJAX actions that update site options. This oversight allows any authenticated user, including subscribers, to manipulate WordPress settings without appropriate permiss...

The Komfortkasse for WooCommerce plugin prior to version 1.4.9 is susceptible to an authentication bypass flaw. This vulnerability allows attackers to forge REST API requests without proper nonce verification, effectively bypassing WordPress's standard security measures. Consequently, a malicious...

The Event Tickets with Ticket Scanner plugin for WordPress prior to version 3.1.14 has a significant vulnerability where it fails to validate a user's permissions concerning WooCommerce orders. This oversight allows users with various roles, including those without administrative privileges, to a...

The Add From Server Lite plugin for WordPress has a vulnerability that allows users with the Author role and higher to upload SVG files without restrictions. This weakness can enable potential attackers to embed JavaScript code within these files, leading to Stored Cross-Site Scripting (XSS) atta...

The Fiber Admin plugin for WordPress prior to version 4.0.1 is susceptible to an authorization bypass vulnerability. This flaw allows unauthenticated users to manipulate the ordering of posts, including drafts and private content, as well as navigation menu items. Furthermore, if term ordering is...

The Magic Link WordPress plugin, prior to version 2.2.6, is susceptible to an authentication bypass vulnerability, permitting any authenticated user to generate login links for other accounts without proper authorization. This flaw allows less privileged users, such as subscribers, to create vali...

The Fiber Admin plugin for WordPress, prior to version 4.0.1, is vulnerable due to improper validation and escaping of request headers. This flaw allows unauthenticated attackers to exploit the system by injecting arbitrary code into a PHP file during a process where a custom database error page ...

The Directorist plugin for WordPress, specifically prior to version 8.11, is vulnerable due to a lack of verification processes for its checkout payment-retry REST action. This flaw allows any authenticated user, including those with minimal privileges like subscribers, to create payment-attempt ...

The Tournamatch WordPress plugin prior to version 4.7.1 lacks proper validation of file paths when users upload new profile or team images. This oversight allows even users with minimal permissions, such as Subscribers, to delete arbitrary files from the server. This includes critical files like ...

The Live Composer plugin for WordPress prior to version 2.1.23 is vulnerable to a stored Cross-Site Scripting (XSS) attack. The vulnerability arises due to the lack of proper escaping of pagination settings supplied through shortcodes in its post-listing module. This weakness permits users with C...

The Tournamatch WordPress plugin prior to version 4.7.1 has a flaw in its access control mechanism, which permits unauthenticated users to access the team invitation listing. This vulnerability allows unauthorized individuals to obtain the email addresses of users invited to join various teams, t...

The Directorist plugin for WordPress, prior to version 8.11, contains a vulnerability that permits authenticated attackers with at least Subscriber-level access to retrieve confidential metadata of another user's unpublished draft listings. This weakness arises from inadequate user ownership veri...

The Directorist plugin for WordPress prior to version 8.11 contains a significant access control vulnerability. This flaw allows authenticated users with Subscriber-level roles and higher to exploit the plugin's features. Specifically, the vulnerability arises from insufficient verification of at...

The Directorist plugin for WordPress is vulnerable due to improper verification of user ownership for listings. An authenticated user, including subscribers, has the ability to publish and promote another user's pending listings without consent if the featured listing fee is set to zero. This fla...

The Directorist plugin for WordPress, specifically versions prior to 8.11, contains a vulnerability that fails to properly authenticate the ownership of payment receipts by users. This oversight permits any authenticated user, including subscribers, to access and disclose sensitive information re...

The Directorist plugin prior to version 8.11 for WordPress has a vulnerability that allows unauthorized users to manipulate email-verification processes in a multisite environment. This flaw enables an administrator from one site in the network to lock out users from other sites, including the ne...

The Advanced Custom Fields (ACF) WordPress plugin prior to version 6.8.11 fails to appropriately verify user permissions when editing target objects during bidirectional relationship synchronization. This oversight permits users with contributor-level access and above to manipulate relationships ...

The Advanced Custom Fields (ACF) plugin for WordPress prior to version 6.8.11 presents an access control vulnerability that enables users with contributor-level access and higher to manipulate custom fields typically reserved for administrators. This is achieved by bypassing the expected location...

The Live Composer WordPress plugin prior to version 2.1.23 lacks proper sanitization and escaping for its custom post type slug settings. This flaw can enable high privilege users, such as administrators, to execute Stored Cross-Site Scripting attacks, even in environments where the unfiltered_ht...

The WP Google Review Slider plugin for WordPress does not implement nonce validation when updating the active Google Places configuration. This lack of validation allows malicious actors to send forged requests that can alter or remove the site's Google Places settings, potentially leading to una...

The FV Flowplayer Video Player plugin for WordPress possesses a vulnerability that allows unauthenticated users to inject malicious scripts into comments. This occurs when shortcode attributes are not properly escaped before being rendered in the media player's markup. If the comment-shortcode-pa...

The Advanced Custom Fields (ACF®) WordPress plugin prior to version 6.8.11 lacks a crucial read-permission check when rendering relational field values. This flaw allows users with post-editing permissions, such as Contributors and higher, to inadvertently expose titles and private statuses of un...

Adobe Commerce is vulnerable to an unrestricted file upload issue that may allow an attacker to upload files of potentially harmful types, leading to arbitrary code execution within the context of the current user. This security weakness can be exploited through user interaction, such as visiting...

The Erlang/OTP SSH server prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20 contains a critical flaw in SSH protocol message handling that allows attackers to bypass authentication and execute arbitrary commands remotely. This vulnerability can be exploited to gain unauthorized acces...

A vulnerability in GitLab's CI/CD configuration could permit an unauthenticated attacker to execute arbitrary code on the server. This exploit arises from insufficient validation of a specially crafted regular expression. Affected versions include GitLab CE/EE 19.2 prior to 19.2.8, 19.3 prior to ...

An exploitable network access vulnerability exists in the MySQL Connectors product of Oracle MySQL (Connector/J version 26.7.0). This vulnerability can be triggered by an unauthenticated attacker with network access, requiring human interaction from another user to successfully execute an attack....

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

A vulnerability in Privoxy versions prior to 3.0.22 allows remote attackers to exploit certain unspecified vectors and deplete file descriptors, potentially leading to a denial of service. This incident can severely disrupt the functionality of the affected application, rendering it unresponsive ...

The out-of-bounds read vulnerability in Windows Paint enables unauthorized attackers to potentially execute arbitrary code within a network context. This flaw could allow malicious entities to manipulate the application, leading to unauthorized actions being performed on affected systems. Users a...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) b...

The Rust Programming Language Standard Library versions 1.29.0, 1.28.0, and earlier versions contain a vulnerability where an integer overflow can lead to a buffer overflow. This issue can be triggered through calls to the str::repeat function with a large argument, which may overflow an internal...

A race condition exists in the Linux kernel that allows local users to gain elevated privileges. By exploiting improper handling of copy-on-write (COW) memory mappings, an attacker could modify files that are meant to be read-only. This vulnerability, known as 'Dirty COW', was notably used in att...

The Expat library, also known as libexpat, versions prior to 2.4.5 contain a vulnerability that allows attackers to insert namespace-separator characters into namespace URIs. This attack vector can lead to various security issues, such as XML parsing attacks, which could compromise the integrity ...

A vulnerability in systemd-tmpfiles permits local users to breach access restrictions by manipulating file ownership and permissions, even when the fs.protected_hardlinks sysctl setting is disabled. This flaw can potentially allow users to change the ownership of critical system files, such as /e...

In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected funct...

A significant vulnerability has been identified in OpenBMB's Internet of Agents, specifically within the Agent Registry component. The flaw resides in the method _primary_field_query of the file common/utils/milvus_utils.py. It involves improper neutralization of special elements in data query lo...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A vulnerability exists in nexmoe VidBee affecting versions up to 1.3.13 and 2.0.2, specifically within an unknown function in the Local HTTP Service component. This weakness allows unauthorized access, potentially leading to sensitive information exposure through remote manipulation. Publicly ava...

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with...

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

The Zip implementation within Rust's standard library, prior to version 1.52.0, contains a flaw that can manifest as an integer overflow when processing Zip file sizes. This can result in the library returning an erroneous size, which may ultimately lead to a buffer overflow vulnerability if a Zi...

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...