Publicly Disclosed
PoC Exploits

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

The Rclone tool, designed for file synchronization with various cloud storage systems, has a vulnerability stemming from the unsecured RC endpoint `operations/fsinfo`. In versions 1.48.0 through 1.73.4, this endpoint allows unauthenticated attackers to send controlled `fs` input, which can instan...

A vulnerability has been discovered in the Wavlink WL-NU516U1 device, specifically affecting the function ftext located in the /cgi-bin/nas.cgi file. This issue arises due to improper handling of the Content-Length argument, leading to a stack-based buffer overflow. Attackers can exploit this vul...

The Calendar Plugin for WordPress prior to version 1.3.18 is susceptible to Cross-Site Scripting (XSS) attacks due to inadequate escaping of user inputs. Specifically, the plugin fails to properly escape event fields submitted by users, which are then displayed in HTML attributes without sufficie...

The BookingPress Appointment Booking Pro plugin for WordPress prior to version 5.7.3 contains a vulnerability that fails to properly enforce REST API authentication. As a result, this oversight allows unauthenticated attackers to gain access to sensitive customer booking data and make unauthorize...

The Quiz and Survey Master plugin for WordPress, prior to version 11.1.3, suffers from a vulnerability that allows unauthenticated attackers to perform username enumeration and brute-force attacks. The plugin lacks appropriate rate limiting and fails to log unsuccessful login attempts effectively...

The FacturaONE plugin for WooCommerce prior to version 5.37 holds a critical security flaw that lacks proper authentication mechanisms for one of its request handlers. This oversight stems from a default empty cryptographic key, exposing the plugin to unauthenticated attackers. Such attackers can...

The User Frontend plugin for WordPress prior to version 4.3.8 contains a flaw that allows unauthorized users to delete attachments without proper verification of ownership. This flaw can be exploited by unauthenticated attackers, enabling them to permanently remove media uploaded by users without...

The Contact Form 7 plugin for WordPress prior to version 2.5 fails to properly validate the host of user-provided return URLs. This oversight allows an attacker to craft malicious links that redirect users to arbitrary external sites during the success or cancel phase of a Stripe checkout process...

The Download Manager plugin for WordPress, prior to version 3.3.62, contains a flaw that allows generated download tokens to remain valid across multiple sessions without proper expiration. This oversight permits an unauthorized user to exploit a leaked download token and access role- or password...

The Smart Manager plugin for WordPress versions prior to 8.92.0 contains a cross-site scripting vulnerability due to improper encoding of a post field before rendering it into an HTML attribute. This flaw allows users with the Contributor role or higher to inject malicious JavaScript code. When a...

The Sina Extension for Elementor, a WordPress plugin, has a Cross-Site Scripting (XSS) vulnerability due to improper escaping of values reconstructed from user input in its unauthenticated AJAX handlers. This flaw allows unauthenticated attackers to inject and execute arbitrary JavaScript code in...

The MPG WordPress plugin prior to version 4.1.8 is susceptible to a reflected cross-site scripting vulnerability. Due to improper sanitization and escaping of a specific parameter, unauthenticated attackers can exploit this flaw by crafting a malicious request. When a victim interacts with this r...

The WPBot WordPress plugin, prior to version 8.5.2, is susceptible to SQL injection due to the failure to validate administrator-configured field identifiers before their use in SQL queries. This allows administrators, if compromised, to craft queries that can be executed when a visitor makes a s...

The 微信二维码登陆 plugin for WordPress versions up to 1.3 contains a security flaw that permits unauthorized access through weak validation of webhook requests. The plugin's signature verification fails, allowing an attacker to simulate a login event for any existing user by intercepting the webhook re...

The Simply Schedule Appointments WordPress plugin contains a vulnerability that allows unauthenticated attackers to inject malicious scripts into the notification content field. This is due to a failure in proper sanitization, where a double-encoded payload bypasses filters and is executed when t...

The Realtyna Organic IDX and WPL Real Estate WordPress plugins before version 5.3.0 allow unauthenticated users to upload arbitrary files through a file upload feature that lacks proper validation. This functionality is controlled by an API with hardcoded credentials enabled by default, exposing ...

The Masteriyo LMS plugin for WordPress prior to version 2.3.1 contains a vulnerability that permits unauthenticated attackers to exploit an AJAX action related to user session management. This flawed implementation allows unauthorized users to clear active sessions for any registered user, includ...

The Events Calendar plugin for WordPress prior to version 6.16.5.1 features a security flaw that allows attackers to bypass authorization checks on specific Event Aggregator import REST API routes. This vulnerability can be exploited by unauthenticated users to mark existing import records as fai...

The Clover Payment Gateway for WooCommerce by Zaytech prior to version 1.3.6 contains a significant oversight in its payment verification process. It fails to ensure that an external payment record legitimately corresponds to a WooCommerce order being processed. This flaw allows unauthorized user...

The Custom Fields Account Registration for Woocommerce plugin prior to version 1.4 contains a vulnerability that permits an unauthenticated user to exploit custom registration fields. By setting up a corresponding field name that maps to the user capabilities meta key, an attacker can grant thems...

The Document Gallery plugin for WordPress prior to version 5.1.1 is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability. This flaw arises due to inadequate sanitization and escaping of user input during an unauthenticated AJAX action, allowing attackers to inject malicious scripts...

The MemberGlut WordPress plugin prior to version 1.1.5 contains a vulnerability where the selected role during front-end registration is not properly validated. This flaw permits unauthenticated users to create accounts with arbitrary roles, including that of an administrator. Exploiting this vul...

The Printcart Web to Print Product Designer plugin for WooCommerce prior to version 2.5.3 lacks proper validation of user-supplied URLs, which enables attackers to exploit this flaw and execute arbitrary server-side requests. This vulnerability allows unauthorized users to access sensitive local ...

The MainWP Child plugin for WordPress prior to version 6.1.2 contains a significant flaw that fails to verify the identity of the requester during site-registration requests. When password authentication is disabled for the targeted account, this vulnerability enables an unauthenticated attacker ...

The Advanced Ads plugin for WordPress prior to version 2.0.23 contains a security flaw where a shortcode parameter is not properly sanitized and escaped before being output on the page. This vulnerability allows users with a Contributor role or higher to inject arbitrary web scripts. Such scripts...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability in WordPress allows for potential SQL Injection due to improper sanitization of the author__not_in parameter in WP_Query. When untrusted input is passed to this parameter via a plugin or theme, it could lead to unauthorized database queries. Affected versions include WordPress 6.8...

A vulnerability identified in the SparkJava framework up to version 2.9.4 relates to the `staticFiles.externalLocation` function. This issue allows an attacker to exploit the symlink following behavior within the `ExternalResourceHandler` component. The flaw can be exploited remotely, posing a si...

A vulnerability exists in the mf-yang Openclaw-CN application, specifically within the Browser Control HTTP API. The flaw, located in the clickViaPlaywright function of the agent.act.ts file, allows attackers to carry out server-side request forgery (SSRF) attacks. This means that by manipulating...

A security vulnerability exists in the mf-yang openclaw-cn software, specifically in the function assertBrowserNavigationAllowed within the Scheme Handler component. This flaw can potentially lead to information disclosure when the argument 'url' is manipulated. The issue can be exploited remotel...

The GNU Inetutils telnet daemon (telnetd) is vulnerable to a remote authentication bypass that can occur when an attacker manipulates the USER environment variable by specifying a '-f root' value. This flaw allows unauthorized users to gain access without proper authentication. Affected users sho...

A flaw in the function handleAddMcpServer of NanoClaw, specifically in the file src/modules/self-mod/request.ts, allows for improper authorization. This vulnerability enables attackers to potentially manipulate access controls, leading to unauthorized actions. The vulnerability is remotely exploi...

A vulnerability exists in the NanoClaw product by Nanocoai, specifically impacting the `createChatSdkBridge.setup` function within the `src/channels/chat-sdk-bridge.ts` file of the MCP Server Approval component. This flaw allows for unauthorized actions due to improper access control measures, ma...

A command injection vulnerability exists in Microsoft Bing Images that allows unauthorized attackers to execute arbitrary code over a network. This weakness arises from improper handling of special elements in commands, potentially exposing sensitive data or system integrity to exploitation. User...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...

A security issue has been identified in NousResearch's hermes-agent, specifically within the SimpleX Gateway Authorization component. The vulnerability arises from the improper handling of the contactId argument in the file hermes-agent/plugins/platforms/simplex/adapter.py. This flaw may allow un...

A vulnerability in Oracle WebLogic Server's Core component permits low-privileged attackers with network access to exploit SAML, potentially compromising the server's functionality. This can lead to unauthorized access, impacting not only the WebLogic Server but also additional interconnected pro...

A remote code execution vulnerability exists in fastjson versions 1.2.68 to 1.2.83, allowing attackers to execute arbitrary code remotely without the need for AutoType enablement or classpath gadgets. This vulnerability can be exploited in the default configuration, which poses a significant risk...

The M365 Copilot product from Microsoft is susceptible to an information disclosure vulnerability that permits unauthorized attackers to disclose sensitive information over a network. This defect stems from a command injection flaw within the AI functionalities of M365 Copilot, emphasizing the ne...

Microweber CMS, up to version 2.0.20, has a significant path traversal flaw in its static file controller. This vulnerability allows remote, unauthenticated attackers to exploit the failure of the normalize_path() function. By supplying specially crafted directory traversal sequences in the path ...

The Oj Ruby gem, a JSON parser and object marshaller, is susceptible to a heap corruption issue when using create_id enabled with JSON object keys of exactly 65,535 bytes. This flaw arises from an integer truncation during the parsing process, leading to a negative-size argument being passed to t...

The vulnerability allows an attacker to send specially crafted payloads to Microsoft Office SharePoint, potentially resulting in unauthorized remote code execution. This security flaw occurs due to the improper handling of untrusted data. If exploited, it could enable malicious actors to execute ...

The SonicWall Single Sign-On (SSO) Agent is found to have a vulnerability due to its default configuration, which utilizes NetAPI to probe associated IP addresses within a network. This probing method can be exploited by an attacker to capture the password hash of users with privileged access. Co...

The TripSpark VEO Transportation and NovusEDU products are vulnerable due to improper handling of user inputs in POST body parameters. This allows malicious users to inject arbitrary SQL commands into the 'Student Busing Information' search queries. The lack of sanitization on server-side logic m...

An SQL Injection vulnerability exists in the SearchTextBox parameter of Fortra's DeliverNow software versions prior to 1.2.18. This flaw allows attackers to manipulate SQL queries, potentially enabling them to execute arbitrary code, escalate user privileges, and access sensitive information stor...

The ASUS Router App contains a vulnerability that allows a malicious third-party application on the same device to initiate a crafted Intent. This can lead to the ASUS Router App opening a specified URL without proper validation, potentially compromising user privacy and security. For more detail...

An unauthenticated Insecure Direct Object Reference (IDOR) vulnerability exists in the Easy Appointments plugin, affecting versions up to 3.12.27. This vulnerability allows attackers to access and manipulate sensitive data without proper authentication, potentially leading to unauthorized access ...