Publicly Disclosed
PoC Exploits

A significant security flaw has been identified in the Netcore NR268 router version 1.7.121109. The vulnerability arises within the 'user_ok' function of the CGI Execution component, allowing for incorrect user authentication. This flaw enables attackers to initiate remote exploits, potentially c...

An out-of-bounds read vulnerability has been identified in the Netcore NR268 Router due to improper handling of arguments in the filter_arp_put_file_cgi function. This flaw can be exploited remotely, allowing an attacker to read memory regions without authorization through crafted requests. The a...

A vulnerability exists in Shenzhen HCC Technology's MPOS M6 PLUS related to the functionality of the Display QR Code Rendering component. This issue arises from improper restriction of rendered user interface layers when manipulating the argument alignment. The vulnerability could be exploited by...

A serious SQL injection vulnerability exists in Exponent CMS versions up to 3.0.2patch2, specifically within the userLogin function found in the xmlrpc.php file of the XML-RPC component. This flaw enables attackers to manipulate SQL queries, potentially compromising the database remotely. The vul...

Pimcore versions up to 2026.3.1 are susceptible to a stored cross-site scripting (XSS) vulnerability. Authenticated backend users with data object edit permissions can exploit the ExternalImage fields by injecting unescaped URLs containing malicious scripts. This occurs when these scripts are ren...

The vulnerability in Square Squash arises from an insecure deserialization mechanism, allowing unauthenticated users to manipulate the application. Specifically, the vulnerability exists within the '/api/1.0/symbolication' endpoint, where attackers can send crafted YAML data. This data, when link...

A vulnerability exists in TobyChui Zoraxy versions up to 3.3.4, specifically within the handleBasicAuth function of the Path Exception Matcher component. This flaw allows for improper authorization due to manipulation of the PathPrefix argument. Importantly, this vulnerability is exploitable remo...

A flaw exists in the SHAREit App version 6.27.38_ww for Android, specifically within the syncInvoke function of the WebView JS Bridge component. This vulnerability allows attackers to remotely execute malicious routines, potentially compromising user data and device integrity. Despite notificatio...

A critical security flaw exists in the Linksys E1700 router that allows an attacker to execute arbitrary commands on the operating system. This vulnerability arises from improper handling of user-supplied input in the setLinksysIpv6 function of the router's web interface. By manipulating the _6rd...

A significant weakness has been detected in the Linksys E1700 version 1.0.0.4.003, specifically affecting the setDMZ function in the /goform/setDMZ file. This vulnerability allows for the manipulation of the MAC_addr argument, leading to the potential execution of OS commands. The exploit is remo...

A security flaw in Linksys E1700 version 1.0.0.4.003 has been identified, impacting the functionality of the static route handler. Specifically, vulnerabilities exist in the addStaticRoute function located in /goform/addStaticRoute, allowing attackers to manipulate arguments related to static rou...

A stack-based buffer overflow vulnerability exists in the Linksys E1700 router within the setVlan function of the /goform/setVlan file. This flaw allows an attacker to manipulate the vlan_set argument, potentially leading to remote code execution. Public exploits for this vulnerability are availa...

The Linksys E1700 router version 1.0.0.4.003 is susceptible to a stack-based buffer overflow in the ssid1MACFilter function. This vulnerability arises from improper handling of user input in the newap_text_%d parameter, which can be exploited remotely. Attackers can leverage this flaw to inject m...

A vulnerability exists in BlackBeltTechnology's pi-agent-dashboard prior to version 0.8.0, specifically in the terminalManager.spawn function. This flaw allows manipulation of the 'cwd' argument, leading to improper authorization. Attackers can exploit this vulnerability remotely, potentially lea...

The jshERP software, up to version 3.6, exhibits a missing authorization vulnerability that empowers low-privilege authenticated users. This flaw allows them to leverage add and import endpoints—specifically /account/add, /material/add, and /material/importExcel—to generate tenant-wide master dat...

The jshERP software, up to version 3.6, exhibits a missing authorization vulnerability that empowers low-privilege authenticated users. This flaw allows them to leverage add and import endpoints—specifically /account/add, /material/add, and /material/importExcel—to generate tenant-wide master dat...

The jshERP software, up to version 3.6, exhibits a missing authorization vulnerability that empowers low-privilege authenticated users. This flaw allows them to leverage add and import endpoints—specifically /account/add, /material/add, and /material/importExcel—to generate tenant-wide master dat...

The jshERP software, up to version 3.6, exhibits a missing authorization vulnerability that empowers low-privilege authenticated users. This flaw allows them to leverage add and import endpoints—specifically /account/add, /material/add, and /material/importExcel—to generate tenant-wide master dat...

jshERP versions up to 3.6 contain a mass assignment vulnerability in the UserController's update handler. This flaw allows authenticated users to manipulate protected fields such as tenant_id and password. By crafting a specific PUT request to /user/update, attackers can potentially assume contro...

The improper authorization vulnerability in jshERP versions up to 3.6 enables low-privilege authenticated users to gain unauthorized access to sensitive settlement account ledgers. This occurs when users can exploit the GET /account/findAccountInOutList endpoint by supplying arbitrary account IDs...

The authorization bypass vulnerability in jshERP version 3.6 enables authenticated users to manipulate the status parameter in POST requests to the /depotHead/addDepotHeadAndDetail endpoint. By setting the status to 1, attackers can circumvent audit permission checks and multi-level approval work...

The jshERP application versions prior to 3.6 have a vulnerability that permits authenticated users to bypass authorization controls when exporting data using the /supplier/exportExcel endpoint. This flaw allows individuals with limited access, such as those restricted to their own or departmental...

The jshERP application, specifically in version 3.6, contains a significant authorization bypass vulnerability. This flaw allows authenticated users, who should only have access to their personal or departmental data, to exploit the system by manipulating the search JSON in a GET request. By incl...

The jshERP product version 3.6 contains a vulnerability in the LogController that permits any authenticated user to access sensitive tenant operation audit logs. This flaw allows low-privilege users to issue GET requests to the endpoints /log/list or /log/info, exposing other users' login identit...

The jshERP software version 3.6 is susceptible to an authorization bypass issue that permits authenticated users to access data from unassigned warehouses by manipulating request parameters like depotId or depotIds. This flaw is particularly concerning when warehouse restrictions are enforced, as...

MoguBlog versions up to 6.2 are susceptible to a significant broken access control vulnerability. This flaw permits authenticated administrators to inadvertently manipulate network-disk files belonging to other administrators. By making specially crafted requests to endpoints like /networkDisk/mo...

MoguBlog up to version 6.2 is susceptible to an insecure direct object reference vulnerability. This flaw permits authenticated administrators to exploit the /networkDisk/getFileList endpoint, allowing them to access and list files belonging to other administrators. The filtering mechanism of thi...

MoguBlog versions up to and including 6.2 are susceptible to an information disclosure vulnerability. This flaw allows low-privileged front-end users to access sensitive system credentials through the getSystemConfig endpoint. By exploiting this vulnerability, attackers can utilize a regular read...

The yshop-crm software, specifically versions up to 2.1.3, contains a vulnerability where authenticated back-office users can approve or reject invoices without proper authorization. This is due to the absence of necessary @PreAuthorize annotations in the CrmInvoiceController, which allows attack...

yshop-crm versions up to 2.1.3 are vulnerable due to a missing authorization check that allows any authenticated back-office user to approve or reject receivables records via a specific endpoint. The absence of a @PreAuthorize annotation and commented-out checks in the service implementation enab...

yshop-crm version 2.1.3 contains a vulnerability that allows authenticated back-office users to manipulate contract statuses. Specifically, users can approve or reject contracts via an unprotected endpoint without proper authorization checks, exposing the system to potential abuse. This flaw resu...

The lamp-cloud application, up to version 5.10.1, has a vulnerability allowing authenticated users to abuse the listFileByBizId endpoint. By manipulating the bizId parameter, users can list and access file attachments belonging to other business objects. This issue exposes sensitive information s...

The TDuck survey form version 6.0 has a vulnerability that allows authenticated users to exploit an insecure direct object reference in the saveFormTheme handler. This flaw enables attackers to overwrite the themes of other users' forms by submitting their own formKey along with a sequential them...

The lamp-cloud application, particularly versions up to 5.10.1, suffers from an insecure direct object reference vulnerability. This issue enables authenticated users to exploit the findUrlById handler within the FileAnyoneController. By supplying arbitrary file IDs, attackers can retrieve storag...

The TDuck Survey Form up to version 6.0 is susceptible to a broken access control issue that enables authenticated users to manipulate other users' forms. This vulnerability permits an attacker to submit a crafted request to the endpoint POST /user/form/item/batch/create, allowing them to inject ...

The TDuck survey form, version 6.0 and earlier, is susceptible to an insecure direct object reference vulnerability. This flaw allows authenticated users to manipulate form submission deletion by providing arbitrary submission IDs. By crafting requests with a valid formKey and sequentially iterat...

A security vulnerability has been identified in the Ollama software that affects versions up to 0.34.1. This issue lies within the IsValid function of the Pull API's model component. The vulnerability allows for remote exploitation through server-side request forgery, potentially impacting the in...

The Open Source Social Network (OSSN) version 10.1 has a vulnerability due to missing authorization in the ossn_album_page_handler function. This flaw allows unauthenticated attackers to download files via the routes album/getphoto and album/getcover. By sequentially enumerating file GUIDs, attac...

A race condition vulnerability has been detected in the VideoRoom component of Meetecho Janus Gateway up to version 1.4.2. This flaw occurs within the file src/plugins/janus_videoroom.c, allowing remote attackers to potentially exploit the flaw for unauthorized manipulation. While the complexity ...

The 3D Product Configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution due to inadequate authentication and nonce checks. Specifically, the vulnerability arises from the handling of the 'xpv_image' parameter, which lacks proper sanitization before being rendered i...

A security flaw has been identified in the Module Configuration component of Zen Cart, specifically within the admin/modules.php file. This vulnerability allows an attacker to manipulate certain arguments, potentially leading to SQL injection attacks that can be executed remotely. As the exploit ...

A SQL injection vulnerability exists in the Admin Panel of Zen Cart 2.2.2 due to improper handling of inputs in the eval function within the admin/configuration.php file. Specifically, manipulation of the argument gID can allow an attacker to execute unauthorized SQL commands. Although the attack...

A code injection vulnerability exists in the Administrative Module Management of Zen Cart versions up to 2.2.2, specifically within the zen_call_function function found in admin/includes/functions/general.php. This flaw allows attackers to manipulate the 'use_function' argument, leading to potent...

A security flaw exists in Zen Cart versions up to 2.2.2, affecting the zen_db_perform function within the PayPal IPN Handler. By manipulating the transaction ID (txn_id), an attacker could execute SQL injection attacks remotely, potentially compromising the application's data integrity. This vuln...

A vulnerability exists in yangzongzhuan RuoYi versions up to 4.8.3, specifically within the checkRoleAllowed function located in the /system/role/authDataScope file. This flaw allows for manipulation of the roleKey argument, resulting in improper privilege management. Attackers can exploit this v...

A vulnerability has been identified in DataEase affecting versions up to 3.0.0, linked to the function Utils.buildCalcField within the file io/dataease/engine/utils/Utils.java. This flaw allows for remote SQL injection attacks due to improper validation of arguments in the calculated field. An ex...

A security vulnerability exists in the Tencent WeKnora product, specifically within the SQL Validator component. This issue arises from inadequate input validation in the 'validateSubquery' function located in 'internal/utils/inject.go', which allows an attacker to execute SQL injection attacks r...

A vulnerability has been found in Agno AGI versions up to 3.0.6 and 3.1.1, specifically within the Delegation Feature's member_agent.run function. This weakness allows for potential execution with unnecessary privileges, making it possible for attackers to manipulate the system remotely. The expl...

A vulnerability in Agno AGI up to version 3.0.6/3.1.1 has been identified that affects the Agent Orchestration Layer, specifically the exec function. This flaw allows attackers to manipulate the argument code, leading to the potential execution of dynamically-managed code resources. Exploiting th...

A remote manipulation vulnerability exists in Agno-AGI Agno versions up to 2.7.3 and 3.0.6 due to improper handling in the 'get_authentication_dependency' function of auth.py. This issue allows attackers to bypass authentication by manipulating the 'security_key' argument, leading to unauthorized...