Publicly Disclosed
PoC Exploits

A SQL injection vulnerability exists in the core of Ivanti Endpoint Manager prior to version 2024 SU8. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the vulnerable system. Exploiting this vulnerability can lead to significant security risks, including unauthorize...

Samba versions 3.5.0 up to 4.6.4, along with specific earlier releases, contain a serious vulnerability where a malicious client can upload a shared library to a writable share. This exploit allows the server to load and execute the uploaded file, leading to unauthorized control and potential dam...

A security flaw in JeecgBoot versions up to 3.9.5 exposes the function OpenApiController.call within the Authentication Filter to server-side request forgery. This vulnerability allows attackers to exploit the function remotely, potentially leading to unauthorized access and data breaches. Notabl...

A serious vulnerability has been identified in JeecgBoot, affecting versions up to 3.9.6. This issue resides in the RestTemplate.exchange function within the flow-run endpoint's specific class file. Exploitation of this vulnerability could allow remote attackers to manipulate server requests, pot...

A vulnerability exists in the function get_tokenizer within the Checkpoint Loading component of SakanaAI text-to-LoRA. By manipulating the argument base_model_name_or_path, an attacker can exploit this flaw to perform path traversal attacks remotely. The vulnerability was disclosed publicly, and ...

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

The out-of-bounds read vulnerability in Windows Paint enables unauthorized attackers to potentially execute arbitrary code within a network context. This flaw could allow malicious entities to manipulate the application, leading to unauthorized actions being performed on affected systems. Users a...

A path traversal vulnerability exists in the tjake Jlama product, specifically within the SafeTensorIndex.loadWeights function. This issue arises when an attacker manipulates the weight_map argument, potentially leading to unauthorized file access on the server. The vulnerability can be exploited...

The vulnerability in Windows LDAP is characterized by an out-of-bounds write issue that enables unauthorized attackers to execute arbitrary code remotely. This poses significant risks as it can allow remote exploitation via network access. Organizations must implement recommended patches to secur...

An improper encoding or escaping of output vulnerability exists in Fortinet FortiAnalyzer and FortiManager products, allowing an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request. This flaw may lead to severe consequences, including unauthorize...

The vulnerability in Fortinet's FortiMail products allows an unauthenticated attacker to exploit improper neutralization of special elements in OS command execution. This flaw may enable the attacker to execute arbitrary code or commands through specially crafted HA join-request packets. Users of...

A vulnerability has been identified in Braindecode's model config deserialization function, specifically in the 'resolve_type_kwargs' method. This flaw allows an attacker to manipulate the Activation argument using externally controlled input. As a result, it opens the door for remote exploitatio...

A path traversal vulnerability in Fortinet FortiMail products allows unauthenticated attackers to navigate to restricted directories, potentially leading to unauthorized command execution. This issue affects multiple versions, including FortiMail 8.0.0 through 8.0.1, and 7.x versions up through 7...

Metabase contains a vulnerability that enables a remote, unauthenticated attacker to perform SQL injection through the '/reset_password' endpoint. This flaw allows attackers to manipulate database queries, potentially gaining unauthorized administrator access to the Metabase instance and compromi...

A vulnerability in PHP allows for the possibility of remote code execution due to improper management of global state that can reference freed memory. In certain scenarios, the global state retains stale information from previous requests, potentially enabling an attacker to execute arbitrary cod...

A security vulnerability present in versions 19.0.0 to 19.0.9, 19.1.10, 19.2.9, and 19.3.1 of React's server component packages can allow unauthenticated remote code execution. This occurs specifically in scenarios where responses include multiple typed arrays alongside an attacker-controlled val...

The Clockinator Lite plugin for WordPress prior to version 1.1.0 contains a significant authorization flaw. This vulnerability permits unauthenticated users to manipulate leave requests without proper verification. As a result, individuals can approve or reject leave requests and alter user assig...

The User Verification plugin by PickPlugins for WordPress versions prior to 2.0.49 is susceptible to a brute force attack due to lack of rate limiting on its one-time password login verification step. This vulnerability permits unauthenticated attackers to exploit the system and log in as any use...

The Clockinator Lite plugin for WordPress prior to version 1.1.0 is vulnerable to SQL injection due to insufficient access controls on record deletion actions. This allows unauthenticated users to execute SQL queries using unsanitized user input for table names. As a result, attackers can delete ...

The Ultimate Addons for Elementor plugin prior to version 1.0.8 lacks adequate validation for uploaded file extensions within its file upload feature. This flaw enables unauthenticated users to upload potentially dangerous files, including PHP scripts, which could lead to remote code execution. W...

The Mine CloudVod plugin for WordPress prior to version 2.6.6 has a significant security flaw that lacks proper authentication measures. This vulnerability allows unauthenticated attackers to access REST API routes that are intended to request cloud storage upload credentials. As a result, malici...

The Order Tracking Plugin for WordPress prior to version 3.6.2 is susceptible to an improper access control vulnerability. This flaw enables unauthorized users to access order histories by exploiting the default sequential numbering of account identifiers. As a result, attackers can retrieve sens...

The Mine CloudVod WordPress plugin prior to version 2.6.6 contains a security flaw that fails to verify the ownership of an order when returning its payment status. This may allow any logged-in user, including those with lower access rights such as subscribers, to access other users' order status...

The TI WooCommerce Wishlist plugin for WordPress is vulnerable to SQL injection due to improper sanitization and escaping of user input in front-end endpoints. This vulnerability allows unauthenticated attackers to manipulate SQL queries executed by the plugin. Exploitation of this flaw can lead ...

The TI WooCommerce Wishlist plugin for WordPress is vulnerable due to insufficient verification of wishlist ownership. This flaw allows unauthenticated users to manipulate registered users' wishlists by deleting items without authorization, given they know or can guess a wishlist's share key. Thi...

The WP Remote Users Sync WordPress plugin, prior to version 2.3.0, contains a vulnerability that permits unrestricted access to user metadata keys. This flaw enables unauthorized users to manipulate user capabilities through incoming synchronization requests. Consequently, a malicious site can ex...

The Abilities Bridge WordPress plugin prior to version 1.4.2 lacks proper nonce verification during the re-authentication of REST API requests using a logged-in session cookie. This oversight permits malicious actors to exploit the vulnerability by deceiving a logged-in administrator into accessi...

A vulnerability has been identified in the ContentPen WordPress plugin, wherein it improperly exposes its REST API key to unauthenticated users. This exposure allows unauthorized individuals to create posts containing unfiltered JavaScript. Consequently, this leads to stored Cross-Site Scripting ...

The AskAny WordPress plugin, prior to version 2.2.1, suffers from a critical session management vulnerability. This flaw occurs when the plugin fails to verify the ownership of a chat session against the requester, enabling unauthorized users to access another visitor's session identifier. Conseq...

The Directorist: AI-Powered Business Directory plugin for WordPress prior to version 8.11.1 has a security flaw that allows users with Subscriber-level accounts and above to change their own listing statuses from pending to published. This exploit bypasses the essential listing moderation control...

The Defender Security WordPress plugin prior to version 6.4.1 lacks proper verification of the client IP address used for firewall and lockout decisions. This vulnerability allows unauthenticated attackers to spoof their IP addresses, bypassing crucial IP-based protections like login lockouts and...

The Defender Security WordPress plugin, prior to version 6.4.1, has a significant flaw in its two-factor authentication process. This vulnerability permits attackers, who may already possess a victim's password, to execute brute-force attacks against the one-time authentication codes. Without ade...

The Descope WordPress plugin prior to version 1.2.0 contains an authentication bypass vulnerability that allows an attacker with no authentication to generate a valid session for any existing user, including administrators. By supplying a non-empty authentication token, the attacker can exploit t...

The Photo Gallery by 10Web plugin for WordPress prior to version 1.8.49 contains a vulnerability that allows attackers with Contributor-level access or higher to exploit a lack of proper escaping for a shortcode attribute. This vulnerability results in Stored Cross-Site Scripting (XSS) when a gal...

The WP Directory Kit plugin for WordPress, prior to version 1.6.3, is susceptible to SQL injection attacks due to improper sanitization and escaping of parameters used in ordering results on its admin screen. Specifically, it relies on a keyword deny-list whose order can be bypassed. This vulnera...

The Oxygen MyData for WooCommerce plugin prior to version 3.0.9 suffers from an authorization bypass vulnerability. This issue enables unauthenticated users to manipulate order statuses through vulnerable payment callbacks, allowing them to mark any WooCommerce order as completed without proper v...

The Crop Thumbnails Plugin for WordPress, prior to version 1.10.0, contains an improper access control vulnerability that permits authenticated users, notably those with the Author role, to manipulate media attachments that do not belong to them. This flaw allows such users to read and overwrite ...

A heap-based buffer overflow vulnerability in Microsoft QUIC allows unauthorized attackers to execute arbitrary code remotely. This flaw could potentially enable adversaries to exploit the affected system over a network, posing significant risks to data integrity and confidentiality. It is essent...

GeoNode, a geospatial content management system, is exposed to a shell command injection vulnerability. This issue arises when a low-privileged remote user uploads a specially crafted vector file layer name. The injected shell syntax can be used to execute arbitrary operating-system commands on t...

The local privilege escalation vulnerability in Iperius Backup 8.8.3 is rooted in the inadequate separation between the graphical user interface, which operates with elevated privileges, and the local users who have low privileges. This flaw allows a local attacker, when the backup service is set...

PrestaShop, an open-source e-commerce platform, is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Customer Service view of its back-office. This issue arises due to the improper handling of user input from the public Contact Us form. An unauthenticated attacker can submit...

A stack-based buffer overflow vulnerability in Windows Active Directory can be exploited by an authorized attacker to execute arbitrary code remotely over the network. This security flaw poses risks to system integrity and can lead to significant data breaches if not promptly addressed. It is cru...

A spoofing vulnerability exists in Microsoft Office Outlook that allows unauthorized attackers to exploit the application by performing unsafe actions without user alerts. This flaw can enable the attacker to impersonate a legitimate entity over the network, potentially leading to unauthorized ac...

An improper encoding or escaping of output vulnerability exists in Fortinet FortiAnalyzer and FortiManager products, allowing an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request. This flaw may lead to severe consequences, including unauthorize...

An origin validation error has been identified in Fortinet's FortiClient products for both Mac and Windows platforms. This vulnerability potentially allows an unauthorized remote attacker to execute code or commands without proper authorization. Successful exploitation of this vulnerability neces...

A vulnerability exists in ToolJet's Onboarding Signup Endpoint that allows unauthorized access due to missing authentication in the 'activateUserWithPassword' function within the 'util.service.ts' file. By manipulating the 'email' argument, attackers can exploit this weakness remotely, gaining ac...

The Basel Post Types plugin for WordPress is vulnerable due to a coding error in the defined() function related to SECURE_AUTH_SALT. This flaw allows unauthenticated attackers to bypass authentication checks entirely, enabling them to impersonate any existing user, including administrators. The i...

A heap-based buffer overflow vulnerability exists in Windows NetBIOS, which can be exploited by an authorized attacker to locally elevate their privileges. This weakness poses a significant risk as it can allow attackers to gain unauthorized access and control over system resources, making it imp...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...