Publicly Disclosed
PoC Exploits

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

The OpenMage Magento LTS versions prior to 20.18.2 and between 21.0.0-beta1 and 21.0.0-beta3 are vulnerable due to an unrestricted file upload issue stemming from a missing blocklist entry for certain file types. This flaw allows unauthenticated attackers to exploit file custom options to upload ...

An authentication bypass vulnerability in Apache Airflow's CeleryExecutor allows unauthorized users to enqueue malicious callback workloads. By exploiting this flaw, an attacker can run arbitrary code on connected CeleryExecutor workers without needing valid Airflow credentials. This occurs throu...

The ELEX WordPress HelpDesk & Customer Ticketing System is susceptible to a deserialization vulnerability that allows for object injection. This flaw arises from the handling of untrusted data, which can potentially lead to unauthorized actions within the application. Users of versions prior to 3...

The AutomatorWP Pro plugin's webhook addon is susceptible to an authorization bypass flaw in versions up to and including 1.4.4. The vulnerability arises from inadequate verification of user permissions, enabling unauthenticated attackers to reset passwords for any WordPress account, including th...

A security flaw has been identified in the Sox_ng product, specifically in the VOC Decoder component where the function read_samples_voc is located. This vulnerability can lead to an out-of-bounds write, which may allow an attacker to manipulate memory beyond intended boundaries. Such manipulatio...

NocoDB before 2026.08.0 is susceptible to a stored cross-site scripting vulnerability. This flaw allows authenticated Creator users to inject malicious scripts via markup in column or table titles. The issue arises when the Delete.vue confirmation dialog utilizes an unescaped innerHTML binding to...

NocoDB versions prior to 2026.09.0 contain a stored cross-site scripting (XSS) vulnerability that allows authenticated Editor users to execute malicious scripts. This is achieved by exploiting crafted attachment MIME types that can be uploaded via the records API. When a user accesses a specific ...

A critical security weakness has been discovered in the Wubang Five-in-One Safety Production Management Information System, affecting versions up to 3.5. The vulnerability lies within the DiyFileUpload function of the /ws.asmx file, allowing attackers to upload files without restriction. This fla...

NocoDB versions prior to 2026.09.0 are susceptible to a privilege escalation vulnerability that compromises the administrative integrity of the platform. When the environment variable for the admin password is empty, the system fails to enforce super-admin bootstrap procedures. This oversight per...

A vulnerability exists in OpenSSL when parsing CMS AuthEnvelopedData structures that employ AEAD ciphers like AES-GCM. This flaw arises from the improper handling of oversized Initialization Vectors (IVs) crafted within ASN.1 parameters, leading to a stack buffer overflow. An attacker can exploit...

An improper neutralization vulnerability exists in the Auth API of Synology DiskStation Manager, impacting versions prior to 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. This flaw allows remote attackers to exploit SQL commands for unauthorized file access or modifications, l...

A security vulnerability has been identified in the Mereithhh VanBlog component, specifically affecting versions up to 0.54.0. The issue resides within the fs.readFileSync function of local.provider.ts, allowing remote attackers to exploit the argument manipulation of the path leading to a potent...

The FrankenPHP standalone static binaries before version 1.13.2 include a PHP Brotli extension that is linked with an outdated version of Brotli. This leads to an out-of-bounds write vulnerability in the decoder, potentially allowing unauthenticated remote attackers to exploit the flaw. By sendin...

A validation flaw in the MongoDB Node.js driver allows an unauthenticated attacker to exploit DNS SRV responses, potentially connecting to unintended hosts and leading to unauthorized access to sensitive application data. When using a mongodb+srv:// connection string, the driver verifies the DNS ...

A vulnerability exists in the Mereithhh VanBlog up to version 0.54.0 that exposes the Image Upload Endpoint to cross-site scripting attacks. An attacker can manipulate the system remotely, allowing for the execution of malicious scripts in the context of a user’s session. This exploitation has be...

A vulnerability has been identified in the Tenda AC18, specifically within the Firmware Upgrade Handler component located at /cgi-bin/upgrade. This flaw arises from insufficient verification of data authenticity due to a manipulation of the upgradeFile argument. As a result, attackers could poten...

A vulnerability has been identified in Opixido OCMS affecting its Admin TUI component. An issue exists in the 'admin/TUI/index.php' file, where improper handling of input within an unknown function allows for cross site scripting (XSS) attacks. This vulnerability can be exploited remotely, enabli...

A security vulnerability has been identified in the Edimax BR6478ACV2 router, specifically within the formPPTPSetup function found in the device's web interface. An attacker can exploit this vulnerability by sending specially crafted arguments related to the pptpUserName parameter, potentially le...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability has been identified in Opixido OCMS affecting its Admin TUI component. An issue exists in the 'admin/TUI/index.php' file, where improper handling of input within an unknown function allows for cross site scripting (XSS) attacks. This vulnerability can be exploited remotely, enabli...

The sysPass application, versions 3.0.1 through 3.2.11, features a critical authentication bypass vulnerability. This flaw allows unauthorized attackers to exploit the install/install handler, permitting them to bypass the necessary checks for installed status. By sending specific POST requests, ...

Psono Server versions 1.12.6 through 7.5.0 of the Community Edition and prior to 7.5.1 of the Enterprise Edition contain an authorization flaw. An attacker with group share-admin privileges can delete group share-right records without having accepted a group invitation. This occurs because the au...

The Quick Page/Post Redirect Plugin for WordPress prior to version 5.2.4 had a hidden update mechanism that allowed it to receive updates from a malicious server instead of WordPress.org. This oversight enabled attackers to push a compromised version that injected arbitrary content into web pages...

The WP Ultimate CSV Importer and its Pro version exhibit a security flaw that causes files exported via the single post export feature to be stored in a publicly accessible location. This exposure allows unauthenticated users to download the exported content and custom fields of any post, includi...

The WP Ultimate CSV Importer plugin for WordPress, prior to version 9.3, is susceptible to SQL injection due to inadequate escaping of imported file values. This vulnerability allows privileged users, such as site administrators in single or multisite environments, to inject malicious SQL queries...

The Duplicate Post plugin for WordPress prior to version 1.5.8 has an authorization vulnerability that fails to properly verify a user's permissions when duplicating posts. This oversight allows users assigned roles with access to the plugin, such as Contributors, to create published posts. This ...

The Lightbox with PhotoSwipe plugin for WordPress prior to version 5.19.0 fails to adequately sanitize link titles and other caption sources before rendering them as HTML in the image lightbox. This oversight permits unauthenticated users to exploit the vulnerability and execute stored cross-site...

The Swipe WordPress plugin prior to version 1.4 is vulnerable to an authentication bypass flaw. This vulnerability allows unauthorized attackers to gain access to the WordPress session of existing users, including administrators. By exploiting this flaw, attackers can issue a WordPress session co...

The Duplicate Post plugin for WordPress versions prior to 1.5.8 contains a serious access control vulnerability. It fails to verify if a user attempting to duplicate a post has sufficient permissions to edit the original content. When the slug takeover feature is activated, this oversight enables...

The Checkout Files Upload for WooCommerce plugin prior to version 2.4.1 lacks proper validation of uploaded files at the checkout process. This security gap enables unauthenticated users to upload malicious files, such as HTML files, disguising them as acceptable image formats. Consequently, thes...

The SEOJuice WordPress plugin prior to version 2.12.0 contains a vulnerability that improperly manages the authentication filter for its REST API interface. This lack of proper restriction allows unauthorized users to bypass the site's REST nonce protection mechanism. Consequently, an attacker co...

The Chargely Free Subscriptions for WooCommerce plugin prior to version 1.0 has a security concern where it fails to implement necessary authorization checks on a REST API endpoint. This oversight allows attackers without authentication to access sensitive configuration details, including the Woo...

The 4Dem Email Marketing plugin for WordPress prior to version 2.0.5 is vulnerable due to the lack of proper authorization checks on several AJAX actions. This flaw enables unauthorized users to manipulate the plugin’s stored configuration and delete important records, which can lead to significa...

The Flatsome WordPress theme prior to version 3.20.13 is susceptible to an authorization bypass vulnerability. This flaw allows users with minimal permissions, such as Contributors, to publish their own content and modify its post type to something different, like a product. The lack of enforceme...

The Flatsome WordPress theme, prior to version 3.20.13, is vulnerable due to a lack of necessary capability or nonce checks on a specific AJAX action accessible to users without authentication. This oversight permits these unauthenticated users to retrieve unpublished content, including drafts an...

The Duplicate Post plugin for WordPress versions prior to 1.5.8 has a flaw that lacks a proper capability check when saving global settings. This oversight allows users with access—potentially any role granted access by an administrator, including lower-level roles like Subscriber—to modify criti...

The Email Marketing 4Dem plugin for WordPress, up to version 2.0.5, contains a significant authorization vulnerability. It fails to properly validate user permissions on multiple AJAX actions and REST routes. This oversight allows unauthenticated users to access sensitive configurations and data ...

The Countdown, Coming Soon, Maintenance WordPress plugin, up to version 3.0.8, lacks proper access control checks for user roles when handling AJAX requests. This flaw allows any authenticated user, including subscribers, to retrieve titles of published posts across various post types, even those...

The Countdown, Coming Soon, Maintenance plugin for WordPress lacks critical authorization and nonce validation during the saving process of countdown data on posts. This weakness allows users with Author-level access and higher to inject arbitrary web scripts. The output-sanitization allowlist in...

The Apache JServ Protocol (AJP) Connector in Apache Tomcat allowed for misconfigured connections that could be exploited by attackers. By default, the AJP Connector is enabled, listening on all configured IP addresses. This elevated trust can lead to unauthorized access and manipulation of files ...

Chargemap is susceptible to a stored cross-site scripting (XSS) vulnerability that can be exploited by a remote, unauthenticated attacker. By injecting malicious code into the username field of the account registration page, attackers can create a new account linked to a victim's email address. O...

The vulnerability in the Booked plugin by Case-Themes allows attackers to bypass authentication mechanisms through alternate channels. This can lead to unauthorized access and potential abuse of user accounts. The affected versions of the plugin range from unrestricted to version 3.0.0. It is cri...

A vulnerability exists in Microsoft Office that allows attackers to manipulate untrusted inputs, enabling them to bypass critical security measures locally. This flaw can expose systems to unauthorized actions, compromising the integrity of sensitive data. It is crucial for users to apply the lat...

Poste Italiane's Postecert FIRMAOK! version 1.6.29 for Windows is susceptible to a local privilege escalation vulnerability due to an uncontrolled OpenSSL search path. This flaw allows an attacker with low privileges to create a non-existent, writable directory and plant malicious OpenSSL configu...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

Flowise version 3.1.4 is susceptible to a server-side request forgery vulnerability. The flaw allows authenticated users with specific permissions to bypass the Custom Function sandbox’s SSRF protections. By manipulating module subpaths in an allowlisted package (like axios or node-fetch), attack...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A critical vulnerability in Google Chrome prior to version 157.0.8103.50 allows remote attackers to execute arbitrary code within the browser's sandbox environment. This is achieved through a specially crafted HTML page that exploits a use after free situation in the XML parsing component, leadin...