Publicly Disclosed
PoC Exploits

An unauthenticated remote code execution vulnerability has been identified in JetBrains TeamCity prior to version 2026.1.3 and 2025.11.7. This weakness is exposed through the agent polling protocol, allowing attackers to execute arbitrary code without authentication, posing significant risks to t...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

The h2 library, which is a pure-Python implementation of the HTTP/2 protocol stack, has a vulnerability that allows for potential request smuggling. This occurs in versions up to and including 4.4.0, where the library incorrectly handles request header blocks containing multiple Host headers. Sub...

The h2 library, which is a pure-Python implementation of the HTTP/2 protocol stack, has a vulnerability that allows for potential request smuggling. This occurs in versions up to and including 4.4.0, where the library incorrectly handles request header blocks containing multiple Host headers. Sub...

An authentication vulnerability has been identified in Apache Tomcat, specifically relating to the configuration of JNDIRealm when using GSSAPI for authentication purposes. This flaw enables unauthorized attackers to authenticate without providing the correct password, thereby compromising the se...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

A remote code execution vulnerability found in React Server Components allows attackers to exploit improperly handled payloads. This issue affects versions 19.0.0 through 19.2.0, compromising server function endpoints through unsafe deserialization of HTTP request payloads. As a result, this flaw...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log messag...

A server-side request forgery vulnerability exists in the HKUDS Nanobot up to version 0.2.1, specifically in the undocumented function _download_image_data_url within the image_generation.py module. This vulnerability allows remote attackers to exploit the function to execute unauthorized server ...

A vulnerability has been identified in the HKUDS Nanobot's Login-shell Environment Handler, specifically in the ExecTool._prepare_command function within the shell.py file. This flaw can lead to the unintentional disclosure of sensitive information when local access is exploited. It arises from t...

A significant vulnerability has been identified in HKUDS Nanobot prior to version 0.2.1, specifically within the connect_mcp_servers function of the mcp.py file. This issue involves improper access controls allowing potential unauthorized registration of MCP resources and prompt wrappers outside ...

A security vulnerability exists in HKUDS Nanobot versions prior to 0.3.0, affecting the Shell Allowlist Handler. Specifically, the issue arises from inadequate validation of shell commands, leading to potential remote command injection. Attackers can exploit this vulnerability by manipulating the...

An issue has been identified in Apache Polaris where it fails to consistently validate storage locations during table and view registration. Authenticated users with the necessary permissions can leverage this vulnerability to allow Polaris to access Iceberg metadata files from user-defined locat...

A security flaw in SourceCodester's Simple Doctors Appointment System version 1.0 allows an attacker to exploit the /admin/ajax.php?action=delete_appointment endpoint. By manipulating the ID parameter, the attacker can execute SQL injection attacks remotely, compromising the integrity and confide...

A vulnerability has been identified in the SourceCodester Photo Share Website version 1.0, specifically within the Comment Input Box component. This issue arises from improper handling of the 'content' argument in the file '/social/ajax.php?action=save_upload', leading to a cross-site scripting (...

An unauthenticated remote code execution vulnerability has been identified in JetBrains TeamCity prior to version 2026.1.3 and 2025.11.7. This weakness is exposed through the agent polling protocol, allowing attackers to execute arbitrary code without authentication, posing significant risks to t...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability exists in WonderTrader versions up to 0.9.9 affecting the _undone_qty function in the Pending Order Handler. This security flaw allows remote manipulation of the getUndoneQty argument, leading to unauthorized alterations in behavioral workflows. The exploit is publicly accessible,...

A vulnerability exists in the TraderATP Cash Trade Conversion component of WonderTrader, specifically affecting the function within the file src/Includes/WTSTradeDef.hpp. This issue arises from the manipulation of the m_offsetType argument, leading to the use of an uninitialized variable, which c...

A SQL injection vulnerability has been identified in the SourceCodester Photo Share Website version 1.0. This issue is triggered when manipulating the email parameter in the /social/ajax.php?action=signup file. Unsanctioned input can lead to unauthorized access, allowing attackers to execute remo...

Marimo, a reactive Python notebook, exhibits a significant security vulnerability prior to version 0.23.0. The terminal WebSocket endpoint (/terminal/ws) allows unauthenticated access, enabling attackers to gain a complete pseudo-terminal shell and execute arbitrary commands on the host system. U...

A vulnerability has been discovered in the SourceCodester Photo Share Website 1.0, specifically targeting an unknown function in the file /social/ajax.php with the action parameter set to save_upload. This flaw allows attackers to manipulate the img[] and imgName[] arguments, leading to unrestric...

A vulnerability has been identified in version 1.0 of the SourceCodester Photo Share Website, specifically affecting the function in /social/index.php?page=home. This flaw allows attackers to perform cross site scripting (XSS) by manipulating the Comment argument, potentially enabling remote expl...

A vulnerability has been identified in the WonderTrader application which affects the function TraderDD::queryTrades located in the source file TraderDD.cpp. This flaw arises from improper handling of the FID_JYLB argument, leading to potential manipulation of the behavioral workflow. Threat acto...

A security vulnerability exists in the PHPGurukul Visitor Management System 1.0 that allows an attacker to exploit a flaw in the processing of the 'fullname' argument in the file /manage-newvisitors.php. This manipulation leads to cross-site scripting (XSS) attacks that can be executed remotely. ...

Weaver (Fanwei) E-cology versions prior to 10.52 are impacted by a file upload vulnerability that allows unauthorized remote attackers to upload arbitrary files, notably JSP webshells. By sending a multipart/form-data POST request to the uploaderOperate.jsp endpoint with manipulated secId and pla...

Weaver (Fanwei) E-cology versions prior to 10.52 are impacted by a file upload vulnerability that allows unauthorized remote attackers to upload arbitrary files, notably JSP webshells. By sending a multipart/form-data POST request to the uploaderOperate.jsp endpoint with manipulated secId and pla...

A vulnerability has been identified in MZ Automation's libiec61850 library, specifically within the ASDU Element Handler. This flaw stems from the function SVReceiver_stopThreadless located in src/sampled_values/sv_subscriber.c, leading to a heap-based buffer overflow. The vulnerability necessita...

A cross-site request forgery (CSRF) vulnerability was identified in Apache Zeppelin that could allow an attacker to impersonate authenticated users. The vulnerability arises due to the application's default CORS configuration, which permits cross-origin state-changing requests. By enticing a user...

A flaw in the Linux kernel's KVM module relates to improper handling of invalid or obsolete root pages after making MMU pages available. The issue arises when the system fails to check for stale page faults, resulting in an attempt to map memory to an invalid root. This can occur when reclaiming ...

A use-after-free vulnerability exists in the nf_tables component of the Linux kernel, specifically within the nft_verdict_init() function. This vulnerability can be exploited when a drop error is incorrectly handled, resulting in a potential double free situation during packet verdict processing....

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress prior to version 1.42.0 is vulnerable to an improper token validation issue. The plugin fails to properly bind its Turnstile validation cache to the unique challenge token in its Forminator integration. This oversight allows attack...

The Subscriptions for WooCommerce plugin prior to version 2.0.1 fails to adequately validate the payment amounts during the order completion process. This vulnerability allows an unauthenticated attacker, particularly in scenarios where guest checkout is enabled, to exploit the system by substitu...

The WP Events Manager plugin prior to version 2.2.5 contains a security flaw where it fails to authenticate payment notifications. This oversight permits unauthenticated users to manipulate booking statuses, marking them as paid without genuine payment confirmation. As a result, unauthorized book...

The Estatik Real Estate Plugin for WordPress prior to version 4.3.3 exhibits a critical flaw in its OAuth social login implementation. This vulnerability allows unauthenticated attackers to manipulate the login process by binding the OAuth flow to a session not associated with the initiating user...

The WP Maps plugin for WordPress, prior to version 4.9.7, lacks proper capability checks in its AJAX actions. This weakness allows users with a Subscriber account to execute uncontrolled recursive functions, subsequently exhausting server resources and leading to a Denial of Service. It is crucia...

The WP Maps plugin for WordPress prior to version 4.9.7 is vulnerable due to a lack of capability checks in its AJAX actions. This flaw enables users with Subscriber-level permissions to exploit the plugin's functionality, allowing them to include and execute arbitrary PHP files from the server's...

The MStore API plugin for WordPress, prior to version 4.21.0, lacks proper authorization checks on its REST endpoint for creating product reviews. This vulnerability allows unauthenticated attackers to submit product reviews to WooCommerce stores, impersonating any reviewer by specifying arbitrar...

The MStore API WordPress plugin prior to version 4.21.0 fails to properly validate the cryptographic signature of the token used for phone-based login. This flaw enables unauthorized attackers, who are aware of a registered user's phone number, to create a forged token, potentially allowing them ...

The Ajax Search Lite plugin for WordPress, prior to version 4.14.5, is vulnerable due to its failure to properly validate deserialized input. This weakness allows unauthenticated attackers to exploit PHP Object Injection, especially when an appropriate Properties Object Payload (POP) chain is ava...

The MStore API plugin for WordPress prior to version 4.21.0 features a critical flaw where it fails to authenticate payment through the payment gateway before marking orders as paid. This allows an unauthenticated attacker to manipulate payment statuses, enabling them to falsely mark any order as...

The MStore API WordPress plugin versions prior to 4.21.0 are vulnerable as it fails to enforce proper restrictions on its vendor-orders endpoint. This oversight permits any authenticated user, even those with lower privileges such as Subscribers, to access and read all WooCommerce orders in the s...

The Meow Gallery plugin for WordPress, prior to version 5.5.2, is susceptible to a JavaScript injection vulnerability. The plugin fails to properly escape the alt text of attachments when generating output for linked galleries. As a result, users with Author roles or higher are able to store a po...

The BNE Testimonials plugin for WordPress prior to version 2.0.8.2 contains a vulnerability that fails to properly escape a shortcode attribute within a JavaScript context. This flaw permits users with contributor privileges and higher to inject arbitrary JavaScript code, leading to potential exe...

The Content Views plugin for WordPress, prior to version 4.5, is susceptible to a SQL injection vulnerability due to insufficient capability checks on specific AJAX operations. This flaw allows authenticated users, including those with minimal privileges like Subscribers, to execute unauthorized ...

The Templately WordPress plugin prior to version 3.7.1 is susceptible to an authorization bypass. This vulnerability allows unauthorized attackers to exploit a lack of proper checks on certain request handlers. By leveraging this flaw, an attacker can replace the legitimate administrator's stored...

The Subscriptions for WooCommerce plugin for WordPress has a security flaw where it fails to validate user permissions when installing and activating the plugin via a nonce-protected AJAX action. This oversight allows users with the Shop Manager role, who ordinarily lack sufficient management cap...

The Subscriptions for WooCommerce WordPress plugin prior to version 2.0.1 lacks proper verification of subscription ownership. This oversight enables any authenticated user to access another user's subscription details, including product information, status, and important dates, by merely providi...

The Comments plugin for WordPress, prior to version 7.6.60, fails to properly sanitize user-supplied URLs when outputting them within HTML attributes. This vulnerability enables unauthenticated users to inject malicious JavaScript payloads into the plugin's comments section. When any user, includ...