Publicly Disclosed
PoC Exploits

An information disclosure vulnerability in Windows Win32K allows authorized attackers to access sensitive information locally. This security flaw could enable an unauthorized actor to obtain confidential data, leading to potential exploitation in compromised systems. Users are urged to apply avai...

A vulnerability exists in the Apache Camel Solr component that allows an attacker to exploit improper input validation and header handling. Specifically, malicious users can manipulate Exchange message headers intended for Solr requests, potentially leading to server-side request forgery (SSRF) a...

The implementations of HeaderFilterStrategy in Apache Camel, specifically CxfRsHeaderFilterStrategy and KnativeHttpHeaderFilterStrategy, fail to appropriately filter inbound headers, allowing unauthenticated attackers to inject internal Camel headers through HTTP requests. This vulnerability can ...

Helm versions up to 4.2.3 contain a vulnerability in the Files.Lines template helper that can lead to a denial of service. An attacker can exploit this flaw by including zero-length byte slices in chart files, causing the Helm engine to panic and resulting in deterministic render failures. This i...

Open Event Server versions up to 1.19.1 are susceptible to a missing authentication flaw which permits unauthorized access to sensitive user information. This vulnerability enables attackers to export the complete member roster of any group via the CSV export endpoint without needing to authentic...

A missing authorization vulnerability in the Maybe product allows authenticated users with low privileges to exploit global hosting settings. By leveraging unprotected actions in the Settings::HostingsController, these users can modify critical configurations, access the operator's Synth API key ...

TheHive version 4.1.24 contains a broken object-level authorization vulnerability that affects its attachment download functionality. This flaw enables authenticated users to access attachments meant for other organizations. Attackers can exploit this security gap by supplying a content-hash iden...

TheHive version 4.1.24 is vulnerable to an unauthenticated information disclosure that permits attackers to access sensitive configuration details simply by sending a GET request to the /api/status endpoint. This endpoint inadequately enforces authentication checks, enabling potential attackers t...

An improper access control issue has been identified in Dendrite versions up to 0.13.8, specifically affecting the syncapi /context endpoint. This vulnerability allows authenticated local users, particularly those who have exited a room, to exploit a flawed membership evaluation. The vulnerabilit...

Dendrite, up to version 0.13.8, is vulnerable to a server-side request forgery (SSRF) that enables unauthenticated attackers to manipulate the server into establishing outbound TLS connections to arbitrary hosts and ports. This vulnerability arises from the lack of validation on the serverName pa...

Dendrite versions up to 0.13.8 exhibit an improper authorization vulnerability within the Matrix Client-Server API, allowing an authenticated user to delete third-party identifier bindings of other users. By exploiting the flawed Forget3PID handler, attackers can submit arbitrary addresses and me...

A vulnerability within the Linux kernel's UVC video support can be exploited due to inadequate handling of undefined video frame types. Specifically, when parsing video formats, the omission of UVC_VS_UNDEFINED frames can result in calculating incorrect buffer sizes, potentially leading to unsafe...

Cursor for Windows version 3.2.16 is susceptible to a binary planting vulnerability that endangers user systems by enabling remote attackers to execute arbitrary code. This occurs when a malicious git.exe file is placed in the repository root directory. When developers clone and open such a craft...

The vulnerability in SigNoz through version 0.133.0 allows attackers to leverage an open redirect in the SSO authentication process. Unauthenticated attackers can exploit this flaw to steal session tokens from users utilizing Google OAuth, SAML, or OIDC. By manipulating the authentication flow, a...

A vulnerability has been identified in the mosaxiv clawlet Chat Tool, specifically within the 'list/remove' function located in the 'tools/tool_cron.go' file. This issue allows for unauthorized manipulation due to a lack of proper authorization checks. The vulnerability can be exploited remotely,...

A vulnerability exists in poco-ai's poco-claw software, specifically in the run_task function located in executor/app/api/v1/task.py. This security issue is associated with the manipulation of the callback_url argument, which may lead to server-side request forgery. Attackers can exploit this vul...

A vulnerability exists in poco-ai's poco-claw software, specifically in the run_task function located in executor/app/api/v1/task.py. This security issue is associated with the manipulation of the callback_url argument, which may lead to server-side request forgery. Attackers can exploit this vul...

A vulnerability has been identified in the poco-ai poco-claw's executor_manager API, specifically in the create_task function located in executor_manager/app/api/v1/tasks.py. This flaw allows for missing authentication, potentially enabling unauthorized access to critical operations. The issue ha...

A vulnerability has been identified in the poco-ai poco-claw's executor_manager API, specifically in the create_task function located in executor_manager/app/api/v1/tasks.py. This flaw allows for missing authentication, potentially enabling unauthorized access to critical operations. The issue ha...

A vulnerability has been identified in the poco-ai poco-claw's executor_manager API, specifically in the create_task function located in executor_manager/app/api/v1/tasks.py. This flaw allows for missing authentication, potentially enabling unauthorized access to critical operations. The issue ha...

A vulnerability has been identified in the poco-ai poco-claw's executor_manager API, specifically in the create_task function located in executor_manager/app/api/v1/tasks.py. This flaw allows for missing authentication, potentially enabling unauthorized access to critical operations. The issue ha...

A vulnerability has been identified in the poco-ai poco-claw's executor_manager API, specifically in the create_task function located in executor_manager/app/api/v1/tasks.py. This flaw allows for missing authentication, potentially enabling unauthorized access to critical operations. The issue ha...

The Hospital Bed Management System version 1.0 has a significant SQL injection vulnerability discovered in its login form component. By manipulating the Username argument, attackers can execute unauthorized SQL commands, allowing for remote exploitation. This vulnerability has been publicly discl...

A vulnerability exists in the liftoff-sr CIPster, specifically in the CipAppPath::deserialize_symbolic function located within source/src/cip/cipepath.cc. This issue allows manipulation that results in an out-of-bounds read, which could potentially be exploited remotely. The vulnerability affects...

A SQL injection vulnerability has been identified in the itsourcecode Hospital Management System version 1.0. The issue arises from an undisclosed function within the file /prescriptionorderdetail.php, where improper handling of the 'delid' argument creates an opportunity for attackers to execute...

The User Registration & Membership plugin for WordPress prior to version 5.2.3 has a security flaw that allows unauthenticated attackers to perform unauthorized actions. This weakness occurs due to the absence of capability checks for certain membership payment actions, which permits these attack...

The Royal Addons for Elementor plugin prior to version 1.7.1063 fails to validate the post status of menu items and associated templates in its REST endpoints. This oversight allows unauthenticated users to access the rendered HTML content of private or draft Elementor templates linked to non-pub...

The User Registration & Membership plugin for WordPress, prior to version 5.2.3, lacks proper validation of membership tiers during public registration. This oversight permits unauthenticated users to register for any available membership tier and receive its corresponding user role automatically...

The WPS Bookings for WooCommerce plugin prior to version 3.11.7 lacks proper checks to confirm if a booking order is associated with the user making the request. This flaw enables any authenticated user, including Subscribers and Customers, to cancel and void bookings made by other users, leading...

The AI Copilot WordPress plugin versions prior to 1.5.4 feature a critical OAuth access token vulnerability. This issue arises from the plugin's failure to correctly bind OAuth access tokens to individual WordPress users, resulting in the capability for unauthenticated attackers to exploit the pu...

The NEX-Forms plugin for WordPress, prior to version 9.2.3, is vulnerable due to inadequate sanitization and escaping of submitted form data. This weakness can allow an attacker to inject malicious scripts that are stored and executed in the admin dashboard when high-privileged users, such as adm...

The PhonePe Payment Solutions WordPress plugin versions prior to 3.1.0 fails to adequately verify the authenticity of incoming payment callbacks. This vulnerability arises when sites are configured through the current setup flow, leading to an empty secret for validating callback signatures. Cons...

The vulnerability in Bricks Builder, developed by Codeer Limited, allows for improper control of code generation, leading to code injection risks. This condition is particularly critical in versions ranging from n/a to 1.9.6. Attackers may exploit this weakness to execute arbitrary code on the se...

Apache ActiveMQ Broker is prone to a code injection vulnerability due to improper input validation in the Jolokia JMX-HTTP bridge. By default, this bridge exposes a web console that allows the execution of operations on all ActiveMQ MBeans. An authenticated attacker can exploit this vulnerability...

The Gitea Docker image is susceptible to a security issue where the configuration REVERSE_PROXY_TRUSTED_PROXIES is set to '*' by default. This improper configuration allows any source IP address to impersonate a user when reverse-proxy authentication headers, such as X-WEBAUTH-USER, are enabled. ...

A vulnerability in the Vertx Websocket component of Apache Camel allows for improper input validation and exposes sensitive information to unauthorized actors. The issue arises when inbound WebSocket parameters are incorrectly mapped to the Camel Exchange header map without applying necessary hea...

The Contest Gallery plugin for WordPress is exposed to a blind SQL injection vulnerability through the 'cgLostPasswordEmail' and 'cgl_mail' parameters in all versions up to and including 28.1.4. This vulnerability arises due to insufficient escaping of user-supplied input and a lack of proper san...

A heap-based buffer overflow vulnerability in Windows Message Queuing Queue Manager can allow an unauthorized attacker to execute arbitrary code locally. This flaw can potentially compromise the integrity and availability of the affected system, posing significant risks if not addressed. Timely u...

The vulnerability in Apache Camel CXF SOAP component stems from improper input validation, where the camel-cxf producer can be manipulated to invoke unintended SOAP operations based on the operationName and operationNamespace headers. An attacker can exploit this flaw by sending crafted HTTP requ...

A remote code execution vulnerability found in React Server Components allows attackers to exploit improperly handled payloads. This issue affects versions 19.0.0 through 19.2.0, compromising server function endpoints through unsafe deserialization of HTTP request payloads. As a result, this flaw...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

Grafana OnCall up to version 1.16.11 is susceptible to an unauthenticated access vulnerability that enables remote attackers to retrieve a valid PluginAuthToken. By exploiting a flaw in the internal plugin install endpoint and using hardcoded default stack_id and org_id values, attackers can gain...

The vulnerability affects the Realtek RtsPer and RtsUer drivers used in PCIe and USB card readers, respectively. It allows an attacker to leak driver logs that may expose kernel mode object addresses. The leakage of these addresses can compromise Kernel Address Space Layout Randomization (KASLR),...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

An out-of-bounds write vulnerability exists in the TIFF parsing component of libimagecodec.media.quram.so. This flaw allows remote attackers to exploit the system by writing to areas of memory that are not allocated for that purpose, potentially leading to arbitrary code execution or crashes. Use...

The FunnelKit WordPress plugin prior to version 3.15.0.6 suffers from a path traversal vulnerability. This issue arises when the plugin does not properly validate user-supplied paths during file deletion operations related to template imports. Administrators, if compromised, could exploit this vu...

The FunnelKit WordPress plugin versions prior to 3.15.0.6 are vulnerable to reflected cross-site scripting attacks due to improper handling of user-supplied parameters in its AJAX actions. This flaw enables unauthenticated attackers to inject malicious scripts that are executed in the context of ...

The RTMKit plugin for WordPress prior to version 2.0.9 is affected by an access control vulnerability. It fails to implement a necessary capability check for one of its AJAX actions, allowing users with just the Contributor role to exploit this flaw. This vulnerability enables them to gain unauth...

The RTMKit WordPress plugin prior to version 2.0.9 suffers from an authorization bypass vulnerability that permits users with Author role privileges to invoke a specific AJAX action. This flaw enables unauthorized users to create and activate site-wide templates, allowing them to modify critical ...

The Header Footer Builder plugin for Elementor allows users with the 'edit_posts' capability, such as Contributors, to import dashboard templates without proper administrative control. This oversight enables these users to inject potentially harmful JavaScript through an Elementor HTML widget. As...