Publicly Disclosed
PoC Exploits

A security vulnerability has been identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P devices, specifically within the Cloud Management component. The flaw arises due to improper handling of the 'url' argument in the file set_cloud_serverUrl.cgi. This vulner...

A vulnerability has been detected in specific models of Ruijie RG-ES series switches, notably affecting the Local Firmware Upgrade Interface via the httpupg.cgi file. This issue can lead to a buffer overflow, allowing attackers to execute remote exploits. The vulnerability is already publicly kno...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A significant vulnerability has been identified in WAVLINK WN553X1-B routers, specifically in the WireGuard CLI Group Handler component. This issue arises from improper handling of user input in the function sub_41A748 found in the /bin/ioos file. By manipulating either the group_id or group_name...

A memory overflow vulnerability exists in the NetScaler ADC and Gateway products by Citrix, specifically when configured as a SAML Service Provider (SP) or Identity Provider (IdP). This flaw allows an attacker to potentially execute arbitrary code remotely or cause a denial of service, impacting ...

A security flaw in the WAVLINK WN553X1-B router's firmware version V260403_2.0.0 allows remote attackers to execute arbitrary commands via manipulated arguments in the WireGuard CLI Handler. Specifically, the defect resides in the sub_419DA8 function of the /bin/ioos file, facilitating OS command...

A remote exploitation vulnerability has been identified in the WAVLINK WN553X1-B router, specifically affecting version 260403_2.0.0. This security flaw exists within the 'ovpn_file' handler, particularly in the 'sub_4162A8' function, where improper handling of the 'file_id' argument allows for O...

A vulnerability exists in the ag-ui-protocol affecting versions up to 0.0.58, specifically in the Interrupt expiry component's function isInterruptExpired. This flaw allows for potential remote exploitation that may lead to excessive resource consumption, creating significant performance issues. ...

A vulnerability has been identified in the ag-ui-protocol's ag-ui up to version 0.0.58, specifically within the Transport Decoder Handler component. This issue arises from improper input validation mechanisms, which could be exploited remotely by attackers. Public knowledge of the exploit allows ...

A vulnerability has been identified in the ag-ui-protocol ag-ui product, specifically within the SSE Parser component’s parseSSEStream function in the sse.ts file. This vulnerability allows for remote manipulation resulting in excessive resource consumption. Attackers could exploit this issue fro...

A weakness has been identified in the ag-ui-protocol's HTTP Transport component, specifically impacting the 'e.text' function. This vulnerability allows attackers to execute remote manipulations, leading to significant resource consumption on affected systems. The exploit is currently publicly av...

A security vulnerability exists in the ag-ui-protocol ag-ui product that affects versions up to 0.0.58. This vulnerability resides in an unknown function of the HttpAgent component, specifically within the file sdks/typescript/packages/client/src/agent/http.ts. When exploited, it can lead to unau...

A vulnerability has been detected in Horizon DataSys Reboot Restore Standard versions up to 13.2, specifically within the function sub_23908 of the kernel driver shield.sys. This flaw leads to memory corruption, which can be exploited locally by an attacker. Publicly available exploit techniques ...

A serious vulnerability exists in BuddyPress that allows for Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This flaw can lead to unauthorized access to sensitive information stored in the database, exposing users to potential data breaches. The issue...

A command injection vulnerability exists in the OpenVPN CLI Handler of WAVLINK's WN553X1-B device. The flaw, located in the function sub_416568 of the '/bin/ioos' file, arises from improper handling of the argument 'file_id'. This vulnerability can be exploited remotely, allowing attackers to exe...

An OS command injection vulnerability exists in the WAVLINK WN701AE's ioos Web Backend component, specifically within the del_vlan_group function. By manipulating the vlan_name argument, an attacker can execute arbitrary commands on the operating system. This flaw enables remote exploitation, pos...

A vulnerability exists in the WAVLINK WN553X1-B router, specifically affecting version 260403_2.0.0. An issue related to the 'sub_416B50' function in the '/bin/ioos' file allows an attacker to manipulate the 'file_id' argument, leading to operating system command injection. This vulnerability can...

A vulnerability exists in the WAVLINK WN553X1-B router that allows for os command injection via the ioos Service. This flaw is triggered through manipulation of the group_id or group_name parameters, which can lead to unauthorized remote command execution. The exploitation of this vulnerability p...

The WAVLINK WN701AE device contains a vulnerability in the function del_staticrule of the static_route_setting.sh component within its ioos Web Backend. This vulnerability allows attackers to manipulate the argument 'rule_name', potentially leading to OS command injection. As a result, the device...

An HTTP request smuggling vulnerability exists in Citrix NetScaler ADC and Gateway due to inconsistent handling of HTTP requests. This flaw can allow an attacker to exploit the application's behavior when processing requests, potentially leading to unauthorized access or data manipulation. The vu...

A vulnerability exists in the Oray Pugongying X5 Pro Router versions up to 7.6.1, specifically within the 'config_restore_ex' function located in the '/etc/openwrt_release' file. This vulnerability allows an attacker to manipulate the filename argument, potentially enabling relative path traversa...

A security flaw has been identified in the Oray Pugongying X5 Pro up to version 7.6.1, specifically affecting the API Authorization functionality within the run_apis_by_json and run_async_task components. This vulnerability allows for improper authorization, enabling potential remote exploitation...

A vulnerability has been found in the Oray Pugongying X5 Pro that affects its session ID handling mechanism. Specifically, the issue exists in the 'session_get' function within the 'session.lua' file of the Session ID Handler component. The flaw arises from the manipulation of the '_user' argumen...

Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthenticated attacker to gain full access to th...

The MapPress plugin for WordPress prior to version 2.97.15 contains a vulnerability that fails to restrict data access in its front-end map embed handler. This flaw enables unauthenticated users to access sensitive information, specifically the email addresses and display names of registered user...

The Media Library Assistant plugin for WordPress is vulnerable due to improper escaping of shortcode attributes before rendering them in generated links. This flaw allows users with Contributor roles and above to conduct Stored Cross-Site Scripting (XSS) attacks, potentially compromising site sec...

The Media Library Assistant plugin for WordPress prior to version 3.44 has a security flaw that allows authenticated users to gain unauthorized visibility of taxonomy terms associated with private attachments and posts. This vulnerability arises because the plugin fails to appropriately verify us...

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin prior to version 2.4.30 is vulnerable to improper access control. This issue arises when the plugin's test-email handler processes requests without adequately checking user capabilities. It leverages a nonce that any logged-in...

The Kali Forms plugin for WordPress, prior to version 2.4.30, contains a security flaw where it fails to conduct proper capability checks on its test email feature. This allows users with low privileges, such as Subscribers, to exploit a nonce available to any logged-in user. Consequently, they c...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability exists in the GStreamer gst-plugins-good package where the rtph264depay and rtph265depay RTP depayloader elements fail to enforce a limit on the size of the reassembly buffer utilized during the processing of fragmented RTP packets. This flaw permits a remote, unauthenticated atta...

A command injection vulnerability exists in the WAVLINK WL-WN530BE1-A router's con_check_read_finish function located in the /protocol.csp file. This flaw allows attackers to manipulate the argument group_name/IP-FROM, potentially leading to remote command execution. The vulnerability has been di...

A vulnerability in the WAVLINK WL-WN530HG4B router allows for OS command injection through the manipulation of the 'Name' argument in the port_forward function located in /cgi-bin/wapi.cgi. This security flaw permits remote attackers to exploit the device, potentially gaining control and executin...

A security flaw has been identified in the WAVLINK WN579X3-D router, specifically within the port_forward function in the /cgi-bin/wapi.cgi file. The vulnerability allows an attacker to manipulate the 'Name' argument, resulting in OS command injection that can be exploited remotely. This could al...

A path handling issue in macOS allows a malicious application to improperly validate file paths, potentially enabling the app to gain root privileges. This vulnerability has been addressed with enhanced validation mechanisms in recently released versions of macOS, specifically in Golden Gate 27.2...

A security vulnerability has been discovered in the WAVLINK WL-WN579A3-A router's Initial Setup Wizard. The specific function affected is set_wzdgwMesh, located in the /cgi-bin/adm.cgi file. This vulnerability allows remote attackers to exploit the system by manipulating the wlan_ssid argument, l...

A vulnerability has been identified in Presenton, impacting versions up to 0.9.11-beta, specifically related to the Desktop Authentication Middleware. This issue arises within the /app_data directory, enabling unauthorized information disclosure. The vulnerability can be exploited remotely, allow...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability has been discovered in Presenton versions up to 0.9.11-beta, affecting its API component. This flaw allows for missing authentication, enabling potential unauthorized remote access. Attackers could exploit this weakness due to the public availability of the exploit. It is crucial ...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

An integer overflow exists in the remote-control screen processing component of TeamViewer clients, potentially allowing malicious remote hosts to induce denial of service or, in some scenarios, execute arbitrary code with the viewer process privileges. Successful exploitation necessitates that a...

A vulnerability in the Linux kernel related to posix CPU timers can lead to a use-after-free condition due to a race in non-leader exec() scenarios. When a timer associated with a process is deleted while concurrently executing an exec() command, it can cause access to freed memory. Specifically,...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A vulnerability exists in Apache HTTP Server that causes a NULL pointer dereference in the mod_xml2enc module. This issue can be exploited by an untrusted backend server, potentially leading to a denial of service condition due to an improperly handled charset conversion in proxied responses. Use...

A significant vulnerability exists in Grafana where users with editing permissions can exploit an integration's legacy schema version to alter protected settings. This can lead to unintended modifications of essential contact point configurations, including destination URLs. Consequently, this ex...