Publicly Disclosed
PoC Exploits

The Post Status Notifier Lite WordPress plugin prior to version 1.13.0 is susceptible to a reflected Cross-Site Scripting (XSS) vulnerability. This occurs due to insufficient sanitization of the `mod` URL parameter when reflected on the admin settings page. An attacker can exploit this vulnerabil...

The WP Compress plugin for WordPress prior to version 7.10.04 is susceptible to a Reflected XSS vulnerability due to improper validation of a query parameter that directs the asset CDN host. This security flaw allows attackers to manipulate script URLs, injecting malicious JavaScript that execute...

The Security Ninja Premium WordPress plugin versions prior to 5.290 have a significant flaw in their two-factor authentication implementation. An unauthenticated attacker equipped with a user's password can bypass the required one-time code needed for authentication. This vulnerability compromise...

The Praison AI SEO WordPress plugin versions prior to 5.0.7 contain an authorization bypass vulnerability that permits unauthorized users to modify permalinks for published posts. Additionally, this flaw enables access to sensitive configuration data within the plugin, which could compromise site...

XAML Diagnostics Elevation of Privilege Vulnerability

Pdfminer.six, an open-source library for extracting information from PDF documents, is vulnerable to arbitrary code execution due to improper handling of malicious pickle files embedded in specially crafted PDF files. Specifically, the issue arises from the `CMapDB._load_data()` function that uti...

An unauthenticated remote code execution vulnerability in Orkes Conductor versions prior to 3.30.2 could allow remote attackers to execute arbitrary operating system commands by submitting malicious JavaScript or Python expressions through workflow definitions to the workflow API endpoint without...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

The experimental SQL Expressions feature in Grafana enables users to evaluate `duckdb` queries which can contain user input. However, the queries are inadequately sanitized prior to being processed by `duckdb`, creating a vulnerability that could lead to command injection and local file inclusion...

A vulnerability has been identified in the facil.io library, affecting versions up to 0.7.4. The flaw resides in the websocket_on_protocol_error function located in the websocket_parser.h file. This vulnerability arises from improper input validation when manipulating the argument on_message, all...

A vulnerability has been identified in the publint package manager affecting versions up to 0.1.4. This vulnerability is linked to the child_process.exec function within the src/node/pack.js file. It enables an attacker to execute arbitrary operating system commands through manipulated input. The...

A security vulnerability has been discovered in Syncfusion's EJ2 JavaScript UI Controls that allows for an OS command injection via the child_process.exec function in package.json. This vulnerability is present in versions up to 33.2.3. Attackers must exploit this vulnerability locally to manipul...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A security vulnerability exists in oclif versions up to 4.23.16, allowing local users to exploit the 'child_process.exec' functionality in the JIT Plugin Entry Handler. By manipulating the 'jitPlugins' argument, an attacker can execute arbitrary operating system commands, potentially leading to u...

The XZ utility has been compromised due to malicious code introduced in the upstream tarballs starting from version 5.6.0. A sophisticated obfuscation technique is employed where the liblzma build process extracts a prebuilt object file hidden within a disguised test file in the source code. This...

A null pointer dereference vulnerability was identified in the Thor Vector Graphics Engine (ThorVG) prior to version 1.0.5. This vulnerability can cause the engine to crash when untrusted SVG data is processed through the Picture::load() function via the SvgLoader::run(). Attackers can exploit th...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

The Apache Camel Undertow Component contains a vulnerability that allows unauthorized clients to receive detailed error messages, including Java stack traces, during route processing failures. This occurs due to a misconfiguration of the muteException option, which defaults to false. This can lea...

In the Apache Camel framework, the Iggy component has a vulnerability that allows unauthorized actors to exploit improper input validation, resulting in Server-Side Request Forgery (SSRF) and exposure of sensitive information. The issue arises as the Iggy component does not filter Camel-internal ...

A vulnerability in the Atmosphere Websocket Component of Apache Camel allows attackers to exploit improper input validation in inbound WebSocket queries. The absence of a HeaderFilterStrategy enables clients to inject control headers into the Camel Exchange. This results in potential server-side ...

Pdfminer.six, an open-source library for extracting information from PDF documents, is vulnerable to arbitrary code execution due to improper handling of malicious pickle files embedded in specially crafted PDF files. Specifically, the issue arises from the `CMapDB._load_data()` function that uti...

The Onlook product version 0.2.32 has a broken object level authorization vulnerability, allowing authenticated attackers to exploit tRPC API endpoints. By supplying arbitrary UUID values to procedures such as project.get, member.remove, and chat.conversation.delete, attackers can gain unauthoriz...

InvokeAI prior to version 6.13.7 presents a vulnerability in the /api/v2/models/scan_folder endpoint, which allows unauthenticated users to exploit the scan_path parameter. This flaw permits attackers to recursively enumerate server filesystem directories, effectively exposing sensitive informati...

Froiden TableTrack versions up to 1.3.10 are susceptible to a stored cross-site scripting vulnerability through the order notes field. This flaw permits unauthenticated attackers to inject arbitrary HTML and JavaScript into the application, allowing for malicious payloads to execute within the ad...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The vulnerability allows an attacker to send specially crafted payloads to Microsoft Office SharePoint, potentially resulting in unauthorized remote code execution. This security flaw occurs due to the improper handling of untrusted data. If exploited, it could enable malicious actors to execute ...

The EPyT-Flow Python package, which facilitates the generation of hydraulic and water quality scenario data for water distribution networks, contains a vulnerability that enables remote code execution. Prior to version 0.16.1, the package's REST API incorrectly processes attacker-manipulated JSON...

The CVE-2024-27867 vulnerability affects a wide range of Apple’s wireless audio devices, including AirPods (2nd generation and later), AirPods Pro (all models), AirPods Max, Powerbeats Pro, and Beats Fit Pro. It allows an attacker within Bluetooth range to spoof the intended source device and gai...

The Events Manager plugin for WordPress versions prior to 7.3.7 is vulnerable due to improper handling of booking-registration data in No-User-Account Booking Mode. Specifically, a registration field supplied by the booker is stored as booking metadata and later deserialized without restrictions ...

The Timetics WordPress plugin, prior to version 1.0.57, has a significant vulnerability that allows unauthorized users to create fully-approved bookings for paid appointments. This occurs due to the lack of enforcement of a pending or unpaid status for new bookings made through unsupported paymen...

The Product Addons and Product Options With Custom Fields plugin for WordPress prior to version 1.6.15 is susceptible to an unauthenticated file upload vulnerability. This flaw allows attackers to exploit a file-upload endpoint that fails to properly restrict access, letting an unauthenticated us...

A SQL injection vulnerability exists in Nessus that allows attackers to create a harmful scan result file. When a privileged user imports this file, it may result in malicious SQL being injected into the scan results database. This exploitation could lead to unauthorized access and potential data...

A vulnerability in WordPress allows for potential SQL Injection due to improper sanitization of the author__not_in parameter in WP_Query. When untrusted input is passed to this parameter via a plugin or theme, it could lead to unauthorized database queries. Affected versions include WordPress 6.8...

A vulnerability in WordPress allows for potential SQL Injection due to improper sanitization of the author__not_in parameter in WP_Query. When untrusted input is passed to this parameter via a plugin or theme, it could lead to unauthorized database queries. Affected versions include WordPress 6.8...

Craft CMS, a customizable content management system, has a remote code execution vulnerability present in specific versions. Attackers could exploit this flaw to execute arbitrary code on the server, posing a significant security risk. The affected versions span from 3.0.0-RC1 to just before 3.9....

A security weakness has been discovered in the GIT File Helper component of umijs. Specifically, the function git.getFileCreateInfo located in packages/utils/src/getFileGitIno.ts is susceptible to OS command injection. This vulnerability could enable attackers to execute arbitrary commands on the...

A security vulnerability has been identified in itsourcecode Hospital Management System 1.0, specifically within an unspecified function of the /prescription.php file. This flaw allows attackers to inject malicious SQL queries through the manipulation of the 'editid' argument, leading to potentia...

A vulnerability has been discovered in the jsforce library, specifically in the function _execCommand located in lib/registry/sfdx.js. This flaw allows for os command injection, posing a risk to local environments where the code is executed. Exploitation of this vulnerability can lead to unauthor...

A security flaw was identified in QUSETIONS MiniCode-Python version 0.1.0, specifically impacting the subprocess.Popen function within the Project File Handler component. This vulnerability allows for potential OS command injection, creating a pathway for attackers to execute arbitrary commands o...

A vulnerability exists in SourceCodester's Class and Exam Timetabling System 1.0 within the /BSIS.php file. This vulnerability enables an attacker to manipulate the 'day' argument, which can lead to Cross Site Scripting (XSS) attacks. Since the exploit can be initiated remotely, it poses a signif...

A cross site scripting vulnerability exists in the SourceCodester Class and Exam Timetabling System 1.0, specifically related to the manipulation of the 'day' argument in the /class.php file. This flaw enables an attacker to execute arbitrary scripts in the user's browser, which can compromise se...

The Apache Camel Keycloak Component contains a vulnerability where improper authentication leads to potential unauthorized access. The KeycloakSecurityPolicy’s default configuration may allow requests with invalid tokens to bypass checks entirely. This means that as long as a request carries a no...

A vulnerability has been identified in the SourceCodester Class and Exam Timetabling System 1.0, specifically within the /edit_subjecta.php file. This vulnerability allows for SQL injection attacks through manipulation of the argument ID, potentially enabling an attacker to execute arbitrary SQL ...

The Autel Maxi Charger Single firmware version V1.03.51 contains a significant vulnerability that allows unauthorized access to the NXP i.MX6 recovery mode via exposed hardware recovery pins. This flaw permits attackers with physical access to execute malicious code, enabling them to modify or ex...

A vulnerability exists within the ngx_http_dav_module of NGINX Open Source and NGINX Plus that can be exploited to trigger a buffer overflow in the NGINX worker process. This scenario is possible when configuration files utilize the DAV module's MOVE or COPY methods combined with specific prefix ...

A SQL injection vulnerability exists within Aptabase's ClickHouse query backend, stemming from commit 5a89368. This flaw enables authenticated attackers to exploit unsanitized filter parameters in Liquid SQL templates, allowing unauthorized access to event data across multiple tenants. By manipul...

The XZ utility has been compromised due to malicious code introduced in the upstream tarballs starting from version 5.6.0. A sophisticated obfuscation technique is employed where the liblzma build process extracts a prebuilt object file hidden within a disguised test file in the source code. This...

The djangoSIGE product, up to version 1.10, contains a vulnerability that allows unauthenticated attackers to exploit the ForgotPasswordView functionality. By interacting with the password reset endpoint, attackers can submit arbitrary usernames or email addresses and determine if they correspond...

Linknat VOS3000 and VOS2009 versions up to 2.1.2.0 are susceptible to an unauthenticated SQL injection vulnerability via the login endpoint's name parameter. This flaw allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive data. By manip...

Linknat VOS3000 and VOS2009 versions up to 2.1.2.0 are susceptible to an unauthenticated SQL injection vulnerability via the login endpoint's name parameter. This flaw allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive data. By manip...