Publicly Disclosed
PoC Exploits

The ElasticSearch Rest Client component of Apache Camel is vulnerable to improper input validation, leading to potential authorization bypass. It allows untrusted HTTP clients to manipulate several Exchange headers that control the component’s behavior, such as SEARCH_QUERY and OPERATION, without...

The Apache Camel PQC Component is susceptible to a vulnerability allowing deserialization of untrusted data. This occurs when the AwsSecretsManagerKeyLifecycleManager reads post-quantum key metadata from AWS Secrets Manager without adequate validation measures, enabling potential code execution w...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The GEN3C product from NVIDIA's Spatial Intelligence Lab is affected by a serious vulnerability that allows unauthenticated remote code execution. This flaw resides in the inference API server, specifically in the /request-inference and /seed-model endpoints, which utilize Python's pickle.loads()...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability has been identified in the CodeAstro Simple Online Leave Management System version 1.0, specifically within the POST Handler component located in the /SimpleOnlineLeave/admin/accept.php file. By manipulating the 'appid' parameter, an attacker may execute SQL injection attacks remo...

A vulnerability has been identified in the CodeAstro Simple Online Leave Management System 1.0, specifically within the file /SimpleOnlineLeave/admin/deletemp.php. This flaw allows attackers to manipulate the ID argument, leading to SQL injection attacks that can be executed remotely. The nature ...

A vulnerability has been identified in waooAI waoowaoo, specifically in the library function located in src/lib/api-auth.ts. This weakness affects key authentication processes including getInternalTaskSession, getAuthSession, requireUserAuth, and requireProjectAuth. Attackers can exploit this vul...

A vulnerability has been identified in Shibby Tomato firmware versions up to 1.28.0000, specifically within the CIFS Mount Handler function sub_2D048. This weakness allows for the manipulation of CIFS arguments, potentially resulting in remote OS command injection. The publicly available exploit ...

A security vulnerability has been identified in Shibby Tomato firmware versions up to 1.28.0000, affecting the function responsible for handling the execution of JFFS2 commands. This flaw allows an attacker to manipulate the argument within the jffs2_exec function, leading to potential remote OS ...

A significant out-of-bounds write vulnerability has been discovered in the Shibby Tomato firmware, specifically affecting the apcupsd component found in the file www/apcupsd/tomatodata.cgi. This flaw resides within the main function, allowing attackers to manipulate the flow of data, potentially ...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability has been identified in the Shibby Tomato firmware affecting the function getupsvar within the apcupsd component. The flaw, which leads to a stack-based buffer overflow, can be exploited remotely when malformed arguments are passed. This issue is particularly critical given its pub...

A vulnerability exists within the Tenda CH22 router, specifically in the formCertListInfo function located at /goform/CertListInfo. This issue arises due to improper handling of the argument Name, leading to a buffer overflow condition. An attacker can exploit this vulnerability remotely, potenti...

The Library Management System WordPress plugin, prior to version 3.5.8, is susceptible to a SQL injection vulnerability due to inadequate sanitization and escaping of user-supplied parameters. This flaw enables unauthenticated attackers to manipulate SQL queries and gain unauthorized access to se...

The Tutor LMS WordPress plugin prior to version 3.9.13 contains a significant security flaw that allows authenticated users, including those with subscriber-level access and above, to post comments without undergoing the appropriate authorization checks. This vulnerability enables the posting of ...

The Tutor LMS plugin for WordPress prior to version 3.9.13 is vulnerable due to a failure to adequately verify user permissions when saving content. This oversight allows authenticated users with instructor-level access to overwrite any post or page, disregarding the ownership of the content. Thu...

The Tutor LMS WordPress plugin prior to version 3.9.13 is vulnerable due to insufficient access control measures in its Droip and Kirki page-builder integrations. This vulnerability allows authenticated users with only subscriber-level access to enroll in paid or private courses without proper au...

The WP Job Portal plugin for WordPress prior to version 2.5.5 contains a vulnerability that fails to verify ownership when returning an employer's contact email for specific job listings. This weakness allows authenticated users with subscriber-level accounts to access and enumerate the private e...

The WP Job Portal WordPress plugin prior to version 2.5.5 has a serious flaw in its access control mechanisms. The plugin fails to adequately validate user capabilities or ownership, thereby allowing authenticated users with a subscriber-level account to perform job moderation actions. This could...

The Tutor LMS WordPress plugin prior to version 3.9.13 contains an access control flaw that allows authenticated users with subscriber-level permissions or higher to manipulate quiz attempts. This vulnerability enables these users to overwrite quiz marks and force-complete the assessment for othe...

A vulnerability exists in multiple WordPress form plugins, allowing unauthenticated users to inject arbitrary PHP objects through unserialized form-field values. When an administrator views the stored entry, these injected objects can be instantiated, potentially leading to unauthorized actions o...

The User Registration & Membership plugin for WordPress prior to version 5.2.2 has an authorization flaw that allows authenticated users to change the roles and membership tiers of other users. This occurs because the plugin does not adequately verify the identity of the user making the upgrade r...

The Breeze Cache plugin for WordPress is susceptible to unauthenticated Stored Cross-Site Scripting (XSS). This vulnerability arises from a predictable replacement hash utilized during the HTML minification process, allowing malicious actors to exploit a regular expression flaw. As a result, atta...

The User Registration & Membership plugin for WordPress prior to version 5.2.2 is vulnerable due to inadequate validation of incoming payment notifications from providers. This flaw allows an attacker to bypass payment verification and artificially trigger paid membership subscriptions, potential...

A vulnerability exists in the itsourcecode Hospital Management System, specifically in the file /patviewprescription.php. This issue arises from improper sanitization of the 'delid' argument, allowing attackers to perform SQL injection attacks. Such vulnerabilities can be exploited remotely, pote...

A vulnerability exists in the AkariAsai retrieval_lm component, specifically within the Indexer.deserialize_from function found in retrieval_lm/src/index.py. This flaw allows attackers to manipulate the index_meta.faiss argument, potentially leading to unsafe deserialization. The attack can be ex...

A significant security flaw has been identified in DedeCMS version 5.7.118, specifically within the Column Management feature located in the file /plus/search.php. This vulnerability allows an attacker to manipulate the Column Name argument, leading to the potential for remote code injection. Wit...

A vulnerability identified in HashNeRF-pytorch allows for local deserialization attacks via the 'torch.load' function in the Checkpoint File Handler. By manipulating the 'ckpt_path' argument, attackers can exploit this weakness, potentially leading to unauthorized access or system compromise. Thi...

The vm2 sandbox, which is designed to execute untrusted code while restricting access to host resources, faced a significant security flaw prior to version 3.9.15. This vulnerability arose from improper handling of host objects in the `Error.prepareStackTrace` function during unhandled asynchrono...

A vulnerability exists within the Attachment API of WuzhiCMS versions up to 4.1.0, specifically in the config/listimage function of the index.php file. This flaw allows remote attackers to manipulate the API, potentially leading to unauthorized information disclosure. Despite an early report of t...

A vulnerability has been identified in the lamaalrajih kicad-mcp project that affects the processing of certain files, specifically within the path_validator.py script. The flaw arises from the mishandling of input arguments related to project paths and schematic paths, leading to a failure in th...

A vulnerability exists in the better-auth better-icons component, specifically in the scan_project_icons/sync_icon function, which is subject to a path traversal attack. This vulnerability affects versions up to 1.0.5 and can be exploited locally by manipulating the icons_file argument. Although ...

A vulnerability has been identified in the augmnt augments-mcp-server version 7.1.0, specifically within the scanProjectDeps function located in the scan-project-deps.ts file. By manipulating the packageJsonPath argument, an attacker can perform path traversal, potentially exposing sensitive file...

A vulnerability exists in kLOsk Adloop versions up to 0.9.0, specifically in the _validate_urls function located in src/adloop/ads/write.py. This flaw allows an attacker to manipulate the final_url argument, potentially leading to server-side request forgery. The vulnerability can be exploited re...

The DBCPConnectionPool and HikariCPConnectionPool services in Apache NiFi versions 0.0.2 through 1.21.0 are susceptible to a vulnerability that allows an authenticated and authorized user to configure a Database URL leveraging the H2 driver, leading to potential execution of custom code. The reco...

A security vulnerability is present in versions up to 0.2.1 and 3.1 of the alioshr memory-bank-mcp. This flaw is rooted in the vulnerability of the list-project-files-validation-factory.ts file, where manipulation of the 'projectName' argument can lead to path traversal attacks. Local access to t...

A vulnerability exists in the CodeAstro Simple Online Leave Management System version 1.0 that allows for SQL injection via manipulation of parameters in the /SimpleOnlineLeave/admin/dashboard.php file. This issue can be exploited remotely, enabling attackers to execute arbitrary SQL queries with...

A security flaw has been identified in the tugcantopaloglu godot-mcp product version 2.0.0, specifically within the validatePath function located in build/index.js of the component run_project. The vulnerability allows for path traversal due to improper handling of the projectPath argument, which...

A path traversal vulnerability exists in the makafeli n8n-workflow-builder, specifically in the 'update_node_from_file' function of the server file. This issue allows an attacker to manipulate the 'filePath' argument, potentially leading to unauthorized access of restricted files and directories....

A vulnerability exists in the R2004 Section Decompression function of GNU LibreDWG version 0.13.4-154-g0b573035 that may lead to a heap-based buffer overflow if exploited. This issue requires local access to be successfully executed. The vulnerability is linked to the decompress_R2004_section fun...

A vulnerability exists in the usestrix strix product, specifically affecting the file system_prompt.jinja component within the PyPI Handler. This allows for the inclusion of functionality from untrusted control spheres, which may lead to unauthorized remote code execution. Although the exploit is...

An unrestricted file upload vulnerability exists in the Area 17 Twill CMS in the Media Library's FileLibraryController functionality. The vulnerability is triggered through improper handling of the input parameter 'qqfilename' in the 'storeFile' method located in the src/Http/Controllers/Admin/Fi...

A vulnerability in Jinher OA version 1.0 allows attackers to exploit an unknown function in the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx through the manipulation of the httpOID argument. This SQL Injection flaw enables remote exploitation, granting unauthorized access to users and poten...

A vulnerability exists in Metasoft's MetaCRM software versions up to 6.4.0 Beta06, specifically within the RPC call handling function. By manipulating the argument 'phprpc_args' within the RPCService.query interface located at /customizemt/xkq/rpc.jsp, an attacker can execute a SQL injection atta...

A security flaw has been identified in the Wavlink WL-NU516U1, which is caused by an OS command injection vulnerability in the wlink_uci_set_value function of the /cgi-bin/adm.cgi file. By manipulating the 'lan_ip' argument, an attacker can execute arbitrary commands on the device remotely. This ...

A code injection vulnerability has been identified in the Pig-mesh software, affecting version 3.9.2 and earlier. The flaw resides in the component pig-codegen, specifically within the GeneratorServiceImpl.java file. Due to this vulnerability, an attacker can manipulate specific functionalities t...

An OS command injection vulnerability exists in the Comfast CF-WR631AX V3, specifically in the system_wl_upload_pic_file function within the FastCGI Backend component. This vulnerability arises due to improper handling of the filename argument in the webmgnt interface, allowing an attacker to exe...

A vulnerability exists in the Leantime Project Management System versions up to 3.8.0, where the 'Setting::saveSetting' function in the API does not properly enforce authorization checks. This flaw allows remote attackers to exploit the vulnerability, potentially manipulating critical configurati...

A remote vulnerability exists in the Leantime project management system, specifically affecting versions up to 3.8.0. This flaw involves the JSON-RPC endpoint's editUser/addUser function, where improper authorization due to inadequate role manipulation can be exploited. Despite the vendor being n...