Publicly Disclosed
PoC Exploits

Certain KGUARD DVR devices with outdated firmware exhibit a serious vulnerability, exposing a system command execution service on all network interfaces without authentication. This flaw enables remote attackers to execute arbitrary commands, potentially compromising the device entirely. Exploits...

The Windows Cloud Files Mini Filter Driver contains a vulnerability due to missing authentication for critical functions. This flaw allows an unauthorized attacker to perform local tampering, which can impact the integrity of files and data within the affected operating systems, such as Windows 1...

The KeePass password manager, specifically versions 2.35 through 2.61.1, contains a vulnerability that stems from inadequate validation of KDBX header field sizes during memory allocation. This flaw allows attackers to create specially crafted KDBX files that specify excessively large header fiel...

The WooCommerce WordPress plugin prior to version 2.0.2 is susceptible to a file upload vulnerability due to its failure to validate the types of files that can be uploaded when its accepted-types setting is left empty. This lack of validation opens the door for unauthenticated attackers to uploa...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The Contact Form 7 Captcha plugin for WordPress contains a vulnerability that allows unauthenticated users to exploit the shortcode parser functionality. Specifically, earlier versions of the plugin, prior to 0.1.9, process the entire Contact Form 7 form’s output, which includes user-submitted da...

The WP Express Checkout plugin for WordPress prior to version 2.5.0 is susceptible to a significant security flaw that fails to properly validate the completion of payment transactions on the server-side. This oversight allows unauthorized users to simulate the payment process, marking orders as ...

The CleanTalk WordPress plugin prior to version 6.87 is susceptible to an arbitrary shortcode execution vulnerability. This flaw allows unauthenticated users to submit comment content that is processed by the WordPress shortcode engine. As a result, malicious visitors can register and execute arb...

The Hustle plugin for WordPress prior to version 7.8.14.2 contains a security flaw that permits unauthenticated users to execute shortcodes through form submissions. The plugin fails to sufficiently sanitize shortcodes in user-provided input, allowing potential attackers to exploit this weakness ...

The WPLP Cookie Consent plugin for WordPress prior to version 4.4.2 suffers from an access control weakness due to the absence of nonce and capability checks on various AJAX actions. This flaw permits any authenticated user, including those with minimal privileges such as subscribers, to gain una...

The Orbit Fox plugin for WordPress, prior to version 3.0.9, is susceptible to a Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate validation of user-supplied HTML tag names within specific Beaver Builder widgets. As a result, users possessing contributor-level access or h...

The Kirki WordPress plugin, prior to version 6.3.0, contains a vulnerability that allows unauthenticated users to access private content. This issue arises because the plugin fails to verify whether a requester is authorized to view certain pages, including those marked as private, draft, or tras...

The Quentn WP plugin for WordPress prior to version 1.2.15 is vulnerable due to improper sanitization and escaping of user input in SQL queries. This flaw can allow high privilege users, such as administrators, to execute malicious SQL commands, potentially compromising the integrity of the datab...

The Sunshine Photo Cart plugin for WordPress prior to version 3.7 is susceptible to a vulnerability that arises due to insufficient validation of client-supplied price identifiers. This flaw allows unauthenticated users to manipulate price information during the cart process, enabling them to pur...

The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.2, is susceptible to an improper authentication vulnerability. This flaw stems from the inadequate implementation of nonce and capability checks in a specific AJAX action related to its cookie scanner functionality. As a result, a...

The Masteriyo LMS WordPress plugin prior to version 3.4.0 is susceptible to improper access control, as it fails to verify user authorization before disclosing course enrollment records through its REST API. This vulnerability enables unauthorized users to access sensitive information, including ...

The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.2, is vulnerable due to the lack of capability and nonce checks in its A/B testing actions. This oversight allows authenticated users, including those with minimal privileges like subscribers, to alter the cookie banner settings t...

The Sina Extension for Elementor, a popular WordPress plugin, is vulnerable to Stored Cross-Site Scripting due to inadequate escaping of HTML attributes in the Table widget settings. This flaw could be exploited by users with Contributor roles or higher to inject malicious scripts, potentially co...

The Quentn WP WordPress plugin, prior to version 1.2.15, has a critical vulnerability that arises from improper escaping of request parameters in SQL queries. This flaw enables unauthenticated attackers to exploit the plugin, allowing them to perform SQL injection attacks. As a consequence, they ...

The SupportCandy WordPress plugin prior to version 3.5.3 contains a vulnerability that fails to validate submitted authorization codes for individual support tickets. As a result, unauthenticated users can read the confidential content of any support ticket without proper authorization. This flaw...

The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.2, is susceptible to an authorization flaw, lacking necessary CSRF checks when handling visitor consent states. This vulnerability allows unauthenticated attackers to manipulate site-wide options, posing a significant risk by over...

The Groundhogg WordPress plugin, before version 4.7.2, is susceptible to an improper redirect vulnerability. This flaw allows attackers to manipulate the email preference confirmation flow, leading to the potential redirection of unsuspecting users to arbitrary external URLs. By crafting maliciou...

The SupportCandy plugin for WordPress prior to version 3.5.3 lacks sufficient authorization checks for its ticket attachment download functionality. This oversight permits unauthorized attackers to access and download sensitive customer-uploaded attachments by simply enumerating the sequential id...

The Ultimate Gift Cards for WooCommerce WordPress plugin lacks a robust mechanism to ensure that gift card redemptions are performed by the rightful recipients. This vulnerability permits any authenticated user, including subscribers, to redeem gift cards that belong to other users. As a result, ...

The Payment Plugins for PayPal WooCommerce plugin, prior to version 2.0.26, lacks proper validation of the order key when adding order data to the JavaScript configuration output on the front end. This oversight allows unauthenticated users to access sensitive information by sequentially iteratin...

A security flaw in the Payment Plugins for Stripe WooCommerce WordPress plugin prior to version 4.0.12 allows unauthenticated users to access sensitive billing information. This vulnerability arises from insufficient validation of the order key, which enables attackers to iterate through order id...

The WP Travel plugin for WordPress versions prior to 12.0.2 is susceptible to an authorization bypass vulnerability. This issue allows unauthenticated attackers to cancel payment transactions linked to customer bookings through specific front-end payment-message handlers. As a result, any unautho...

The Payment Plugins for PayPal WooCommerce WordPress plugin prior to version 2.0.26 suffers from an improper authorization vulnerability. This flaw allows any authenticated user, including subscribers, to link another user's stored payment method to their own account without adequate verification...

The Loops & Logic plugin for WordPress, prior to version 4.3.0, contains a vulnerability that fails to restrict access to its public template-data action. This design flaw enables unauthenticated users to gain access to sensitive user data, including email addresses and roles, as well as arbitrar...

The ELEX WooCommerce Request a Quote plugin before version 2.4.1 contains a vulnerability that arises from improper sanitization and escaping of parameters in an SQL query. This flaw allows unauthenticated attackers to execute SQL injection attacks, potentially gaining unauthorized access to sens...

The WP Travel plugin for WordPress, prior to version 12.0.2, contains a vulnerability that fails to securely verify the owner of a booking when a bank-deposit slip submission is made. This flaw enables unauthenticated attackers who are aware of a target customer's email address to manipulate the ...

The WP Travel plugin for WordPress contains a security flaw that permits an unauthorized individual to reset a customer's booking payment status to unpaid. By exploiting the vulnerability, attackers, equipped with only the target customer's email address, can bypass proper authorization checks in...

The Content Mask plugin for WordPress prior to version 1.8.5.6 is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate sanitization and escaping of content submitted through posts. This vulnerability enables users with minimal privileges, such as Contributors, to inject malicious sc...

A type confusion vulnerability has been identified in the V8 JavaScript engine of Google Chrome. Prior to version 152.0.7977.82, this flaw allows malicious attackers to execute arbitrary code within the browser's sandbox environment by crafting a specially designed HTML page. This vulnerability p...

ProFTPD, a popular FTP server software, is susceptible to multiple stack-based buffer overflow vulnerabilities due to improper handling of the TELNET IAC escape character in the 'pr_netio_telnet_gets' function. These vulnerabilities allow remote attackers to exploit the flaws, potentially leading...

A significant security issue has been identified in the moltis product, specifically in the vault_unlock_handler/vault_recovery_handler functions located in the vault.rs file. This vulnerability allows malicious actors to exploit the affected components remotely, leading to a missing authenticati...

A vulnerability has been identified in Cesanta mJS up to version 1.26, specifically within the 'skip_spaces_and_comments' function in src/mjs_tok.c. This issue allows for a heap-based buffer overflow, which can be exploited remotely. The vulnerability has been publicly disclosed, and potential at...

A vulnerability exists in the itsourcecode Sales and Inventory System version 1.0, specifically in the /pages/us_edit.php file. This flaw allows for manipulation of the argument 'ID,' leading to potential SQL injection attacks. Attackers can exploit this vulnerability remotely, leveraging publicl...

The All-in-One WP Migration and Backup plugin for WordPress contains a SQL injection vulnerability due to inadequate input escaping during the archive restore process. This flaw allows unauthenticated attackers to insert malicious SQL commands into existing queries. As a result, they can potentia...

Roo-Code prior to version 3.54.0 contains a vulnerability that enables attackers to bypass the auto-approve mechanism, facilitating unauthorized execution of shell commands. By exploiting a word-boundary mismatch in comment processing between the approval gate's shell parser and bash, attackers c...

Roo-Code version 3.54.0 is affected by an auto-approve bypass vulnerability in its shell command parsing logic. This flaw allows malicious actors to exploit the omission of the bash pipe operator in the command parser's token set. By crafting specific command lines that include an allowlisted pre...

A session fixation vulnerability exists in the ningzichun Student Management System due to improper handling of session initialization within the login.php file's session_start function. This flaw allows an attacker to hijack active user sessions by manipulating session identifiers. Remote exploi...

A vulnerability exists in the ningzichun Student Management System's database connection functionality, specifically in the mysqli_connect function located in config/database.php. This issue allows attackers to exploit hard-coded credentials, potentially enabling unauthorized remote access to the...

Adobe Commerce has a vulnerability that allows for improper neutralization of special elements used in a template engine, potentially leading to arbitrary code execution in the context of the current user. An attacker can exploit this issue without requiring any user interaction, posing significa...

An information disclosure vulnerability has been detected in the ningzichun Student Management System, particularly within the Backup Handler component. The weakness resides in an unknown function of the example.7z file, allowing unauthorized remote access to sensitive information. As the system ...

A significant security vulnerability exists in the aircheng-org iWebShop-5 platform, specifically in the Authentication Storage feature located in the controllers/admin.php file. This flaw allows an attacker to manipulate the argument for passwords, potentially leading to the use of weak password...

A vulnerability has been identified in iWebShop-5 up to version 5.15, specifically affecting the Login function in the controllers/systemseller.php file. An attacker can manipulate the 'Name' argument to bypass authentication, allowing unauthorized access. This flaw can be exploited remotely, pos...

Adobe Commerce has a vulnerability that allows for improper neutralization of special elements used in a template engine, potentially leading to arbitrary code execution in the context of the current user. An attacker can exploit this issue without requiring any user interaction, posing significa...

A vulnerability in the Windows Kernel allows an authorized attacker to exploit an untrusted pointer dereference, potentially enabling them to gain higher privileges on the affected system. This could lead to unauthorized access to sensitive data and administrative functionalities. It's critical f...

A security vulnerability has been identified in the iWebShop-5 application provided by aircheng-org, specifically in versions up to 5.15. The vulnerability arises from the improper handling of the 'outerSrc/selectPhoto' argument within the 'uploadFile' function found in 'controllers/pic.php'. Thi...