Publicly Disclosed
PoC Exploits

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A deserialization vulnerability exists in the License Servlet of Fortra's GoAnywhere MFT. This flaw permits an attacker with a forged license response signature to deserialize a potentially arbitrary actor-controlled object, which may lead to command injection exploits.

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A cross-site scripting vulnerability exists in the Add Product Page component of Configuroweb's Inventariobasico. This issue arises from improper handling of input arguments in the addlist.php file, allowing attackers to inject malicious scripts. As the product follows a rolling release model, us...

A critical weakness has been identified in the D-Link DIR-505 version 1.10B02, specifically within the web management interface. The flaw exists in the 'main' function of the secmark1524.cgi file, which accepts user input parameters (accu, pass, code, hash, cmds) without proper validation. This o...

A security flaw has been identified in the Request Forwarder component of maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8. This issue allows for local network attacks that can exploit the vulnerability to disclose sensitive information. Although the project was made aware of the repor...

A vulnerability has been discovered in the maotoumao MusicFreeDesktop application, specifically within the Request Forwarder component. This issue enables attackers to perform server-side request forgery, which could allow malicious users to send unauthorized requests from the vulnerable server t...

Apple addressed a permissions issue that allowed unauthorized access to sensitive user data. This has been rectified in recent updates to iOS and iPadOS, along with other operating systems like tvOS, visionOS, and watchOS. Users are strongly encouraged to upgrade to the latest versions to ensure ...

The Salon Booking System plugin for WordPress is susceptible to an arbitrary file deletion vulnerability across all versions up to and including 9.8. This vulnerability arises from inadequate validation of uploaded file paths before deletion. As a result, this flaw can be exploited by unauthentic...

The Tutor LMS plugin for WordPress is susceptible to unauthorized data access due to a missing capability check across multiple functions. This vulnerability allows unauthenticated attackers the ability to add, modify, or delete data. The issue affects all versions of the Tutor LMS plugin up to a...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

The Sourcecodester Stock Management System version 1.0 contains a vulnerability that allows attackers to execute arbitrary SQL commands through the 'editCategories.php' page. This SQL injection flaw can lead to unauthorized access to sensitive data, modification of database content, and potential...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability exists in the Web Directory Free WordPress plugin prior to version 1.7.0, where an insufficient sanitization process allows for the exploitation of SQL commands through an AJAX action that is accessible to unauthenticated users. This weakness enables attackers to perform various S...

The Country State City Dropdown CF7 plugin for WordPress is exposed to an SQL Injection vulnerability, allowing attackers to exploit the 'cnt' and 'sid' parameters due to inadequate escaping of user-supplied input and insufficient preparation in the SQL query. This vulnerability enables unauthori...

The Contact Form Plugin by Fluent Forms is susceptible to a privilege escalation vulnerability stemming from a lack of appropriate capability checks in the /wp-json/fluentform/v1/managers REST API endpoint. This issue allows unauthenticated attackers to assign management permissions to any user, ...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

LibreNMS versions prior to 26.8.0 are susceptible to an authentication bypass vulnerability in the REST API. This issue arises when attackers exploit MySQL type coercion by submitting small integer values (0 through 9) instead of string tokens. By leveraging this weakness, unauthorized individual...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The Smart Popup by Supsystic plugin for WordPress before version 2.0.2 is vulnerable to template injection due to improper handling of template delimiters. An authenticated administrator can exploit this vulnerability by injecting arbitrary template expressions into a popup text block. These inje...

The Essential Addons for Elementor WordPress plugin prior to version 6.8.7 has a flaw that allows users to register and log in without required administrator approval through its email one-time-password registration flow. This vulnerability can permit unauthorized access when the features are ena...

The Sadad QA Payment Plugin for WordPress, up to version 1.28, has a serious flaw in its payment notification handling. The plugin fails to properly verify the authenticity of incoming payment notifications due to the insecure handling of the merchant secret, which is left empty by default. This ...

The Royal Elementor Addons plugin for WordPress, prior to version 1.7.1070, contains a security flaw where it fails to properly validate form field values before incorporating them into email recipient addresses. This issue allows unauthenticated attackers to alter the intended recipient list and...

The BitPay Gateway for WooCommerce WordPress plugin prior to version 4.1.3 has a serious flaw where it fails to properly bind transaction confirmations to their respective orders. This oversight allows an attacker with access to a legitimate low-value transaction to falsely mark any higher-value ...

NGINX Open Source contains a significant vulnerability in its HTTP/3 QUIC module. When this module is enabled, an unauthenticated remote attacker might exploit conditions beyond their control to send specially crafted HTTP/3 requests that can reopen a QPACK encoder stream. This situation can lead...

The URL Shortify plugin for WordPress suffers from an Open Redirect vulnerability due to inadequate validation of the 'redirect_to' parameter within its promotional dismissal handler. This flaw allows unauthorized attackers to create deceptive links that redirect unsuspecting users to potentially...

Gitea versions prior to 1.16.7 are susceptible to a remote code execution vulnerability caused by the improper escaping of the `git fetch` command's remote parameter. This flaw enables an attacker to execute arbitrary code on the server by crafting a malicious request. It is crucial for users of ...

GNU Bash versions up to 4.3 are vulnerable to a code injection flaw due to the mishandling of trailing strings after function definitions in environment variables. This vulnerability enables remote attackers to execute arbitrary code by crafting specific environment variables under various condit...

An unauthenticated remote code execution vulnerability exists in YOOtheme Pro versions 5.0.0 to 5.0.52 due to improper binding of image operations and output destinations in its publicly accessible image transformation handler. This flaw allows an attacker to exploit a legitimate public image URL...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The Customer Engagement System plugin for WordPress prior to version 2.0.2 contains a significant access control vulnerability. This flaw allows unauthenticated users to access its MailChimp interest-group functionality. Furthermore, the plugin fails to validate the supplied API key, enabling the...

The Recipe Card Blocks Lite plugin for WordPress prior to version 3.6.4 is vulnerable to SQL injection attacks. This vulnerability arises from the plugin's failure to properly sanitize and cast a block and shortcode attribute before incorporating it into SQL queries. As a result, authenticated us...

The WP Roster plugin for WordPress prior to version 2.35 contains a flaw that does not enforce capability or nonce checks during its AJAX actions. This vulnerability enables unauthenticated attackers to exploit the plugin, potentially leading to unauthorized deletion of user accounts associated w...

The PayPlug for WooCommerce plugin prior to version 3.1.1 is vulnerable due to its lack of capability and ownership checks on unauthenticated AJAX actions that utilize a caller-supplied order identifier. This flaw permits unauthorized attackers to manipulate, read, and permanently delete WooComme...

The GeoDirectory WordPress plugin prior to version 2.8.196 is susceptible to a Stored Cross-Site Scripting vulnerability. This occurs due to improper escaping of a post badge shortcode attribute within a JavaScript context before it is inserted into an inline event handler. This flaw allows users...

The Customer Engagement System WordPress plugin prior to version 2.0.2 is vulnerable to SQL injection attacks due to improper handling of user input. The plugin constructs SQL statements for storing visibility rules by concatenating request-supplied ID values directly into an INSERT statement wit...

The GeoDirectory plugin for WordPress is susceptible to an improper access control vulnerability that allows users with the Contributor role or higher to access and disclose the content, custom fields, and status of other users' listings. This occurs when the plugin renders a listing without veri...

The Royal MCP WordPress plugin prior to version 1.5.10 contains an object-level permission check vulnerability. This issue allows users with contributor-level access to duplicate requested pages without appropriate restrictions. Consequently, these users can read the full content of any private o...

The Media Library Assistant plugin for WordPress contains a security flaw that compromises CSRF nonce validation in its bulk-action handler. This vulnerability allows attackers to send forged requests that may bypass the nonce check when the nonce field is omitted. As a result, authenticated user...

The MP3 Audio Player WordPress plugin, prior to version 5.16, is prone to a cross-site scripting vulnerability that arises from improper escaping of an audio player shortcode attribute. This flaw enables users with Contributor-level access or higher to inject arbitrary JavaScript code. Such code ...

The Media Library Assistant plugin for WordPress versions prior to 3.42 is vulnerable to cross-site request forgery (CSRF) attacks. This vulnerability allows an attacker to craft a malicious request that, if executed by a logged-in user with Editor privileges or higher, can lead to the permanent ...

The Royal MCP WordPress plugin prior to version 1.5.10 lacks proper object-level or post-type authorization checks in its search functionality. This oversight enables authenticated users, specifically those with subscriber privileges, to access and disclose titles and contents of non-public entri...

The GeoDirectory WordPress plugin prior to version 2.8.196 contains a vulnerability that allows a post badge click-through link value to be improperly sanitized or escaped. This flaw permits users with Contributor roles and higher to exploit stored cross-site scripting attacks, targeting higher-p...

The Welcart e-Commerce plugin for WordPress suffers from a vulnerability where it fails to properly sanitize and escape parameters used in SQL queries. This oversight allows users with the Editor role or higher to execute SQL injection attacks, potentially compromising the integrity of the databa...

The Welcart e-Commerce WordPress plugin, prior to version 2.12.6, contains a flaw that allows unauthenticated users to manipulate the redirection of URLs. This oversight in user-supplied URL validation can lead to attackers redirecting users to any chosen external sites, posing significant securi...