Publicly Disclosed
PoC Exploits

The Rede Itaú for WooCommerce plugin for WordPress before version 5.5.3 contains a vulnerability that allows unauthenticated users to exploit the payment gateway webhook. This flaw enables attackers to modify the status of WooCommerce orders without proper authentication. Specifically, they can m...

The Rede Itaú for WooCommerce WordPress plugin prior to version 5.5.3 is vulnerable due to inadequate verification of payment gateway webhook authenticity. This flaw permits unauthorized actors to change the status of WooCommerce orders, potentially altering the status of paid or completed transa...

The Cardinity Payment Gateway for WooCommerce plugin is vulnerable due to inadequate verification of payment notification authenticity. By default, the plugin's configuration allows an empty secret for signing notifications, enabling unauthorized users to spoof payment confirmations. This vulnera...

A local privilege escalation vulnerability exists within the pkexec utility of polkit, a setuid tool that allows unprivileged users to execute commands as privileged users based on predetermined policies. Due to insufficient handling of the calling parameters, pkexec can misinterpret environment ...

The Tutor LMS plugin for WordPress, in versions prior to 4.1.1, has a critical weakness in its page management system. This vulnerability allows unauthenticated users to bypass intended restrictions and manipulate unpublished content. Specifically, these users can forcefully publish pages, overwr...

The Document Gallery WordPress plugin versions up to 5.1.1 is susceptible to a reflected Cross-Site Scripting vulnerability due to improper sanitization and escaping of user input. This security flaw can be exploited through an unauthenticated AJAX action, enabling attackers to execute malicious ...

The User Rights Access Manager plugin for WordPress, specifically versions up to 1.1.3, presents a significant security risk by failing to restrict access to an AJAX handler responsible for account registration. This oversight allows unauthenticated users to register new accounts with elevated pe...

The Spin Wheel WordPress plugin, prior to version 2.2.1, contains a vulnerability that permits unauthenticated users to gain unauthorized access to coupon codes tied to various campaigns. This occurs because the plugin fails to validate whether a legitimate spin was executed by the visitor before...

The eaSYNC Booking plugin for WordPress, prior to version 1.3.31, has significant security flaws due to missing authorization and nonce checks on various cancellation-related AJAX actions. This lack of security measures allows unauthenticated users to initiate cancellation requests for bookings, ...

The Easy HTTPS Redirection (SSL) plugin for WordPress, prior to version 2.0.2, is vulnerable due to the lack of capability checks in certain AJAX actions. This security issue permits authenticated users, including those with Subscriber privileges, to access sensitive data such as URLs gathered fr...

Multiple TP-Link Wi-Fi range extenders exhibit a vulnerability in their web-management login flow, utilizing a custom XOR-and-dictionary transformation. An attacker on the same local network can capture traffic during legitimate administrator login attempts. By observing the session key, dictiona...

The SimpleForm plugin for WordPress is vulnerable due to improper checks in the AJAX handler which allows unauthenticated attackers to create an Administrator-level account. This vulnerability arises from the absence of capability checks during role assignment and flaws in the handling of user me...

The File Manager plugin for WordPress prior to version 6.9 contains a vulnerability that permits remote attackers to upload and execute arbitrary PHP code. The issue arises from the renaming of an insecure example elFinder connector file to have a .php extension. This flaw facilitates attackers t...

The SODOLA SL902-SWTGW124AS firmware prior to version 200.2.12 is susceptible to a buffer overflow vulnerability. This flaw enables unauthenticated attackers to compromise the device remotely by sending a malicious POST request with an oversized boundary value in the Content-Type header. Exploiti...

Hikvision network camera devices suffer from an improper authentication vulnerability, which arises when the system fails to adequately authenticate users. This deficiency could enable an attacker to escalate privileges and obtain sensitive information, risking the integrity and confidentiality o...

A vulnerability existing in the SGLang component SGLang Session Cleanup allows for remote denial of service attacks via the Session.create_req function, located in session_controller.py. This weakness can be exploited by an adversary to disrupt normal service availability, causing potential downt...

Multiple versions of Drupal, including those prior to 7.58 and various 8.x releases, are susceptible to a vulnerability that permits remote attackers to execute arbitrary code. This exploit takes advantage of configuration flaws in several subsystems, particularly those using default or common mo...

Wazuh versions prior to 4.14.8 are affected by a vulnerability wherein the wm_agent_upgrade function lacks a proper origin check. This flaw enables enrolled agents to send upgrade_custom commands with a file_path controlled by an attacker. As a result, attackers can exploit this to inject message...

A vulnerability has been identified in SGLang up to version 0.5.19, specifically in the `generate Endpoint` functionality found in the `io_struct.py` file. This issue arises from improper handling of the `session_params` argument, which leads to significant service disruptions. Attackers can expl...

A vulnerability in AhsayCBS, specifically in the API's checkSysPwd function of the com/ahsay/obs/api/ApiStructsAction.java file, allows for improper authentication due to argument manipulation. This issue permits remote exploitation, putting systems at risk. Users are urged to upgrade to version ...

A vulnerability has been identified in Bitcoin Daemon and Bitcoin-Qt that can allow remote attackers to disrupt service by creating block-processing outages and causing incorrect block counts. This behavior can severely impact the stability of the Bitcoin network, exposing users and miners to pot...

A security flaw has been identified in Praat's Model Loader, specifically within the function whisper_model_load located in whisper.cpp. This vulnerability arises from improper handling of the argument n_dims, which could lead to an out-of-bounds write condition. Attackers may exploit this issue ...

A vulnerability has been discovered in the itsmeravitejak Online-Examination-System, specifically within the dbtables.sql file. This weakness allows unauthorized users to manipulate database operations remotely, potentially leading to the disclosure of sensitive information. The flaw operates thr...

A vulnerability exists in the Safetensors Tensor Loader component of ExLlamaV2 where a manipulation of the data_offsets argument in the STFile.get_tensor function results in a buffer overflow. This flaw can be exploited remotely, allowing attackers unauthorized access to critical functions. Despi...

A vulnerability has been identified in OAID Tengine versions up to 1.12.0, specifically within the get_tm_file_model function in the tmfile Model Loader component. This issue arises due to improper handling of the argument offset_root, leading to potential out-of-bounds read scenarios. An attacke...

A vulnerability has been identified in OpenClaw ClawScan versions up to 0.1.6, affecting the shouldSkipTargetPath function within the Static Scanner component. This flaw can be exploited through manipulation, leading to a potential failure of the protection mechanisms. Local access is required fo...

The Abandoned Cart Pro for WooCommerce plugin is susceptible to an authentication bypass due to insecure encryption practices implemented in all versions up to 10.8.0. This vulnerability arises from the use of MAC-free AES-CTR encryption for cart-recovery link tokens. The mechanism fails to enfor...

A type confusion vulnerability has been identified in the V8 JavaScript engine of Google Chrome. Prior to version 152.0.7977.82, this flaw allows malicious attackers to execute arbitrary code within the browser's sandbox environment by crafting a specially designed HTML page. This vulnerability p...

A type confusion vulnerability exists in the V8 engine of Google Chrome, affecting versions prior to 142.0.7444.175. This flaw enables attackers to potentially exploit heap corruption by crafting malicious HTML content. If successfully exploited, it may lead to unexpected behavior within the brow...

This vulnerability arises from a type confusion issue within the V8 JavaScript engine used in Google Chrome, potentially granting remote attackers the ability to execute arbitrary code. Exploitation can occur when a user is tricked into visiting a specially crafted HTML page, which executes malic...

A remote code execution vulnerability, CVE-2024-2887, was discovered in Google Chrome prior to version 123.0.6312.86, which allowed a remote attacker to execute arbitrary code via a crafted HTML page. The update to Chrome version 123.0.6312.86/.87 addresses this vulnerability, along with several ...

A type confusion vulnerability has been identified in Apple's operating systems that could allow attackers to execute arbitrary code by processing specially crafted web content. Improved checks have been implemented in the latest versions of iOS, iPadOS, macOS, and tvOS to address this issue. App...

A significant vulnerability exists in various Apple products that utilize the WebKit component. This flaw permits remote attackers to execute arbitrary code or initiate a denial of service through a specially crafted website. The vulnerability impacts multiple platforms including iOS, Safari, iCl...

A vulnerability exists in cemtan's sar2html version 4.0.0, specifically affecting the functions deleteHost, deleteRange, and deleteAll in the file sar2html.py. This flaw can be exploited remotely due to insufficient authentication checks, allowing attackers to manipulate the system without valid ...

A vulnerability has been identified in cemtan's sar2html version 4.0.0, specifically within the 'index' function of the file sar2html.py. This flaw allows for SQL injection through improper manipulation of the 'sort' argument, enabling potential attackers to execute malicious SQL commands. The is...

The SimpleForm plugin for WordPress is vulnerable due to improper checks in the AJAX handler which allows unauthenticated attackers to create an Administrator-level account. This vulnerability arises from the absence of capability checks during role assignment and flaws in the handling of user me...

Nexent versions up to 2.7.0 exhibit a vulnerability in the check_file_access function, allowing authenticated users to bypass tenant restrictions. This issue enables users to access other tenants' knowledge-base files, potentially exposing sensitive information. In a multi-tenant deployment, atta...

Blinko versions up to 1.8.8 are exposed to a broken access control vulnerability in the /api/file route. This flaw enables authenticated users to unjustly access private attachments belonging to other users. Through a flawed owner check, attackers can exploit this vulnerability by supplying the f...

GrowChief version 0.3.0 contains a vulnerability in the getAllUsers handler, where missing authorization checks enable authenticated users to list all users across different organizations. This oversight allows attackers, even with low privileges such as self-registered accounts, to exploit the G...

The Sure product versions from 0.7.0 to 0.7.6-alpha.6 expose a vulnerability whereby authenticated users with limited permissions can exploit the BulkUpdatesController#create method. This allows them to manipulate transaction information for other users, including changing dates, notes, and categ...

The Shopizer e-commerce platform, up to version 3.2.5, is susceptible to an authorization bypass vulnerability that enables authenticated customers to post reviews under the identities of other customers. By manipulating the customerId field in requests sent to the review submission API, maliciou...

Databasus versions 3.7.0 through 3.61.0 have a flaw that allows attackers to bypass authentication during the password reset process. By exploiting this vulnerability, an attacker can request a six-digit password reset code linked to a known email address and attempt to brute-force the code witho...

holaOS, through version 2026.822.1, contains a missing authorization flaw in its channel-gateway connectors. This vulnerability allows any user of the messaging platform to submit agent tasks because the system's #isAllowed check indiscriminately accepts all senders when the default allowFrom lis...

Gitingest versions up to 0.3.1 are susceptible to a symlink following vulnerability that permits unauthenticated attackers to access sensitive server files. By exploiting this flaw, attackers can submit symlink blob URLs, effectively redirecting the server to return files that the service user ca...

Colanode Server versions up to 0.4.7 are vulnerable to a path traversal issue, allowing authenticated users to gain unauthorized access to .jpeg files. This can be exploited by using encoded traversal sequences in the avatarId parameter. By sending specially crafted GET requests that navigate bey...

FlexPrice versions up to 2.1.38 have a significant security flaw in their payment processing system specifically related to the QuickBooks Webhook integration. This vulnerability arises when the intuit-signature header is omitted, allowing unauthenticated attackers to bypass signature verificatio...

AstronRPA versions up to 1.1.6 are susceptible to an insecure direct object reference vulnerability, specifically found in the /file/download endpoint. This flaw allows authenticated users to gain unauthorized access to files belonging to other tenants by merely specifying the fileId. Attackers c...

The Lamp-Boot OAuth module is vulnerable to an insecure direct object reference, specifically within the /anyone/findDeptByCompany endpoint. This flaw allows authenticated, low-privilege users to bypass URI permission checks, enabling them to enumerate employeeId values sequentially. As a result,...

A vulnerability has been identified in the D-Link DIR-868L router firmware version 2.01b05, which affects the functionality of the HNAP CGI Handler within the file /htdocs/cgibin. This security issue allows attackers to execute arbitrary operating system commands by manipulating the SOAPACTION ar...

A significant vulnerability has been identified in Apple’s macOS Sonoma and older versions of iOS, where improperly handled web content could allow for arbitrary code execution. Users of macOS Sonoma 14 and earlier versions of iOS should be aware that this issue may have been actively exploited. ...