Publicly Disclosed
PoC Exploits

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

An improper access control vulnerability in the Windows Cross Device Service allows an attacker with authorized access to elevate their privileges locally. This can lead to unauthorized actions within the system, compromising the integrity and security of users' environments. Microsoft has releas...

A use after free vulnerability exists in the Windows Ancillary Function Driver for WinSock. This flaw enables an authorized attacker to exploit the driver and potentially elevate privileges locally, threatening the integrity of the operating system. To mitigate risk, it is essential to apply the ...

An authentication bypass vulnerability exists in Dovecot SQL authentication, where an administrator can inadvertently disable the 'auth_username_chars' configuration. This misconfiguration allows attackers to bypass authentication checks, potentially enabling unauthorized access and user enumerat...

The Link Factory plugin for WordPress is compromised by a backdoor that enables unauthorized access via an operator-controlled REST API endpoint located at /wp-json/link-factory/v1/. This backdoor is authenticated using a detached Ed25519 signature, which is verified against a hardcoded public ke...

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress prior to version 7.0.9 is susceptible to an access control vulnerability. It lacks proper capability checks and nonce verification for specific store-management actions, potentially allowing any authenticated user, including sub...

A heap-based buffer overflow vulnerability exists in the Windows Imaging Component, which could allow an unauthorized attacker to execute arbitrary code locally. This flaw can be exploited by malicious actors to manipulate memory allocation and potentially gain unauthorized access to system resou...

The WP Helper Premium plugin for WordPress is susceptible to a vulnerability that allows unauthenticated users to access sensitive order details. Specifically, versions prior to 4.7.6 fail to verify order keys when rendering custom order confirmation pages or processing related AJAX actions. This...

A significant access control vulnerability exists in the Booking for Appointments and Events Calendar plugin for WordPress prior to version 2.4.6. This flaw allows any authenticated employee to retrieve information about appointments without proper authorization, potentially exposing sensitive cu...

The ShopEngine Elementor WooCommerce Builder Addon for WordPress lacks adequate protection for its authentication endpoints, making it susceptible to Cross-Site Request Forgery (CSRF) attacks. An attacker can exploit this vulnerability to trick a victim into authenticating to an attacker-controll...

The KiviCare WordPress plugin prior to version 4.5.2 is vulnerable due to a lack of restrictions on role assignments via its unauthenticated registration endpoint. This flaw enables attackers to create active, privileged accounts, such as clinic staff (doctors), granting them full access to sensi...

The Customer Email Verification for WooCommerce plugin prior to version 3.2.6 exhibits a vulnerability allowing unauthenticated users to bypass email verification mechanisms. This occurs due to inadequate validation of the email-verification activation code, which can be exploited by an attacker ...

The Food Menu plugin for WordPress prior to version 6.0.2 has a significant vulnerability that allows unauthenticated users to modify reservation statuses. This issue arises from the lack of proper capability and ownership checks in the reservation-status update action. The action is accessible t...

Marimo, a reactive Python notebook, exhibits a significant security vulnerability prior to version 0.23.0. The terminal WebSocket endpoint (/terminal/ws) allows unauthenticated access, enabling attackers to gain a complete pseudo-terminal shell and execute arbitrary commands on the host system. U...

The vulnerability in the PPP Daemon (pppd) versions 2.4.2 through 2.4.8 is a buffer overflow issue found in the eap_request and eap_response functions. This flaw can potentially allow an unauthorized attacker to exploit the overflow, leading to arbitrary code execution or causing the application ...

The vulnerability within the Linux kernel occurs in the pppol2tp_recv() function, which fails to properly manage memory deallocation in a multi-threaded environment. This oversight allows an unprivileged user to potentially exploit the system by dereferencing a channel that has already been freed...

Metabase, an open-source business intelligence and embedded analytics tool, suffers from a deserialization vulnerability in versions prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4. When configured with an H2 database connection, including the default sample database, this flaw permits authenti...

This vulnerability involves a memory corruption issue that arises when processing specially crafted media files, which can lead to unintended app termination or memory corruption in affected Apple devices. Apple has addressed this flaw with enhanced input validation in the latest versions of thei...

A vulnerability exists in the Linux kernel's netfilter module that affects the nft_map_catchall_activate() function. This function encounters an inverted element activity check, leading to a failure in appropriately handling catchall map elements during a failed transaction. The bug arises when t...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

Microsoft has identified a vulnerability in the Microsoft Malware Protection Engine associated with Microsoft Defender, allowing unauthorized elevation of privilege. This vulnerability, called 'RoguePlanet', could enable an attacker to gain escalated access to the system. Microsoft is currently d...

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

The Quick Paypal Payments WordPress plugin versions prior to 5.7.50 contains a security weakness in its PayPal IPN handler. This vulnerability allows an attacker to exploit the payment confirmation process by matching order tokens without validating key transaction details such as the paid amount...

The Estatik Real Estate Plugin for WordPress features a significant flaw where it fails to properly validate the recipient list intended for messages generated via its property request form. This oversight allows unauthenticated users to exploit the functionality and send emails to any arbitrary ...

The Payment Button for PayPal WordPress plugin prior to version 1.2.3.44 features a significant vulnerability related to improper input validation. This security flaw allows unauthenticated users to manipulate the payment amount by sending a client-supplied payment value that is not properly vali...

The Kirki WordPress plugin prior to version 6.2.1 is susceptible to inadequate authorization that affects its front-end form submission REST routes. This vulnerability allows unauthenticated attackers to exploit the system by executing any registered shortcodes, which can lead to significant issu...

The Payment Gateway for PayPal in the WooCommerce plugin prior to version 9.2.1 contains a vulnerability that compromises the integrity of payment processing. It fails to validate whether a payment was successfully completed before marking orders as paid. The exploit allows an unauthenticated att...

The Welcart e-Commerce plugin for WordPress is susceptible to a significant vulnerability where it fails to properly verify the authenticity of callback requests related to convenience-store and bank-transfer settlements. This flaw allows an unauthenticated attacker to change the status of an ord...

The Wallet System for WooCommerce WordPress plugin version prior to 2.7.10 is vulnerable due to a lack of validation for user-supplied wallet amounts during the checkout process. This failure allows authenticated users to reduce their order total arbitrarily, including the possibility of setting ...

A vulnerability exists in the Linux kernel's networking subsystem that allows for a race condition involving qdisc_rtab_list. This occurs when multiple CPU cores attempt to access and modify the same singly linked list of rate tables concurrently. The lack of proper synchronization mechanisms can...

The node-tar library, utilized for handling tar files in Node.js, has a security flaw affecting versions up to 7.5.2. This vulnerability arises from an inadequate sanitization of link paths in both hardlink and symbolic link entries when the preservePaths option is disabled (which is the default ...

The Royal Addons for Elementor plugin for WordPress, prior to version 1.7.1065, contains a vulnerability that fails to adequately validate widget settings when generating HTML outputs. This oversight allows users with Contributor roles or higher to inject malicious scripts, facilitating Stored Cr...

The ProSolution WP Client WordPress plugin prior to version 2.0.9 has a critical security flaw that permits authenticated users to leverage an unvalidated URL input for server-side HTTP requests. Due to the lack of validation on the user-supplied URL and insufficient checks on user capabilities o...

The ProSolution WP Client plugin for WordPress, prior to version 2.0.9, suffers from a serious security flaw due to inadequate checks on administrative AJAX actions. This oversight permits any authenticated user, including those with limited roles such as subscribers, to invoke administrative dat...

The WP Photo Album Plus WordPress plugin, prior to version 9.2.09.002, fails to enforce user authorization when allowing front-end uploads. This oversight enables any authenticated user, including those with minimal access such as Subscribers, to upload files to albums owned by others, including ...

The Order Sync with Zendesk for WooCommerce plugin prior to version 2.2.3 fails to implement necessary capability checks on its REST API endpoints. This oversight allows unauthenticated users to gain access to sensitive customer information, including order history and total purchases, simply by ...

The WPC Admin Columns plugin for WordPress prior to version 2.3.4 lacks proper authorization checks in one of its AJAX actions. This oversight permits users with minimal roles, such as subscribers, to access and read arbitrary user, post, and term metadata, potentially exposing sensitive informat...

The WooCommerce Subscriptions plugin, prior to version 9.1.0, is vulnerable to PHP Object Injection when operating on stores that have High-Performance Order Storage enabled. This vulnerability allows unauthenticated users to exploit the weakness by injecting malicious serialized objects. By leve...

The WP Directory Kit WordPress plugin prior to version 1.5.6 fails to properly sanitize and escape input parameters in its SQL statements during authenticated AJAX actions. This lack of adequate authorization checks enables any authenticated user, including subscribers, to exploit this vulnerabil...

The Events Manager plugin for WordPress prior to version 7.4.1 contains a significant access control vulnerability. This flaw arises from improper scoping of capability mapping, which negates the access control measures implemented by WordPress for unrelated privileged actions. As a result, unaut...

An access control vulnerability exists in the Ezoic WordPress plugin prior to version 2.23.1, which fails to adequately restrict access to its content export features. This flaw enables unauthorized users to exploit the plugin, resulting in the ability to trigger an unwanted server-side export of...

The WP Directory Kit WordPress plugin is susceptible to SQL injection due to insufficient sanitization and escaping of parameters used in SQL statements. This vulnerability enables unauthenticated users to manipulate the database by exploiting a non-default search field type, potentially leading ...

The WP Photo Album Plus plugin for WordPress prior to version 9.2.07.002 contains a security flaw that allows unauthorized users to access sensitive configuration data. This occurs because the plugin does not implement necessary checks on certain public endpoints and inadequately handles input va...

The WP Photo Album Plus plugin for WordPress has a significant security issue that arises from its failure to validate user-controlled input when constructing file paths. This vulnerability allows unauthenticated attackers to execute arbitrary deletion commands on ZIP archives stored on the serve...

The Events Manager plugin for WordPress, prior to version 7.4.1, is susceptible to SQL injection due to insufficient sanitization and escaping of user-supplied input in its SQL statements. This vulnerability permits users with subscriber-level access or higher to manipulate booking consent record...

The User Access Manager plugin for WordPress prior to version 2.3.15 contains a significant access control flaw. This vulnerability allows unauthenticated individuals to bypass intended restrictions, gaining unauthorized access to posts, pages, and custom post types. The absence of proper access ...

The Cookie Consent WordPress plugin prior to version 0.0.10 contains a significant flaw that allows authenticated users, even those with minimal privileges, to modify the geolocation service license key. This vulnerability arises due to insufficient enforcement of administrator-only capabilities ...

The WP Photo Album Plus plugin for WordPress versions prior to 9.2.07.002 is susceptible to reflected cross-site scripting (XSS) due to improper sanitization and escaping of input parameters. This weakness can be exploited by unauthenticated attackers, who can craft malicious links that, when cli...

The Form Maker plugin by 10Web for WordPress prior to version 1.15.45 contains a vulnerability due to improper parameterization of user-controlled values. This flaw allows an attacker with subscriber-level permissions to exploit dynamic SQL queries within the plugin, potentially enabling second-o...

The Wallet for WooCommerce plugin prior to version 1.6.10 suffers from a vulnerability where it fails to validate the actual amount collected during wallet top-up transactions. This oversight enables users to increase their wallet balance unjustly, allowing for potential financial exploitation. P...