Publicly Disclosed
PoC Exploits

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

The Eupago Gateway for WooCommerce plugin versions 4.5.0 through 4.7.5 is vulnerable to a significant security flaw that allows attackers to bypass payment confirmation verification. This vulnerability enables unauthenticated malicious actors to manipulate incoming payment-confirmation webhook re...

The CryptoCloud WordPress plugin versions 3.0.0 to 3.0.1 contains a significant security flaw that stems from the absence of authentication checks for payment notifications received from its gateway callback. This vulnerability arises because the integrity verification process is not implemented,...

OpenIdentityPlatform's OpenAM, an access management solution, is susceptible to a pre-authentication Remote Code Execution vulnerability due to unsafe Java deserialization. This issue arises from the handling of the jato.clientSession HTTP parameter, allowing unauthenticated attackers to execute ...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

The weMail plugin for WordPress prior to version 2.1.6 contains a significant vulnerability that allows users with Editor roles to access a site-wide third-party email-service API key. This unrestricted access can lead to unauthorized actions as the key can be used to impersonate other users with...

The WATI Chat and Notification WordPress plugin, up to version 1.1.8, has a significant vulnerability where it does not enforce authentication on a public endpoint that exposes its stored API token. This lack of security allows unauthenticated attackers to exploit the endpoint, retrieve the API t...

The weMail WordPress plugin version 2.1.6 is susceptible to an access control misconfiguration that fails to accurately verify user capabilities within its REST API permission checks. This flaw permits users assigned roles listed in the allowed-roles list, which includes roles like Editor and abo...

The DT Directory Lite Addon for WordPress lacks essential nonce and capability checks in its settings handlers. This oversight permits unauthenticated attackers to alter the configuration and skin options of the plugin, potentially leading to unauthorized changes that could compromise site functi...

The Gallery for Social Photo plugin for WordPress, up to version 1.0.0.41, contains a flaw that permits unauthenticated attackers to manipulate server-side requests. The vulnerability arises from the inadequate validation of user-supplied URLs, enabling attackers to make requests to arbitrary int...

The DT LMS WordPress plugin up to version 1.2 is vulnerable to an improper authorization issue, where lack of capability and nonce checks on an AJAX action permits unauthenticated attackers to revoke course and class completion statuses of learners. This vulnerability exposes the system to unauth...

The AZEXO Store Locator plugin for WordPress, specifically version 1.4, is affected by an authorization bypass vulnerability that enables any authenticated user, including subscribers, to delete posts and pages without proper capability checks. This lack of authorization control poses a significa...

An improper authentication vulnerability exists in the Danfoss AK-SM 8xxA Series, which can allow unauthorized access to sensitive functions within the affected products. This vulnerability risks the security of controlled environments, potentially leading to exposure of critical data and operati...

Codefriar sf-mcp before version 1.3.3 is vulnerable to an OS command injection attack. This vulnerability arises due to improper handling of inputs in the escapeValue() function within src/utils.ts, which fails to neutralize shell metacharacters such as backticks and $() substitutions. Attackers ...

A vulnerability exists in Payload CMS affecting versions between 3.0.0 and 3.90.0. This flaw allows for a custom field option to unintentionally influence authentication claims in login tokens, compromising the integrity of user authentication. Users are advised to upgrade to version 3.90.0, wher...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A security flaw exists in the Next.js framework that allows an attacker to bypass authorization checks if such checks are implemented in middleware. This vulnerability arises in versions prior to 14.2.25 and 15.2.3. To mitigate risk, it is recommended to restrict incoming requests that include th...

Greenshot versions 1.2.10 and earlier are vulnerable due to insecure deserialization of .greenshot files. This flaw could allow an attacker to execute arbitrary code on the user's system by crafting a malicious .greenshot file. When opened, the application fails to properly validate the data, cre...

A vulnerability in the Welcart e-Commerce Plugin allows attackers to execute cross-site scripting (XSS) attacks by manipulating the ResponseCd argument in the error_page_message function of the classes/paymentESCOTT.main.class.php file. This vulnerability can be exploited remotely, and the exploi...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability was identified in EchoHS GeekezBrowser versions up to 1.7.2 and 1.8.0, affecting the Public API component's /api/status file. This flaw could enable attackers to disclose sensitive information through local exploitation methods. To address this issue, users are strongly advised to...

ReadyMedia versions 1.3.0 through 1.3.3 are susceptible to a stack-based buffer overflow vulnerability that can be exploited by remote attackers. This flaw occurs when a specially crafted DFF audio file containing an oversized PROP chunk size is processed. The vulnerability allows attackers to ma...

A vulnerability has been identified in PDF.js, specifically related to a missing type check when processing fonts. This oversight permits arbitrary JavaScript execution within the PDF.js environment. As a result, users of affected versions of Mozilla Firefox and Thunderbird could be vulnerable to...

The Nexbox A95X TV boxes utilizing the Amlogic S905X platform are vulnerable to unauthorized access through an exposed internal UART header. This vulnerability allows attackers with physical access, equipped with a USB-to-TTL adapter, to gain an interactive shell with system-level privileges. Exp...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

The vulnerability in Collabora Online Built-in CODE Server allows attackers to execute arbitrary OS commands via a flawed implementation in proxy.php when the CODE server is not operational. This design flaw primarily impacts deployments integrated with Nextcloud, particularly after the CODE serv...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

The Control Web Panel (CWP) exhibits a vulnerability due to a blind SQL injection flaw in its unauthenticated loopback API route. This vulnerability affects versions prior to 1.30 and allows attackers to exploit the 'user' parameter, which is directly incorporated into a MySQL query that targets ...

The vulnerability in the PutContents API of Gogs arises from improper handling of symbolic links, potentially allowing local execution of arbitrary code. This misconfiguration may expose sensitive data and facilitate unauthorized access to critical systems. Users and administrators are urged to u...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A memory corruption issue has been detected in Apple’s iOS, iPadOS, and macOS platforms, which is related to improper memory handling. Parsing specific files may lead to unexpected app terminations, potentially allowing for arbitrary code execution. This vulnerability has been addressed in the la...

DoraCMS versions up to 3.1.0 are susceptible to a mass assignment vulnerability that can be exploited by authenticated low-privileged users. This vulnerability exists in the PUT /api/v1/user/api-keys/:id endpoint, which allows attackers to rebind their API key to a victim's account. By manipulati...

HotGo version 2.15.1 contains a critical authentication bypass vulnerability that allows attackers to circumvent the SMS verification process. By supplying a manipulated Code field to the /admin/sms/send endpoint, unauthenticated users can specify the SMS login verification code. If they possess ...

GoFound, up to version 1.4.1, is susceptible to a path traversal vulnerability that permits unauthenticated attackers to delete arbitrary directories. By exploiting this flaw, attackers can use '../' sequences in the database parameter to craft malicious GET requests directed at '/api/db/create' ...

PandaWiki versions 3.65.0 through 3.87.5 are susceptible to a stored cross-site scripting vulnerability. This issue allows unauthenticated attackers to exploit the /share/v1/common/file/upload endpoint, enabling them to upload HTML files masquerading as images. By misleading administrators into a...

Copyparty, a portable file server, is affected by a path traversal vulnerability that allows attackers to access files, directories, and commands outside the designated web document root. This vulnerability is present in versions prior to 1.8.2 and can lead to unauthorized information disclosure....

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The PayHere Payment Gateway plugin for WordPress, versions 2.4.0 to 2.4.5, has a security flaw that allows attackers to forge payment notifications. This happens when the merchant secret is not set, which is the default configuration. As a result, unauthorized individuals can mark any order as pa...

An OS command injection vulnerability exists in the VPN module of specified TP-Link Archer router models. This flaw allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a maliciously crafted VPN client configuration file. The vulnerability arises fro...

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log messag...

A security flaw exists in the Mobile Site Directory of dayrui's XunRuiCMS versions up to 4.7.4. This vulnerability is exploited through the function str_replace found in the index.php file. By manipulating the argument dirname, an attacker can execute arbitrary code remotely. Publicly available e...

An improper certificate validation vulnerability exists in the HTTPS listener of Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9 prior to the recommended updates. This flaw enables unauthenticated attackers to forge a certificate chain, allowing them to masquerade as a legitimate trusted c...

A code injection vulnerability exists in the Email Template Rendering component of dayrui XunRuiCMS up to version 4.7.4. The issue arises from the function _get_tpl_content located in the Notice.php file, allowing attackers to manipulate template content remotely. The public availability of the e...

A security flaw exists in the Dayrui XunRuiCMS up to version 4.7.4 located in the Member Module's View function. By manipulating the 'catid' argument, a remote attacker can execute SQL injection attacks, exposing sensitive data or compromising the database's integrity. This vulnerability has been...

A vulnerability has been identified in WAVLINK's WN551X3-A, affecting its DNS Resolution Handler component. This security flaw allows remote attackers to inject arbitrary OS commands by manipulating argument data in the function sub_41a430 located in the /bin/ioos file. The issue has been made pu...

A vulnerability affecting the WAVLINK WN551X3-A router has been identified where improper handling of the 'group_name' argument in the WireGuard CLI Group Handler can lead to OS command injection. This vulnerability allows remote attackers to execute arbitrary commands on the device by sending sp...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A cross-site scripting flaw has been identified in the CloudClassroom-PHP-Project, specifically within the manageassessment2.php file. The vulnerability arises from improperly handled input in the ExamName parameter, allowing attackers to manipulate the argument and execute arbitrary JavaScript i...