Publicly Disclosed
PoC Exploits

Codefriar sf-mcp before version 1.3.3 is vulnerable to an OS command injection attack. This vulnerability arises due to improper handling of inputs in the escapeValue() function within src/utils.ts, which fails to neutralize shell metacharacters such as backticks and $() substitutions. Attackers ...

A vulnerability exists in Payload CMS affecting versions between 3.0.0 and 3.90.0. This flaw allows for a custom field option to unintentionally influence authentication claims in login tokens, compromising the integrity of user authentication. Users are advised to upgrade to version 3.90.0, wher...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A security flaw exists in the Next.js framework that allows an attacker to bypass authorization checks if such checks are implemented in middleware. This vulnerability arises in versions prior to 14.2.25 and 15.2.3. To mitigate risk, it is recommended to restrict incoming requests that include th...

Greenshot versions 1.2.10 and earlier are vulnerable due to insecure deserialization of .greenshot files. This flaw could allow an attacker to execute arbitrary code on the user's system by crafting a malicious .greenshot file. When opened, the application fails to properly validate the data, cre...

A vulnerability in the Welcart e-Commerce Plugin allows attackers to execute cross-site scripting (XSS) attacks by manipulating the ResponseCd argument in the error_page_message function of the classes/paymentESCOTT.main.class.php file. This vulnerability can be exploited remotely, and the exploi...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability was identified in EchoHS GeekezBrowser versions up to 1.7.2 and 1.8.0, affecting the Public API component's /api/status file. This flaw could enable attackers to disclose sensitive information through local exploitation methods. To address this issue, users are strongly advised to...

ReadyMedia versions 1.3.0 through 1.3.3 are susceptible to a stack-based buffer overflow vulnerability that can be exploited by remote attackers. This flaw occurs when a specially crafted DFF audio file containing an oversized PROP chunk size is processed. The vulnerability allows attackers to ma...

A vulnerability has been identified in PDF.js, specifically related to a missing type check when processing fonts. This oversight permits arbitrary JavaScript execution within the PDF.js environment. As a result, users of affected versions of Mozilla Firefox and Thunderbird could be vulnerable to...

The Nexbox A95X TV boxes utilizing the Amlogic S905X platform are vulnerable to unauthorized access through an exposed internal UART header. This vulnerability allows attackers with physical access, equipped with a USB-to-TTL adapter, to gain an interactive shell with system-level privileges. Exp...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

The vulnerability in Collabora Online Built-in CODE Server allows attackers to execute arbitrary OS commands via a flawed implementation in proxy.php when the CODE server is not operational. This design flaw primarily impacts deployments integrated with Nextcloud, particularly after the CODE serv...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

The vulnerability in the PutContents API of Gogs arises from improper handling of symbolic links, potentially allowing local execution of arbitrary code. This misconfiguration may expose sensitive data and facilitate unauthorized access to critical systems. Users and administrators are urged to u...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A memory corruption issue has been detected in Apple’s iOS, iPadOS, and macOS platforms, which is related to improper memory handling. Parsing specific files may lead to unexpected app terminations, potentially allowing for arbitrary code execution. This vulnerability has been addressed in the la...

DoraCMS versions up to 3.1.0 are susceptible to a mass assignment vulnerability that can be exploited by authenticated low-privileged users. This vulnerability exists in the PUT /api/v1/user/api-keys/:id endpoint, which allows attackers to rebind their API key to a victim's account. By manipulati...

HotGo version 2.15.1 contains a critical authentication bypass vulnerability that allows attackers to circumvent the SMS verification process. By supplying a manipulated Code field to the /admin/sms/send endpoint, unauthenticated users can specify the SMS login verification code. If they possess ...

GoFound, up to version 1.4.1, is susceptible to a path traversal vulnerability that permits unauthenticated attackers to delete arbitrary directories. By exploiting this flaw, attackers can use '../' sequences in the database parameter to craft malicious GET requests directed at '/api/db/create' ...

PandaWiki versions 3.65.0 through 3.87.5 are susceptible to a stored cross-site scripting vulnerability. This issue allows unauthenticated attackers to exploit the /share/v1/common/file/upload endpoint, enabling them to upload HTML files masquerading as images. By misleading administrators into a...

Copyparty, a portable file server, is affected by a path traversal vulnerability that allows attackers to access files, directories, and commands outside the designated web document root. This vulnerability is present in versions prior to 1.8.2 and can lead to unauthorized information disclosure....

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The PayHere Payment Gateway plugin for WordPress, versions 2.4.0 to 2.4.5, has a security flaw that allows attackers to forge payment notifications. This happens when the merchant secret is not set, which is the default configuration. As a result, unauthorized individuals can mark any order as pa...

An OS command injection vulnerability exists in the VPN module of specified TP-Link Archer router models. This flaw allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a maliciously crafted VPN client configuration file. The vulnerability arises fro...

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log messag...

A security flaw exists in the Mobile Site Directory of dayrui's XunRuiCMS versions up to 4.7.4. This vulnerability is exploited through the function str_replace found in the index.php file. By manipulating the argument dirname, an attacker can execute arbitrary code remotely. Publicly available e...

An improper certificate validation vulnerability exists in the HTTPS listener of Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9 prior to the recommended updates. This flaw enables unauthenticated attackers to forge a certificate chain, allowing them to masquerade as a legitimate trusted c...

A code injection vulnerability exists in the Email Template Rendering component of dayrui XunRuiCMS up to version 4.7.4. The issue arises from the function _get_tpl_content located in the Notice.php file, allowing attackers to manipulate template content remotely. The public availability of the e...

A security flaw exists in the Dayrui XunRuiCMS up to version 4.7.4 located in the Member Module's View function. By manipulating the 'catid' argument, a remote attacker can execute SQL injection attacks, exposing sensitive data or compromising the database's integrity. This vulnerability has been...

A vulnerability has been identified in WAVLINK's WN551X3-A, affecting its DNS Resolution Handler component. This security flaw allows remote attackers to inject arbitrary OS commands by manipulating argument data in the function sub_41a430 located in the /bin/ioos file. The issue has been made pu...

A vulnerability affecting the WAVLINK WN551X3-A router has been identified where improper handling of the 'group_name' argument in the WireGuard CLI Group Handler can lead to OS command injection. This vulnerability allows remote attackers to execute arbitrary commands on the device by sending sp...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A cross-site scripting flaw has been identified in the CloudClassroom-PHP-Project, specifically within the manageassessment2.php file. The vulnerability arises from improperly handled input in the ExamName parameter, allowing attackers to manipulate the argument and execute arbitrary JavaScript i...

A vulnerability has been identified in mathurvishal CloudClassroom-PHP-Project, specifically related to the viewquery.php file. The issue stems from an unknown function that improperly handles the 'eid' argument, leading to potential SQL injection attacks. This flaw allows remote attackers to exe...

A vulnerability exists in the VStarcam O-KAM SuperIPCam 1.3.3.32, specifically in the function FUN_005a2d44 of the SuperIPCam.exe file related to P2P Session Teardown. This flaw allows for a use-after-free scenario, which can be exploited remotely. The issue was publicly disclosed, and despite at...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A stack-based buffer overflow vulnerability exists in the VStarcam O-KAM Client version 1.3.3.32, specifically in the function FUN_10003EA0 within the DevDll_925.dll library. This flaw enables an attacker to execute arbitrary code remotely, posing significant security risks to affected systems. D...

A path traversal vulnerability exists in the deepset-ai FARM product, specifically in the WordEmbedding_LM.load function located in the language_model.py file. This weakness arises from inadequate validation of the 'embeddings_filename' argument, allowing attackers to potentially access restricte...

A flaw in deepset-ai Farm, affecting versions up to 0.8.0, allows an attacker to exploit the `EmbeddingTokenizer.from_pretrained` method in the Tokenizer Loader component. By manipulating the `vocab_filename` argument, an attacker can execute a path traversal attack, which could lead to unauthori...

A significant security vulnerability exists in the Webpro-nl Knip product versions up to 6.44.0, specifically within the function writeFile located in the Workspace Handler component. This vulnerability arises due to improper handling of arguments in the function which allows attackers to execute...

A weakness has been identified in Aklivity Zilla versions up to 1.3.4, 2.4.7, and 2.5.0-rc2, specifically within the Path.resolve function of the FileSystemServerFactory component. This vulnerability allows manipulation of argument parameters, leading to potential path traversal attacks. Remote e...

A use-after-free vulnerability was identified in Apple’s Safari browser and iOS platforms, which could allow attackers to craft malicious web content that may result in memory corruption. This vulnerability has been addressed with enhanced memory management protocols in versions 26.5.2 of Safari,...

A vulnerability exists in Termix-SSH (versions up to 2.9.2) affecting the processing of the path argument within the file transfer functionality. Specifically, the parameter 'destPath' is susceptible to manipulation, allowing remote attackers to exploit the system via path traversal techniques. T...

A deserialization vulnerability exists in the Workflow Fork Endpoint of jxxghp MoviePilot versions up to 3.1.2, located in the WorkflowExecutor.restore_context function within the app/chain/workflow.py file. This issue allows an attacker to execute malicious code remotely, leading to potential da...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability in the Flask framework allows for session data to be improperly cached by proxies, potentially exposing sensitive session cookies to unintended clients. This occurs when certain conditions are met: the application must be behind a caching proxy that fails to strip cookies, use per...