Publicly Disclosed
PoC Exploits

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A security feature bypass vulnerability exists in Microsoft Windows, referred to as 'YellowKey.' This flaw could allow unauthorized access to restricted features, compromising system integrity. A proof of concept has been publicly released, contrary to established security practices. Users are ad...

The Apache Camel Kafka Component is susceptible to an input validation flaw that enables an attacker to manipulate the target Kafka topic at runtime. Specifically, the kafka.OVERRIDE_TOPIC header can be exploited to publish messages to arbitrary, potentially sensitive topics, bypassing predefined...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

The affected versions of cPanel and WHM contain a serious authentication bypass flaw in the login flow. This vulnerability enables unauthenticated remote attackers to bypass authentication mechanisms, allowing them to gain unauthorized access to the control panel. Users of the specified versions ...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

The Apache Camel IRC component is vulnerable due to improper input validation that allows an attacker to manipulate the destination of IRC messages. This occurs when an HTTP route passes headers from an inbound request without proper filtering, allowing any client to redirect messages meant for a...

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default ...

A vulnerability has been discovered in the MetaCRM software from Metasoft, affecting versions up to 6.4.0 Beta06. This flaw resides in the file /business/qnaire/upload.jsp, where an unknown function allows for unrestricted file uploads. This capability could enable attackers to upload malicious f...

A vulnerability exists in Apache Camel's DAPR component, specifically in the Dapr Pub/Sub consumer. This flaw arises from improper input validation, allowing an attacker with publishing rights to manipulate CloudEvent headers, namely the pub/sub component name and topic. By doing so, they can red...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

The ktransformers library, versions up to 0.6.3, is vulnerable to an unauthenticated pickle deserialization flaw. This vulnerability allows remote attackers to execute arbitrary commands by sending specially crafted pickle payloads to the SchedulerServer's ZMQ ROUTER socket. By exploiting malicio...

The cal.diy application, from Calcom, is susceptible to an open redirect vulnerability located in the conferencing OAuth callback endpoint. This flaw allows attackers to craft malicious state parameters that can redirect unsuspecting users from a legitimate domain to arbitrary URLs controlled by ...

Huginn versions up to and including 2022.08.18 are susceptible to a server-side request forgery (SSRF) vulnerability found in the fetch_url method of ScenarioImport. Authenticated users can exploit this flaw to submit specially crafted URLs that allow them to perform arbitrary HTTP requests. This...

The Glance application version 0.8.5 is impacted by an IP address spoofing vulnerability within its authentication handler. This flaw allows unauthenticated attackers to evade brute-force lockout protections. By manipulating the X-Forwarded-For request header, attackers can present arbitrary valu...

The vulnerability in Adminer, found in versions prior to 5.4.3, arises from the improper handling of cookie attributes via the unsanitized X-Forwarded-Prefix HTTP header. This flaw enables attackers to manipulate the Set-Cookie path attributes, thereby downgrading SameSite protections. When a rev...

The vulnerability in HyperDX prior to version 2.31.0 allows authenticated team members to exploit the server using a controlled host parameter to access arbitrary internal destinations. This is done via the ClickHouse proxy test endpoint, which lacks proper URL validation and allowlist enforcemen...

Roo Code versions prior to 3.54.0 are susceptible to a command injection vulnerability that exploits the auto-approve feature. This flaw allows attackers to bypass predefined allowlist and denylist checks by nesting command substitutions within parameter expansions. The issue arises from the comm...

LimeSurvey versions 6.17.10 and 7.0.4 are vulnerable to server-side request forgery (SSRF) through their REST API. This vulnerability allows authenticated users to manipulate the Host header, enabling the server to execute arbitrary HTTP requests. Exploiting this flaw could permit attackers to ac...

Vitec Flamingo version 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint. This flaw enables remote attackers to execute arbitrary commands by taking advantage of a double-evaluation issue in how shell arguments are handled. The endpoint uses...

An improper input validation vulnerability exists in Apache Camel, affecting multiple versions. This flaw could potentially allow malicious actors to exploit the application by sending crafted requests, resulting in unintended behavior or security breaches. Users are strongly advised to upgrade t...

A vulnerability in NGINX Plus and NGINX Open Source arises when a map directive improperly utilizes regex matching in conjunction with string expressions referencing the map’s regex capture variables before the map output variable, or when non-cacheable variables are used under specific condition...

The Apache Camel JIRA component is susceptible to an improper input validation and authorization bypass vulnerability. This occurs due to the way it processes operation parameters from Exchange message headers without adequate filtering. The headers, such as `IssueKey`, `ProjectKey`, and `IssueTr...

Mattermost versions up to 11.6.0, 11.5.3, 11.4.4, and 10.11.14 exhibit a path traversal vulnerability due to insufficient validation of integration URLs. This flaw enables a malicious authenticated user, possessing a system admin Mattermost auth token, to exploit arbitrary API calls, potentially ...

A security vulnerability has been identified in the Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System version 8.2.2. The flaw resides within an unknown function located at /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp, where the manipul...

A stack-based buffer overflow vulnerability has been identified in the Tenda AC10 router's /goform/AdvSetLanip component, specifically within the fromAdvSetLanip function. This flaw arises due to improper handling of the GetValue/SetValue arguments, allowing an attacker to exploit the vulnerabili...

A security flaw has been identified in the itsourcecode Hospital Management System version 1.0. This vulnerability resides in the /prescriptionorderreport.php file, where insufficient input validation allows an attacker to manipulate the 'delid' argument. By exploiting this weakness, a malicious ...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

The ThumbPress WordPress plugin prior to version 6.2.2 is susceptible to a security flaw where it fails to verify user capabilities on specific AJAX actions. This omission allows authenticated users with subscriber permissions or higher to deactivate the plugin. Consequently, this can lead to con...

The Elementor Website Builder plugin for WordPress prior to version 4.1.4 contains a flaw that allows authenticated users with Contributor-level access or higher to improperly access private post data through its REST endpoints. This vulnerability permits these users to retrieve sensitive informa...

The Tag Groups plugin for WordPress versions prior to 2.2.0 is susceptible to a Cross-Site Scripting (XSS) vulnerability due to improper escaping of AJAX parameters. This flaw allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any logged-in user with Editor level a...

The MailerSend WordPress plugin prior to version 1.0.8 lacks a necessary nonce check for its configuration-delete action. While it verifies the manage_options capability, it fails to validate the nonce, allowing an attacker to potentially trick a logged-in administrator into visiting a maliciousl...

The PayPlus Payment Gateway plugin for WordPress has a security flaw that allows unauthenticated users to exploit AJAX actions, leading to unauthorized access to sensitive WooCommerce order information. By bypassing necessary authorization and order-ownership checks, attackers could potentially r...

The Social Login, Passkeys, Magic Link & Email OTP plugin for WordPress versions prior to 1.4.1 is vulnerable due to a lack of rate limiting and absence of lockout mechanisms for its passwordless email one-time-password verification. This oversight allows attackers to exploit the security weaknes...

The Kirki WordPress plugin prior to version 6.0.12 is susceptible to a sever-side request forgery (SSRF) vulnerability. This issue arises because the plugin does not adequately validate URLs provided by users, potentially allowing unauthenticated attackers to initiate HTTP requests to arbitrary s...

The PayPlus Payment Gateway plugin for WordPress, prior to version 8.2.2, has a vulnerability that permits unauthenticated users to access certain AJAX actions without proper authorization checks. This oversight allows an attacker to manipulate payment-related metadata associated with arbitrary W...

The All-in-One WP Migration and Backup plugin for WordPress prior to version 7.106 contains an improper input validation flaw. This vulnerability allows unauthenticated attackers to create or append log files in arbitrary locations outside of the intended storage directory. The plugin fails to pr...

The Kirki WordPress plugin prior to version 6.0.12 is vulnerable due to inadequate sanitization and escaping of the email subject and body inputs. This flaw enables unauthorized users to inject arbitrary HTML code into the password-reset emails sent to registered users, thereby exposing them to p...

The Kirki WordPress plugin prior to version 6.0.12 contains a significant vulnerability in that it fails to implement necessary authorization checks on one of its REST routes. This oversight permits unauthenticated users to not only overwrite existing comments but also to create comments that are...

A vulnerability exists in the LearnPress WordPress plugin, where certain search parameters are not adequately escaped before being rendered in HTML attributes. This oversight can lead to reflected cross-site scripting (XSS) attacks, which may execute malicious scripts in the browsers of users, pa...

The SlimStat Analytics plugin for WordPress allows unauthenticated users to inject malicious scripts due to improper handling of guested geolocation values in admin analytics reports. This shortcoming can lead to the execution of XSS payloads when an administrator views these reports, particularl...

The Modern Event Calendar Pro and Lite plugins for WordPress are vulnerable due to improper sanitization and escaping of request parameters used in SQL statements during an AJAX action. This weakness allows unauthenticated users to exploit the vulnerabilities, leading to unauthorized access to da...

The All in One SEO plugin for WordPress prior to version 4.9.9 has a security issue where it fails to properly restrict access to certain AI integration REST API endpoints. This flaw allows users with minimum privileges, such as Contributors, the potential to overwrite or reset critical site-wide...

The WP Travel plugin for WordPress prior to version 11.7.1 is susceptible to an unauthorized action vulnerability that permits unauthenticated users to cancel any booking on the site. The plugin fails to implement necessary capability and ownership checks during the booking cancellation process, ...

The Reviews Feed, a plugin for WordPress, fails to sanitize WordPress shortcodes present in third-party review content before rendering them via its dynamic block. This oversight permits unauthenticated attackers to execute arbitrary shortcodes on any pages displaying the feed, potentially compro...

The Unlimited Elements for Elementor WordPress plugin, prior to version 2.0.11, fails to properly sanitize or escape content fetched from the Google Serp API. This vulnerability allows unauthenticated attackers to submit malicious reviews to a targeted business's Google listing. When these review...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A security feature bypass vulnerability exists in Microsoft Windows, referred to as 'YellowKey.' This flaw could allow unauthorized access to restricted features, compromising system integrity. A proof of concept has been publicly released, contrary to established security practices. Users are ad...

Pdfminer.six, an open-source library for extracting information from PDF documents, is vulnerable to arbitrary code execution due to improper handling of malicious pickle files embedded in specially crafted PDF files. Specifically, the issue arises from the `CMapDB._load_data()` function that uti...

Langflow, a tool for constructing and deploying AI-driven agents and workflows, is susceptible to a vulnerability in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint in versions before 1.9.0. This vulnerability enables an attacker to build public flows without authentication, leveraging ...