Publicly Disclosed
PoC Exploits

OpenMetadata versions up to 2.0.2 exhibit a server-side request forgery vulnerability in the URLValidator.validateURL function. This flaw arises from improper DNS hostname resolution and inadequate validation of internal addresses. Users with permissions to create or update EventSubscription can ...

ClipBucket versions prior to 5.5.3-#197 contain a vulnerability in the admin template editor that allows authenticated administrators with manage_template_access permission to exploit directory traversal sequences. This flaw enables the modification of executable PHP files by traversing outside o...

GNU libextractor prior to version 1.16 is susceptible to a privilege escalation vulnerability due to the improper handling of the LIBEXTRACTOR_PREFIX environment variable. This flaw allows a local attacker to exploit the system by loading plugins from an untrusted search path, potentially executi...

The TDuck Survey Form version 6.0 has a vulnerability that allows remote unauthenticated attackers to submit form entries without providing valid passwords. The application relies solely on client-side validation for write password enforcement, which can be bypassed through direct API access usin...

The TDuck Survey Form 6.0 has a significant information disclosure issue wherein the FormAuthUtils.hasPermission method operates in a fail-open mode. This flaw allows authenticated users to access submissions from forms that are no longer valid. Specifically, when a user provides a dataId for a p...

The TDuck Survey Form, up to version 6.0, is susceptible to an authorization bypass vulnerability. Non-admin authenticated users can exploit the FormThemeController endpoints to manipulate global form themes and categories. This allows them to add, modify, or delete themes and theme categories, w...

A cross site scripting vulnerability exists in Krayin Laravel-CRM versions up to 2.2.5, specifically in the Upload Functionality's ConfigurationForm::rules method. This issue can be exploited remotely, allowing attackers to inject scripts into web pages viewed by users. The vulnerability has been...

A vulnerability was identified in the Krayin Laravel-CRM framework affecting the User Management component. This issue arises from improper handling of the role_id argument in the UserController.php file, allowing unauthorized users to gain elevated privileges. The flaw can be exploited remotely,...

X-SpringBoot versions up to 6.0 include a hardcoded static master login verification code (172839) that is enabled by default in the database seed. This vulnerability enables unauthenticated attackers to authenticate as any user by simply providing the public master code along with a known email ...

The X-SpringBoot framework through version 6.0 is susceptible to an object-level authorization bypass in its user management functionality. This vulnerability allows sub-administrators to manage users without proper ownership verification. Attackers with user-management permissions can exploit th...

X-SpringBoot up to version 6.0 has a vulnerability in its application manager functionality that exposes sensitive appKey and appSecret credentials via an unauthenticated GET request. The flaw allows unauthorized attackers to access these credentials through the /application/manager/select endpoi...

A SQL injection vulnerability has been identified in the mathurvishal CloudClassroom-PHP-Project, specifically within the managevideos2.php file. This issue arises from the manipulation of the argument 'editassid', allowing remote attackers to execute unauthorized SQL commands. The software follo...

A vulnerability has been identified in the mathurvishal CloudClassroom-PHP-Project, specifically in the updatefaculty.php file. This flaw arises from improper validation of the 'fid' argument, allowing for SQL injection attacks that can be executed remotely. As the project employs a rolling relea...

A vulnerability has been identified in the mathurvishal CloudClassroom-PHP-Project, specifically in the Student Update Functionality located in the updatestudent.php file. This weakness, stemming from improper validation of user input, allows for SQL injection attacks through the manipulation of ...

A security vulnerability exists in the mathurvishal CloudClassroom-PHP-Project prior to version 5dadec098bfbbf3300d60c3494db3fb95b66e7be, specifically in the 'updatequery.php' file. This issue allows an attacker to manipulate the 'gid' argument, resulting in SQL injection that can be initiated re...

A vulnerability exists in the mathurvishal CloudClassroom-PHP-Project that allows for SQL injection through the Faculty Authentication component. This vulnerability specifically resides in the 'loginlinkfaculty.php' file, where improper handling of user input in the form of arguments 'fid/pass' c...

A significant security flaw has been found in the zhistaredu StarTraining product, specifically within the API-Docs Endpoint at the SecurityConfig.java file. This vulnerability allows for missing authentication, enabling remote attackers to exploit the system. The vulnerability pertains to an unk...

A significant vulnerability has been identified in the zhistaredu StarTraining product affecting the Druid Console component. The flaw exists in the 'anonymous' function located in the '/druid/index.html' file, where inadequate authentication controls can be exploited. Attackers may leverage this...

A vulnerability has been identified in the zhistaredu StarTraining software, specifically in the JWT Token Handler component. The issue arises from the UserLoginService.createToken function in application.yml, which leads to the use of hard-coded passwords due to improper handling of user_id and ...

A vulnerability exists in Zhonglun CloudPos, specifically in the OpenLocalBrowser function located in the JSBridge component. This vulnerability arises when an attacker manipulates the 'url' argument, leading to potential code injection, which can be executed remotely. The disclosure of this expl...

The Decepticon hacking agent from BitterSecurity is susceptible to a vulnerability due to improper handling of special-token literals in LLM messages generated during web crawls. In versions before 1.1.17, the system wraps results of agent reconnaissance without filtering these literals, allowing...

A deserialization flaw in the LangChain4j-agentic component impacts multiple pre-release versions, allowing remote exploitation if AgenticScope persistence is enabled. This issue was identified in the AgenticScopeSerializer.fromJson method and poses a risk where an attacker with write access to t...

A vulnerability has been identified in the Note Editor component of the sheshbabu zen product, specifically related to the use of the dangerouslySetInnerHTML function in NotesEditor.jsx. This issue allows an attacker to inject malicious scripts into a web page, leading to cross-site scripting (XS...

A vulnerability exists in the Automatic Update feature of Zhonglun CloudPOS 3.0, stemming from an inadequate implementation of the Program.cs file. Manipulating certain parameters—such as the version, URL, package key, or package name—can grant unauthorized access to channels that should be restr...

The ONT/Beacon device by Nokia features a critical input handling flaw in its unified WEBUI application. This vulnerability allows low-privileged authenticated users to exploit insufficient validation of user-supplied data, enabling them to execute arbitrary commands on the device's operating sys...

A vulnerability in Microsoft Office SharePoint permits an authorized attacker to execute code injection, enabling them to perform spoofing attacks over a network. This weakness poses significant risks as it can lead to unauthorized access and manipulation of sensitive information. Organizations u...

GNU Bash versions up to 4.3 are vulnerable to a code injection flaw due to the mishandling of trailing strings after function definitions in environment variables. This vulnerability enables remote attackers to execute arbitrary code by crafting specific environment variables under various condit...

An unauthenticated attacker can exploit a vulnerability in WordPress that allows `get_page_template()` to inadvertently resolve and include a chosen local `.php` file located outside of the active theme directories. When specific server conditions and configurations of the active theme are met, t...

An unauthenticated attacker can exploit a vulnerability in WordPress that allows `get_page_template()` to inadvertently resolve and include a chosen local `.php` file located outside of the active theme directories. When specific server conditions and configurations of the active theme are met, t...

An improper neutralization of input during web page generation vulnerability in Automattic WordPress core can lead to a DOM-Based XSS attack. This issue arises from the default configuration of WordPress, which allows unauthenticated users to exploit cross-site scripting by bypassing comment mode...

The MasterStudy LMS plugin for WordPress, specifically versions 1.9 through 3.7.50, is susceptible to a serious vulnerability that allows unauthorized course enrollment. The flaw arises because the plugin fails to verify whether a member's requested course aligns with their membership plan. As a ...

The wpForo Forum plugin for WordPress versions 3.0.0 to 3.1.5 has a vulnerability that fails to adequately verify client-supplied IP address headers. This flaw enables unauthenticated attackers to manipulate these headers, thereby bypassing established rate limits on paid AI requests. As a result...

The Bookly WordPress plugin prior to version 28.3 is susceptible to a vulnerability where it fails to adequately verify the identity of customers when they attempt to update their stored details. This oversight allows unauthorized attackers who have knowledge of a customer's primary identifier to...

An out-of-bounds write vulnerability has been identified in the libavcodec library of FFmpeg, particularly within the MagicYUV decoder. This flaw may lead to denial-of-service conditions and has the potential to be exploited for remote code execution. The issue arises from improper handling of ce...

The Link Library plugin for WordPress prior to version 7.9.6 suffers from a security flaw due to improper URL validation. When a user submits a URL, the plugin may revert to making requests to potentially unsafe internal network resources if the input is deemed unsafe. This lack of validation ena...

The Link Library WordPress plugin prior to version 7.9.6 contains a flaw that permits unauthorized users with the Contributor role and higher to create directories and manipulate image files on the server. This vulnerability arises due to a lack of proper sanitation of user-supplied input, allowi...

The Link Library WordPress plugin prior to version 7.9.6 is vulnerable due to inadequate escaping of certain parameters when generating links for its front-end directory pages. This oversight allows for the exploitation of Reflected Cross-Site Scripting attacks, affecting any visitor to the site,...

A significant vulnerability exists in Sanluan PublicCMS, affecting versions up to 6.202506.e. This flaw is found in the CmsContentAdminController, specifically in the exportExcel/exportData functionality. An attacker can exploit this vulnerability to bypass authorization controls by manipulating ...

Pangolin versions prior to 1.22.0 have a security flaw that permits unauthorized users to bypass authentication mechanisms. This vulnerability arises when an attacker manipulates URL parameters for the share-link authentication endpoint, leading to unauthorized access to various protected resourc...

The Visual Composer Website Builder plugin for WordPress allows local file inclusion through the `vcv-template` parameter in all versions up to and including 45.16.0. This vulnerability enables unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to ...

Prior to the versions 2026.2.7, 2026.5.7, and 2026.8.2, Authentik had a privilege escalation vulnerability whereby accounts with delegated group management permissions could grant superuser status without proper authorization. This issue affected only deployments where non-administrators were giv...

A cross site scripting vulnerability exists in the ningzichun student-management-system due to improper handling of user input in the echo function of admin/fun/addLog.php. This flaw allows an attacker to manipulate the 'reason' and 'detail' arguments, potentially leading to the execution of mali...

The Visual Composer Website Builder plugin for WordPress allows local file inclusion through the `vcv-template` parameter in all versions up to and including 45.16.0. This vulnerability enables unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to ...

A significant vulnerability exists within the ningzichun student-management-system, specifically in the file example_lite.sql, allowing attackers to exploit an unknown functionality. This flaw facilitates the use of default credentials, enabling unauthorized remote access. Although the issue has ...

A cross-site request forgery vulnerability has been identified in the Ningzichun Student Management System, affecting versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This flaw allows attackers to execute unauthorized commands on behalf of users without their consent, enabling remote expl...

The vulnerability in Apache OFBiz arises from an outdated XML-RPC component, which has not been maintained and poses a risk of pre-authentication remote code execution. This issue specifically affects Apache OFBiz versions before 18.12.10, highlighting the necessity for users to upgrade to the la...

A security vulnerability has been identified in the ningzichun Student Management System, specifically affecting versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. The issue resides in an undisclosed function within editLog.php, which allows for the manipulation of parameters such as sid, a...

A vulnerability has been identified in the ningzichun Student Management System, specifically affecting the file admin/fun/getStudent.php. This weakness allows attackers to bypass authorization by manipulating the 'sid' argument. The vulnerability can be exploited remotely, allowing unauthorized ...

A vulnerability in the chillzhuang SpringBlade framework has been identified, affecting the UserServiceImpl.userInfo function. This weakness allows an attacker to manipulate userId arguments, leading to unauthorized access to user information. The exploitable endpoint can be accessed remotely, ra...

Copyparty's SFTP front end is vulnerable to a volume restriction bypass, allowing authenticated users to create, delete, or modify files outside their permitted volume boundaries. By exploiting specific handlers (_mkdir, _rmdir, and _chattr), attackers can craft destination paths without proper a...