Publicly Disclosed
PoC Exploits

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

An improper authorization vulnerability exists in the WebDAV COPY operation handler of Sigoden Dufs up to version 0.46.0. This weakness allows attackers to manipulate authorization processes, potentially enabling remote exploitation. It is crucial to upgrade to version 0.47.0 or later to address ...

A vulnerability has been identified in the TRENDnet TEW-657BRM router affecting the sprintf function within /setup.cgi of the mini_httpd component. This flaw allows for out-of-bounds writes, which can potentially be exploited remotely. As the affected product has been discontinued for over 15 yea...

This vulnerability allows unauthorized command execution in the GPU micronode, leading to potential memory corruption when a specific sequence of commands is executed. Attackers could exploit this weakness to disrupt system functionality or gain access to sensitive areas of memory, posing risks t...

A vulnerability has been identified in the D-Link DIR-600L router's HNAP Handler, specifically in the hnap_main function located in the cgibin directory. This flaw allows an attacker to execute a remote stack-based buffer overflow attack, leading to potential unauthorized access and control over ...

A vulnerability has been identified in the D-Link DIR-600L router, specifically within the authentication functionality of the file 'authentication.cgi'. This vulnerability can be exploited by manipulating the 'id' or 'password' arguments, leading to a stack-based buffer overflow. As a result, at...

A NULL pointer dereference vulnerability exists in GPAC versions prior to 26.02.0, specifically in the m2tsdmx_update_sdt() function. This flaw can be exploited by attackers who provide a specially crafted .ts file containing an invalid service descriptor. When the service or provider names are l...

A NULL pointer dereference flaw exists in GPAC prior to version 26.02.0, specifically in the function gf_node_get_field_by_name() located in src/scenegraph/base_scenegraph.c. This vulnerability allows attackers to craft a malicious XMT scene that references a non-existent node, potentially crashi...

A type confusion vulnerability exists in GPAC prior to version 26.02.0 within the ctxload_process() function. The flaw allows attackers to pass non-object descriptors to the ODS_SetupOD() function without appropriate checks on the descriptor tag. By supplying a maliciously crafted XMT file contai...

The littlefs version up to 2.11.3, when built with LFS_MIGRATE, has a type confusion vulnerability in its lfs_dir_traverse function. This vulnerability allows attackers to exploit crafted littlefs v1 images that cause the metadata to be improperly interpreted as LFS_FROM_USERATTRS during migratio...

MicroQuickJS, prior to commit 99eed3f, is susceptible to an out-of-bounds read vulnerability. This occurs when the JS_Call() function raises exceptions during frame setup without appropriately updating the context stack pointer (ctx->sp) and frame pointer (ctx->fp). Consequently, an attacker can ...

Cyrus SASL versions up to 2.1.28 contain a serious authentication bypass flaw within the SRP server mechanism. The vulnerability arises when the function srp_server_mech_step2 fails to reject client public values A that are multiples of N. This allows unauthenticated network clients to manipulate...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A heap-based buffer overflow vulnerability exists in the DrayTek Vigor2960, specifically within the file existence check function in the mainfunction.cgi file. This flaw can be exploited remotely by manipulating the 'upload_name' argument, which could lead to memory corruption. Users are strongly...

A command injection vulnerability exists in DrayTek Vigor2960 version 1.5.1.6 due to inadequate input validation in the set_table function of the /cgi-bin/mainfunction.cgi file. An attacker can exploit this weakness remotely by manipulating the 'jsondata' argument, allowing unauthorized commands ...

A path traversal vulnerability exists in the DrayTek Vigor2960 router versions up to 1.5.1.6, specifically within the app_guest_export function of the mainfunction.cgi script. By manipulating input parameters, an attacker can gain unauthorized access to files on the server, which may result in po...

A path traversal vulnerability exists in the DrayTek Vigor2960 router affecting version 1.5.1.6. This flaw is related to the handling of the 'option' parameter in the /cgi-bin/mainfunction.cgi?action=doWebBackup function, which allows attackers to manipulate this input to disclose sensitive data ...

A security vulnerability has been identified in the DrayTek Vigor2960 that allows remote command injection via manipulation of the swmconfigupload argument in the mainfunction.cgi file. Existing in versions up to 1.5.1.6, this flaw can be exploited by attackers to execute arbitrary commands on th...

A security flaw in the D-Link DIR-850L with firmware version FW1.20WWb03 compromises the Console Login component due to hard-coded credentials found in the /usr/sbin/consolepwd file. This vulnerability allows local attackers to easily exploit the system, gaining unauthorized access. The details o...

Prior to version 1.11.3, FreeSWITCH is susceptible to a vulnerability in the sofia_presence_handle_sip_i_message() function that mishandles the parsing of SIP MESSAGE requests. By improperly splitting the 'To' user on a plus sign, it allows attackers to leverage the chat protocol selector. This e...

The D-Link DSL-6740C router contains a vulnerability within the FTP Daemon component, specifically in the ftpd_conf.php file. This flaw exposes hard-coded credentials, allowing unauthorized remote access to the device. Attackers can exploit this vulnerability using publicly available methods, pot...

The itsourcecode Airline Reservation System 1.0 contains a vulnerability in the /admin/manage_user.php file, which allows for SQL injection through improper handling of the ID argument. This flaw may enable remote attackers to manipulate SQL queries, potentially leading to unauthorized access to ...

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log messag...

The vulnerability in Sudo prior to version 1.9.5p2 arises from an off-by-one error that can lead to a heap-based buffer overflow. This flaw can be exploited through 'sudoedit -s' when given a command-line argument that concludes with a backslash. Successful exploitation can grant attackers elevat...

The vulnerability in Sudo prior to version 1.9.5p2 arises from an off-by-one error that can lead to a heap-based buffer overflow. This flaw can be exploited through 'sudoedit -s' when given a command-line argument that concludes with a backslash. Successful exploitation can grant attackers elevat...

The Custom Block Builder plugin for WordPress prior to version 3.0.0 has a critical flaw in its permission checks for REST routes. It fails to properly deny unauthorized requests, allowing unauthenticated users to manipulate server-side PHP code. This oversight can lead to serious security breach...

The Burst Statistics plugin for WordPress versions prior to 3.7.5 contains a vulnerability that permits unauthorized access to report statistics. This occurs because the plugin fails to enforce date range restrictions on shared report links, enabling users with access to the link to view statisti...

The Burst Statistics plugin for WordPress prior to version 3.7.5 is susceptible to an information disclosure issue. This vulnerability arises because the plugin does not validate whether a reported page view is linked to published content. Additionally, it fails to check the post status before di...

The Membership Plugin for WordPress prior to version 4.0.6 contains a significant access control vulnerability. It fails to ensure that the membership referenced in a saved-card payment request belongs to the user making the request. This flaw allows subscribers to potentially access and disclose...

The RegistrationMagic plugin for WordPress prior to version 6.1.0.4 has a security flaw that permits unauthenticated users to exploit the registration form. This vulnerability allows attackers to overwrite the profile fields of legitimate, non-administrator users without verifying the ownership o...

The WPGraphQL plugin for WordPress prior to version 2.27.1 features a critical access control flaw that allows users with Contributor roles and above to bypass restrictions on custom non-public post statuses. This means they can unintentionally access and read posts created by other users, potent...

The Membership Plugin for WordPress prior to version 4.0.6 lacks essential authorization and CSRF checks. This oversight allows unauthenticated users to execute a schema-altering database maintenance process, leading to potential data corruption. Specifically, it permits these users to alter the ...

The RegistrationMagic plugin for WordPress fails to properly escape user-supplied values in admin screens, enabling attackers to inject arbitrary JavaScript. This vulnerability can be exploited by unauthenticated users who craft a malicious link, tricking administrators into executing the injecte...

The Auth Armor plugin for WordPress, up to version 1.0.3, contains a critical vulnerability that allows logged-out users to access several handlers without authentication. This flaw leads to exposure of the site's stored API credentials, which can be exploited by unauthenticated attackers. Conseq...

The A2Reviews WordPress plugin version 1.2.3 contains an authorization bypass vulnerability that allows unauthenticated attackers to modify its settings and product review metadata. This occurs due to improper verification of authorization on multiple API command handlers, which rely on a signatu...

The RegistrationMagic plugin for WordPress is susceptible to an SQL injection vulnerability due to improper sanitization and escaping of parameters within its SQL statements. This flaw enables users with elevated privileges, such as administrators, to manipulate database queries, potentially lead...

The Payment Gateway via Valitor for WooCommerce plugin prior to version 1.9.41 has a significant security flaw that compromises payment confirmation processes. It does not adequately validate the authenticity of payment callbacks, relying on a hard-coded verification secret that is common across ...

The vulnerability in MailEnable arises from improper handling of XML External Entity (XXE) references within the parseObjectResponse method. This flaw permits remote attackers to gain unauthorized access to sensitive data present in the system. Exploitation of this security issue requires user au...

A cross site scripting vulnerability has been identified in the Linux Foundation's Magma NMS component, specifically within the handleReact function of the nms/server/main/routes.ts file. This vulnerability enables attackers to manipulate the web application to execute malicious scripts remotely....

A remote exploitation vulnerability exists in the Host Middleware of Linux Foundation Magma, specifically within the hostOrgMiddleware function. This issue arises from improper handling of the role argument, leading to a lack of necessary authorization checks. As a result, attackers could remotel...

A vulnerability exists in the vllm-project's vllm versions 0.30.0 and 0.31.0 due to a race condition in the single_type_kv_cache_manager.py file. This flaw allows an attacker to exploit the manipulation of the Common Prefix Handler, potentially leading to unauthorized data access. The exploitatio...

A vulnerability has been identified in the D-Link DIR-600L router's HNAP Handler, specifically in the hnap_main function located in the cgibin directory. This flaw allows an attacker to execute a remote stack-based buffer overflow attack, leading to potential unauthorized access and control over ...

The vulnerability in the TLS and DTLS implementations of OpenSSL versions prior to 1.0.1g allows remote attackers to exploit crafted Heartbeat Extension packets. This exploitation results in a buffer over-read, potentially revealing sensitive information from the memory of the affected process. A...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A vulnerability has been identified in the D-Link DIR-600L router, specifically within the authentication functionality of the file 'authentication.cgi'. This vulnerability can be exploited by manipulating the 'id' or 'password' arguments, leading to a stack-based buffer overflow. As a result, at...

A buffer overflow vulnerability has been identified in the TRENDnet TEW-657BRM router, specifically linked to the processing of the 'upgrade_flash.cgi' file. This flaw allows remote attackers to manipulate input argument boundaries, potentially leading to unauthorized access or service disruption...

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

A vulnerability has been identified in the TRENDnet TEW-657BRM router affecting the sprintf function within /setup.cgi of the mini_httpd component. This flaw allows for out-of-bounds writes, which can potentially be exploited remotely. As the affected product has been discontinued for over 15 yea...

A vulnerability in SiteSkite, a WordPress plugin, allows unauthenticated users to execute arbitrary code remotely. This serious security flaw affects versions 2.1.8 and earlier, potentially leading to unauthorized access and manipulation of vulnerable installations. Users are strongly advised to ...