Publicly Disclosed
PoC Exploits

Flowise, a user-friendly platform for creating customized large language model flows, has a significant vulnerability in version 3.0.5 that allows for remote code execution. The flaw lies within the CustomMCP node, where user input is inadequately sanitized. Specifically, the mcpServerConfig stri...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

A vulnerability has been identified in Keycloak involving the SingleUseObjectProvider, a global key-value store. This flaw allows an unauthenticated attacker to exploit the system by forging authorization codes. If successfully exploited, it could lead to the creation of admin-level access tokens...

An issue has been identified in Microsoft Defender that could allow an authorized attacker to gain elevated privileges through improper link resolution before file access, also known as link following. This vulnerability could enable attackers to manipulate file paths, potentially leading to unau...

A security weakness has been identified in the itsourcecode Hospital Management System version 1.0, pertaining to the file /viewdoctorconsultancycharge.php. An attacker can exploit this vulnerability by manipulating the 'delid' parameter, which leads to unauthorized SQL queries. This SQL injectio...

A critical flaw has been identified in the Macrozheng Mall's mall-portal module, specifically within the /sso/getAuthCode functionality. This vulnerability facilitates weak password recovery mechanisms, enabling potential attackers to manipulate the authentication process. The exploit can be exec...

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log messag...

A file inclusion vulnerability exists in the Installation Wizard of DedeCMS versions up to 5.7.118 UTF8SP2. This issue arises from the manipulation of the _4_Setup function located in the install/index.php file, potentially allowing an attacker to include arbitrary files remotely. The complexity ...

A notable access control vulnerability has been identified in the V-Secure Jingyun Antivirus version 2.4.2.39. This flaw occurs in the ZyArk.sys library of its Kernel Driver component and can be exploited locally, allowing unauthorized access to sensitive functions. The weakness stems from improp...

A vulnerability exists in the Built-in HTTP API Service of mifi lossless-cut versions up to 3.69.0, which may allow attackers to manipulate the service leading to server-side request forgery. This attack requires local network access and has a high complexity level, making exploitation challengin...

A vulnerability has been identified in Jiangmin Antivirus 21 that affects the MessageNotifyCallback function within the kvcore.sys library of the Minifilter Port. This flaw allows for improper access controls, enabling local attackers to potentially exploit the system through unauthorized manipul...

A SQL injection vulnerability exists in the Request Parameter Handler of the dresende node-sql-query library. The affected function, SelectQuery.from/SelectQuery.build, can be exploited remotely through manipulated requests, potentially allowing attackers to execute unauthorized SQL commands. Thi...

A security flaw identified in the Shenzhen Aitemi M300 Wi-Fi Repeater allows for a command injection via the sprintf function in the protocol.csp file. Attackers can manipulate parameters such as enable, name, or mac, leading to remote command execution. This vulnerability has been made public an...

A security flaw in the itsourcecode Hospital Management System version 1.0 allows for SQL Injection via manipulated parameters in the /viewdoctor.php file. This vulnerability can be exploited remotely, enabling attackers to interact with the database maliciously. The exploit is publicly accessibl...

A command injection vulnerability has been identified in the Tenda CH22 router, specifically in the function formCertListInfo located in the /goform/CertListInfo file. This vulnerability arises from improper handling of the 'Name' argument, allowing an attacker to execute arbitrary commands on th...

A significant vulnerability has been identified in the Task Management System version 1.0 developed by Code-Projects. The issue lies within the /user/UpdateTaskStatus.php file where a manipulation of the task_id/val parameter can lead to a lack of proper authorization checks. This flaw permits re...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

A SQL injection vulnerability has been identified in the code-projects Task Management System version 1.0, specifically in the file /user/comment_count_user.php. This flaw allows attackers to manipulate the 'task_id' argument, potentially leading to unauthorized database access. Given that the ex...

A vulnerability has been identified in the Code-Projects Task Management System version 1.0. This flaw exists within the '/admin/AdminLogin.php' file's handling of email and password arguments, allowing remote attackers to execute SQL injection attacks. Exploiting this vulnerability could potenti...

A security flaw exists in the code-projects Task Management System 1.0 related to the login functionality. This vulnerability arises from improper handling of the password parameter within the /index.php file. An attacker can exploit this loophole remotely, allowing unauthorized access and manipu...

A security vulnerability has been identified in UTT HiPER 1200GW, affecting versions up to 2.5.3-170306. The issue lies within the strcpy function of the /goform/pptpSrvGlobalConfig file, where improper handling of the EncryptionMode argument can lead to a stack-based buffer overflow. This vulner...

The CubeWP Framework WordPress plugin prior to version 1.1.31 contains a significant vulnerability due to improper sanitization and lack of capability checks on an AJAX action. This flaw allows users with Subscriber-level access and higher to execute SQL injection attacks, potentially compromisin...

The LWS Optimize plugin for WordPress prior to version 4.1.2 contains an improper input validation vulnerability. This flaw allows attackers to exploit an unauthenticated analytics endpoint, enabling them to inject arbitrary web scripts into the administrative dashboard. When an administrator acc...

The InfiniteWP Client for WordPress contains a security flaw where the plugin fails to verify the connection state and the authenticity of requests at its remote management endpoint, particularly within WordPress Multisite setups. This oversight permits unauthenticated attackers to bind a malicio...

An SQL injection vulnerability exists in the WP Directory Kit plugin for WordPress, versions prior to 1.5.5. This issue arises due to inadequate sanitization and escaping of user-supplied parameters before they are incorporated into SQL statements. As a result, unauthenticated attackers may explo...

The Create WordPress plugin, prior to version 2.5.4, lacks proper authorization checks on one of its public REST API routes. This oversight allows unauthenticated attackers to access unpublished content, which can be rendered and made publicly available through the API. The vulnerability compromi...

The WP MAPS PRO plugin for WordPress prior to version 6.1.3 lacks proper capability checks for certain AJAX actions. This oversights allows unauthenticated users to exploit these actions, leading to potential uncontrolled recursion. As a result, attackers may consume server resources excessively,...

The WPC Order Tip for WooCommerce plugin prior to version 3.3.1 is susceptible to an authorization bypass due to the lack of proper nonce verification and authorization checks in its reporting functionality. This oversight permits unauthorized individuals to access sensitive order information for...

The PiWeb Cancel order/Refund request feature in the WooCommerce plugin for WordPress versions prior to 1.3.4.34 lacks essential authorization checks. This vulnerability enables unauthenticated users to access and disclose the contents of other customers' orders without permission. Moreover, it a...

The WP MAPS PRO plugin for WordPress prior to version 6.1.3 is prone to a security vulnerability due to the lack of capability checks in AJAX actions accessible to unauthenticated users. This oversight permits unauthorized attackers to exploit file inclusion vulnerabilities by supplying a user-co...

The WP Data Access plugin for WordPress before version 5.5.79 contains a vulnerability where it fails to properly validate column names in an unauthenticated AJAX action. This oversight permits attackers to manipulate requests and gain unauthorized access to the database. Specifically, they could...

The Create WordPress plugin versions prior to 2.5.4 contain a significant vulnerability where an authorization check is not enforced on certain REST API routes. This oversight allows attackers to access unpublished content without authentication, potentially leading to unauthorized exposure of se...

The Iptanus File Upload plugin for WordPress prior to version 5.1.8 contains a vulnerability where a lack of proper sanitization and escaping of a specific parameter allows unauthenticated users to execute SQL injection attacks. This oversight can lead to unauthorized access to sensitive data or ...

The Nexter Blocks WordPress plugin prior to version 5.0.2 suffers from improper access control, allowing users with a Contributor role to save arbitrary CSS through its REST endpoints. This oversight enables potential attackers to inject CSS that can alter the site's appearance, facilitating meth...

The WP Photo Album Plus plugin for WordPress prior to version 9.2.07.002 lacks proper capability and nonce checks for its public REST endpoint actions. This vulnerability allows unauthenticated users to delete ZIP archives of generated album exports, potentially leading to unauthorized loss of us...

The GeoDirectory WordPress plugin, prior to version 2.8.169, lacks necessary authorization checks when returning map marker data for individual listings. This flaw allows unauthorized users to access and reveal details such as the title and geographic coordinates of listings that are pending or i...

The Solace Extra plugin for WordPress, prior to version 1.6.1, has a notable design flaw where it lacks proper capability and nonce checks for specific AJAX operations. This vulnerability allows any authenticated user, including subscribers, to make unauthorized modifications to post meta data on...

The Slim SEO WordPress plugin prior to version 4.9.11 allows users with the Contributor role to access post-meta data that they should not be able to view. This vulnerability occurs because the plugin does not adequately restrict access to the post-meta preview feature. As a result, users can rea...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A flaw in the Linux kernel's xfs filesystem can lead to stale data fork mappings during operations involving ILOCK cycles. The xfs_reflink_fill_{cow_hole,delalloc} functions, which manage data and cow fork mappings, may fail to refresh the data fork mapping when reacquiring the ILOCK. This oversi...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

The Flowise application version 3.1.4 is susceptible to a server-side request forgery (SSRF) vulnerability due to an inadequate deny-list configuration in its SSRF guard found in httpSecurity.ts. Specifically, the default configuration omits critical endpoints associated with Oracle Cloud Infrast...

The awslabs.aws-transform-mcp-server tool from Amazon contains a vulnerability due to improper validation of the savePath parameter, which could allow an attacker to write files outside the designated working directory. This issue affects versions 0.1.0 through 0.1.4. Users are encouraged to upgr...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

IPFire version 2.19 is susceptible to a Remote Command Injection vulnerability through its ids.cgi component. The issue arises from improper handling of the OINKCODE parameter allowing authenticated users to execute arbitrary shell commands. This vulnerability can be exploited directly or via Cro...

An unauthenticated remote code execution vulnerability has been identified in JetBrains TeamCity prior to version 2026.1.3 and 2025.11.7. This weakness is exposed through the agent polling protocol, allowing attackers to execute arbitrary code without authentication, posing significant risks to t...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

A command injection vulnerability has been identified in the MCPGateway by Abdullah1854, specifically within the 'getUsageByDateRange' function located in the file 'src/services/claude-usage.ts'. This vulnerability arises due to improper handling of input parameters, allowing an attacker to manip...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...