Publicly Disclosed
PoC Exploits

A vulnerability in PHP allows for the possibility of remote code execution due to improper management of global state that can reference freed memory. In certain scenarios, the global state retains stale information from previous requests, potentially enabling an attacker to execute arbitrary cod...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A command injection vulnerability has been identified in the Edimax BR-6208AC router running firmware version 1.32. This flaw exists within the processing logic of the /goform/mp file, where improper validation allows attackers to execute arbitrary commands remotely. Although the exploit has been...

The vulnerability in libwebsockets arises from improper handling of PUBACK packets within the MQTT Protocol, allowing remote attackers to exploit the flaw. This security issue stems from insufficient validation of input data, leading to the potential for arbitrary code execution by writing beyond...

A security flaw in the OpenBMB Internet of Agents affects the WebSocket Connection Manager's ConnectionManager.connect function. The vulnerability allows manipulation of the agent_name argument, which can lead to missing authentication. This can potentially enable attackers to launch attacks remo...

A SQL injection vulnerability has been discovered in itsourcecode's Online Book Store version 1.0. The flaw resides in the /admin_edit.php file, where improper handling of the 'bookisbn' parameter can allow remote attackers to exploit the application. This vulnerability allows them to manipulate ...

An uncontrolled recursion vulnerability in Elasticsearch can lead to a denial of service through serialized data with nested payloads. Attackers with network access to the cluster's server interface can craft malicious requests that may cause the node to terminate. Since no authentication is need...

A missing authentication vulnerability has been identified in AgentScope's Agent Service, particularly in the 'get_current_user_id' function of the 'deps.py' file. This flaw allows an attacker to manipulate the 'X-User-ID' argument, potentially bypassing authentication mechanisms. The vulnerabili...

A significant flaw exists in the Bash Tool component of the agentscope-ai AgentScope application, specifically in the check_permissions function located in the file src/agentscope/tool/_builtin/_bash.py. This vulnerability leads to incorrect authorization, enabling potential attackers to exploit ...

A critical security flaw has been identified in AgentScope's MCP Workspace API due to improper handling of subprocess commands in the _config.py file. This vulnerability allows attackers to manipulate the command argument within the subprocess.Popen function, potentially enabling remote code exec...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A vulnerability identified in eosphoros-ai's DB-GPT product version 0.8.1 involves the FileBasedSkill.get_prompt function, leading to improper handling of special elements within the Jinja2 template engine. This issue enables potential attackers to exploit the vulnerability remotely, posing signi...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability identified in eosphoros-ai's DB-GPT affects the exec_module function in hf_adapter.py of the HuggingFace Adapter component. By manipulating the trust_remote_code argument, attackers could execute unauthorized functionality from an untrusted source. This vulnerability can be exploi...

A vulnerability has been identified in eosphoros-ai DB-GPT, specifically within the execute_code function in the code_utils.py file of the CodeAction component. This flaw allows an attacker to manipulate the system and execute arbitrary code from a remote location. Publicly available exploits can...

Hikvision network camera devices suffer from an improper authentication vulnerability, which arises when the system fails to adequately authenticate users. This deficiency could enable an attacker to escalate privileges and obtain sensitive information, risking the integrity and confidentiality o...

A flaw in the Dokan WordPress plugin prior to version 5.3.3 allows vendors to manipulate payment reconciliation processes. The plugin does not properly match the credited amounts in a vendor's reverse-withdrawal ledger to the actual payments received for orders. This oversight enables vendors to ...

The Security For WooCommerce plugin for WordPress, versions from 1.0.10 to 1.0.16, is susceptible to a serious vulnerability that allows unauthenticated users to bypass capability checks when creating new user accounts. This flaw permits attackers to designate roles for the newly created accounts...

An attacker capable of manipulating HTTP traffic on Debian and Ubuntu systems can exploit vulnerabilities within the APT client. By improperly utilizing hard links and necessitating the client to follow redirects, attackers can coerce the installation of unverified packages, which could allow the...

The WP PageNavi Style Plugin for WordPress, prior to version 1.4, is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This vulnerability arises because the plugin fails to properly sanitize and escape certain settings. An attacker could exploit this flaw to manipulate a logged-in adminis...

The CatFolders plugin for WordPress, prior to version 2.5.7, suffers from an authorization bypass vulnerability. This flaw allows users with minimal privileges, such as subscribers, to manipulate media folder settings. Specifically, it enables them to reset the ownership of any media folder and b...

The CatFolders WordPress plugin versions prior to 2.5.7 contains a vulnerability due to improper sanitization and escaping of user-controlled parameters in SQL queries. This flaw allows authenticated users with upload permissions (Authors and above) to manipulate SQL queries, potentially leading ...

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin prior to version 5.3.3 is susceptible to an authorization issue that compromises order integrity. Attackers without authentication can exploit this flaw to access sensitive customer and order details. They can also manipula...

The Dokan plugin for WooCommerce, prior to version 5.3.3, contains a vulnerability that allows unauthenticated attackers to manipulate the sender address in emails sent through the store's contact form. Instead of using a trusted site-owned sender address, the plugin directly includes the submitt...

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution for WordPress contains a significant authorization flaw that permits an unauthorized subsite administrator on a WordPress Multisite network to grant marketplace seller status to users across different subsites. This vulnerability ...

The Car Dealer plugin for WordPress, up to version 4.73, fails to implement adequate restrictions on its unauthenticated AJAX actions. This allows unauthorized users to access sensitive information from any post, including private, draft, pending, future, or trashed content. By merely supplying t...

The IVPAY Payments WordPress plugin before version 1.0.8 is susceptible to SQL injection due to inadequate sanitization of inputs in the payment callback. This flaw allows unauthenticated attackers to exploit the vulnerability by supplying an empty API key—which the plugin mistakenly accepts as v...

The Cloud Blocks plugin for WordPress, up to version 1.1.8, contains a significant security flaw that allows unauthenticated users to exploit the plugin's functionality. By failing to implement necessary authorization checks and proper sanitization when storing block asset URLs, malicious users c...

The Easy Social Icons plugin for WordPress, prior to version 4.0.3, has a vulnerability that allows users with Author permissions and above to upload malicious SVG files. This issue arises because the plugin does not properly sanitize SVG files, which leads to the potential injection of XSS paylo...

The Essential Real Estate plugin for WordPress prior to version 5.3.5 contains an access control vulnerability that permits low-privileged authenticated users to access and read invoices belonging to other users. The flaw arises from the plugin's failure to validate user ownership of an invoice d...

The EWWW Image Optimizer plugin for WordPress, prior to version 8.9.1, suffers from a serious flaw that enables authenticated attackers with author-level permissions or higher to inject arbitrary web scripts. This vulnerability arises from inadequate sanitization and restriction of user-supplied ...

The Essential Real Estate plugin for WordPress, before version 5.3.5, lacks necessary checks for publication status and user authorization in two AJAX functionalities. This oversight permits unauthenticated users to access and download images linked to property listings that have not yet been pub...

The Essential Real Estate plugin for WordPress contains a vulnerability that permits unauthorized users to activate paid listing packages without the necessary payment. This occurs due to insufficient validation of free activation requests in AJAX actions. As a result, a self-registered user can ...

The Easy Social Icons plugin for WordPress, prior to version 4.0.3, fails to properly sanitize and escape certain settings before rendering them on front-end pages. This oversight enables high-privilege users, like Administrators, to exploit the vulnerability for Stored Cross-Site Scripting attac...

The YITH WooCommerce Gift Cards plugin for WordPress prior to version 4.38.1 lacks proper locking mechanisms for gift card balance updates during checkout. This vulnerability enables an attacker possessing a gift card code to exploit it by initiating multiple concurrent checkouts, potentially exc...

The Essential Real Estate WordPress plugin, when running versions prior to 5.3.5, exhibits a security weakness that enables unauthenticated users to send emails to any address of their choice. This vulnerability arises from inadequate restrictions on the recipient field in its contact email funct...

The Essential Real Estate plugin for WordPress, prior to version 5.3.5, is susceptible to an authorization bypass in one of its AJAX functionalities. This flaw enables attackers to access and retrieve unpublished property details, including sensitive information such as the listing agent's privat...

The Subscriptions for WooCommerce plugin for WordPress prior to version 2.1.1 fails to restrict access to membership content effectively. This oversight permits unauthenticated users to view restricted posts and pages when accessed through certain routes, undermining content protection and leadin...

An input validation error in the WP Event Manager plugin prior to version 3.4.2 allows unauthenticated users to exploit the front-end event submission flow. This vulnerability enables attackers to read and modify the content of unpublished posts and pages by supplying arbitrary post identifiers. ...

The Community Events WordPress plugin prior to version 1.6.0 contains a vulnerability due to the absence of proper authorization and nonce checks in one of its AJAX actions. This oversight enables unauthorized users to access and retrieve sensitive details of event submissions that are pending mo...

The Tutor LMS WordPress plugin, prior to version 4.2.0, exhibits a vulnerability where the correct answers to quiz questions are disclosed to students. This occurs regardless of the user settings that control answer visibility, allowing any enrolled student access to the correct responses before ...

The FV Flowplayer Video Player plugin for WordPress prior to version 7.5.56.7212 is susceptible to Server-Side Request Forgery (SSRF) due to insufficient URL validation for user-supplied inputs. This flaw enables users with Contributor-level access or higher to craft requests that fetch internal ...

The FV Flowplayer Video Player plugin for WordPress has a vulnerability that allows users with Contributor roles and above to insert arbitrary web scripts. This occurs due to the plugin's failure to properly sanitize and escape user-supplied input before displaying it on a page. Consequently, whe...

The FV Flowplayer Video Player plugin for WordPress is vulnerable due to a lack of proper authorization and CSRF checks in its cloud storage media browser handlers. This issue allows authenticated users with minimal permissions, such as Subscribers, to disclose sensitive configurations and file l...

The All In One Login plugin for WordPress prior to version 2.5.0 lacks proper restrictions on the number of login attempts using its passwordless email login feature. This vulnerability enables unauthenticated attackers to exploit the system by making multiple attempts against the short numeric c...

The WP Event Manager plugin for WordPress prior to version 3.4.2 exposes a significant security flaw where improper validation of user-supplied post identifiers allows users with Subscriber access or higher to reassign post authorship. This vulnerability can lead to unauthorized content takeover,...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in OpenHands prior to version 1.25.0 exposes a missing authentication issue within the Landing Page component. This flaw can be exploited by an attacker from the local network, potentially leading to unauthorized access. It is crucial for users to upgrade to version 1.25.0 where t...