Publicly Disclosed
PoC Exploits

The BuddyForms plugin for WordPress prior to version 2.10.3 is vulnerable to unauthorized access, allowing unauthenticated users to download configuration settings of any form. This includes sensitive information such as notification recipient email addresses and reCAPTCHA secret keys that are no...

The Firelight Lightbox WordPress plugin, prior to version 2.3.23, is vulnerable to Stored Cross-Site Scripting (XSS) due to inadequate URL escaping. This vulnerability allows users with as little as Contributor privileges to craft malicious links that, when clicked by others, can execute harmful ...

The BuddyForms WordPress plugin prior to version 2.10.1 has a significant flaw wherein it fails to ensure that users editing an existing entry are the original authors of the respective post. This oversight permits users with edit permissions, even those at the Subscriber level, to alter the titl...

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress prior to version 8.8 is vulnerable due to insufficient sanitization of tracking data from public visitor requests. This flaw allows unauthenticated attackers to inject malicious scripts, which can execute in the context of a logge...

The Joinchat WordPress plugin prior to version 6.4.2 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper escaping of button block messages. This flaw allows users with Author roles or higher to inject malicious scripts into the frontend output, potentially compromising the security...

The Fraud Prevention For WooCommerce and EDD plugin prior to version 2.3.6 allows users with a Subscriber role or higher to add legitimate customers to the store's fraud blacklist without appropriate permissions. This oversight could lead to unauthorized manipulation of customer orders, potential...

The User Frontend plugin for WordPress prior to version 4.3.14 fails to properly sanitize and escape user-supplied values, allowing reflected cross-site scripting (XSS) attacks via publicly accessible AJAX responses. This issue primarily affects logged-out visitors, as an anonymous nonce only val...

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress prior to version 8.8 contains a security flaw that fails to properly sanitize and escape a user-supplied parameter within an SQL statement. This vulnerability can be exploited by users with elevated permissions, such as administra...

The Enable Media Replace plugin for WordPress prior to version 4.2.3 contains a vulnerability that allows unauthenticated users to exploit the deserialization of stored metadata. This flaw occurs during the media replacement process, where the plugin fails to properly restrict allowed classes. As...

The Security Plugin, Firewall & Malware Scanner for WordPress prior to version 2.191 presents a significant security issue wherein the authentication mechanism fails to verify a user's password before validating a two-factor authentication code. As a result, an attacker possessing the current aut...

The Security Plugin, Firewall & Malware Scanner with Auto Removal for WordPress prior to version 2.191 has a significant flaw that allows non-super-admin users, including subsite administrators on multisite installations, to access sensitive files. This includes the main configuration file which ...

A vulnerability in Apache Superset versions up to and including 2.0.1 allows session validation attacks when the default SECRET_KEY is used. This configuration flaw enables attackers to authenticate and gain unauthorized access to resources. Superset installations must adhere to security best pra...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

OpenIdentityPlatform's OpenAM, an access management solution, is susceptible to a pre-authentication Remote Code Execution vulnerability due to unsafe Java deserialization. This issue arises from the handling of the jato.clientSession HTTP parameter, allowing unauthenticated attackers to execute ...

The vulnerability affects Mozilla Firefox and Thunderbird, where improper handling of onreadystatechange events during page reloading can be exploited by remote attackers. This flaw may lead to application crashes or allow execution of arbitrary code by triggering attempts to execute data from un...

EDK2 BIOS by TianoCore exhibits a serious vulnerability that enables malicious users to perform an out-of-bounds write due to improper buffer size calculations. This could be exploited remotely, leading to arbitrary code execution on affected systems. The implications of such exploitation extend ...

A flaw in the JCE editor extension for Joomla permits unauthorized users to create new editor profiles. This malicious capability exposes the site to risks, including the ability to upload PHP code and execute it, potentially leading to a full compromise of the website security. Site administrato...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

This vulnerability allows remote attackers to perform a stored cross-site scripting (XSS) attack by exploiting unauthenticated updates to public UI settings in the Rancher interface. It affects multiple versions of SUSE Rancher, enabling potential unauthorized access and manipulation of sensitive...

The com.epson.InstallNavi.helper tool, part of the EPSON printer driver installer, is susceptible to a local privilege escalation issue due to multiple implementation flaws. The tool inadequately authenticates clients via the XPC protocol, failing to uphold the authorization model in macOS. This ...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The Linux kernel has a vulnerability in the SMB client, which can cause a heap overflow during the rewriting of discretionary access control lists (DACLs). This occurs when the size of SID (Security Identifier) replacement exceeds the allocated buffer size, particularly when transitioning from sh...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A path traversal vulnerability exists in Fortinet's FortiMail products, affecting multiple versions. This issue allows unauthenticated attackers to craft HTTP or HTTPS requests that can lead to unauthorized file writing on the underlying system. Implementing proper access controls and promptly ap...

A vulnerability in GitLab's CI/CD configuration could permit an unauthenticated attacker to execute arbitrary code on the server. This exploit arises from insufficient validation of a specially crafted regular expression. Affected versions include GitLab CE/EE 19.2 prior to 19.2.8, 19.3 prior to ...

The CoAP component of Apache Camel contains a vulnerability that allows the generation of error messages revealing sensitive information. When a response cannot be properly built due to issues such as type conversion failures, the system returns an error response containing internal details. This...

An issue has been identified in the Apache Camel A2A component that presents a Server-Side Request Forgery (SSRF) vulnerability. This flaw arises from discrepancies in how a webhook URL's host is validated. Specifically, hosts represented as IP literals can be matched against an outdated prefix l...

A vulnerability exists in Microsoft Windows Remote Desktop Protocol (RDP) that enables unauthorized attackers to execute arbitrary code over a network. The issue arises from the usage of uninitialized resources, which can lead to compromised systems if exploited. Proper patching and security meas...

The Apache Camel OAuth component experiences a vulnerability due to improper caching of OAuth 2.0 bearer tokens. The OAuthClientCredentialsTokenResolver stores tokens in a static cache, which is accessed by multiple instances and components. This design flaw allows different OAuth profiles, when ...

An improper limitation of a pathname in Apache Camel's Docling component allows arbitrary file writing in directories accessible to the Camel process. Specifically, when the CamelDoclingOutputFilePath header is set, it does not normalize the path, which means attackers can exploit this to create ...

A Path Traversal vulnerability exists in the Apache Camel Docling component, allowing external entities to influence command-line arguments. This flaw arises because the method intended to sanitize path-like arguments only checks for relative traversal, leaving absolute paths unverified. As a res...

The Apache Camel Keycloak component is vulnerable to insufficient session expiration due to the way token introspection results are cached. When the introspection feature is enabled, the system incorrectly accepts expired tokens, as it only checks if a token is active without comparing the expira...

An Expression Language Injection vulnerability in the AWS2-S3 component of Apache Camel allows unauthorized manipulation of expressions used in messages. The flaw exists because the producer of the AWS2-S3 component sometimes evaluates headers containing dynamic keys improperly, which can lead to...

The Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb is vulnerable due to an unprotected API that allows remote users to manipulate the bulb's functionality without any authentication. This API flaw enables unauthorized individuals to turn the bulb on or off, alter its brightness, or c...

A vulnerability exists in the Apache Camel Saxon component where improper handling of XML External Entities enables an attacker to exploit the system. The default Saxon configuration lacks restrictions, allowing external DOCTYPE declarations and entities to be resolved upon parsing. This flaw may...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

EDK2 BIOS by TianoCore exhibits a serious vulnerability that enables malicious users to perform an out-of-bounds write due to improper buffer size calculations. This could be exploited remotely, leading to arbitrary code execution on affected systems. The implications of such exploitation extend ...

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default config...

The Contact Form by Supsystic plugin for WordPress, prior to version 1.11.1, is susceptible to email header injection due to improper handling of CR/LF characters in user submissions. This flaw allows unauthenticated attackers to inject arbitrary email headers into outgoing notification emails. S...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

The Zip Library for Rust, specifically version 9.0.4, has a vulnerability where it improperly reconciles filenames in Central Directory File Header with those in Local File Header during file extraction. This can lead to a scenario where an attacker crafts a ZIP archive that appears harmless base...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...