Publicly Disclosed
PoC Exploits

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

The Payable Payment Gateway for WooCommerce prior to version 1.3.1 lacks proper verification of incoming payment notifications. This flaw enables unauthenticated attackers to alter the payment status of any order within a WooCommerce store, irrespective of the payment method used. Consequently, t...

The Quick Event Manager plugin for WordPress, prior to version 9.19, has a security flaw that permits unauthenticated users to access and read the contents of draft and private posts. This vulnerability arises from inadequate verification of the status or type of the requested post when details a...

The Mapster WP Maps plugin for WordPress, versions prior to 2.0.6, features a significant vulnerability that allows unauthorized users to manipulate post data via a REST API endpoint. This lack of authorization checks enables attackers to overwrite the titles of existing posts, create new publish...

The All-in-One Video Gallery plugin for WordPress fails to validate the publication status of videos before displaying them on the player page. This oversight allows unauthenticated users to access sensitive video information, including titles and source URLs of private, draft, pending, scheduled...

The Security Optimizer plugin for WordPress is susceptible to a serious flaw wherein it fails to limit the number of two-factor authentication codes that can be submitted during a pending login. This weakness enables an attacker, who has knowledge of a user's password, to perform a brute-force at...

The Firelight Lightbox plugin for WordPress prior to version 2.3.24 exhibits a vulnerability where it inadequately escapes image attribute values before rendering them in the browser. This flaw could enable users with contributor-level access and above to inject malicious web scripts. These scrip...

The Bulk Media Register plugin for WordPress lacks proper validation of user-supplied paths, allowing users with Author permissions to manipulate file movements. This can lead to unauthorized access to sensitive files by enabling users to move or rename files outside the designated WordPress dire...

The Premium Packages plugin for WordPress prior to version 7.2.2 is susceptible to a serious vulnerability that allows unauthenticated users to overwrite the prices of items stored in their shopping carts. This flaw enables attackers to generate orders with arbitrary totals, potentially leading t...

The BuddyForms plugin for WordPress, prior to version 2.10.1, contains a flaw that fails to adequately verify the ownership of guest-uploaded attachments. This vulnerability allows unauthenticated users to delete media files uploaded by other visitors, potentially leading to unauthorized loss of ...

The Essential Addons for Elementor plugin for WordPress prior to version 6.8.8 fails to enforce proper restrictions on user roles during account creation. Authenticated users with Author-level access or higher can exploit this vulnerability, enabling them to grant elevated roles like Editor to ne...

The Payment Forms for Paystack WordPress plugin prior to version 4.0.6 contains an access control flaw that enables users with the Contributor role and higher to access sensitive configuration pages. This oversight permits unauthorized visibility of critical payment gateway API credentials, inclu...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A security flaw exists in the Next.js framework that allows an attacker to bypass authorization checks if such checks are implemented in middleware. This vulnerability arises in versions prior to 14.2.25 and 15.2.3. To mitigate risk, it is recommended to restrict incoming requests that include th...

The Searchor application, developed by ArjunSharda, contains a flaw in its command-line interface input processing. Prior to version 2.4.2, the application utilizes the 'eval' function on user-provided input without sufficient validation. This oversight can lead to arbitrary code execution, enabl...

The Laravel web application framework has a vulnerability in the TokenGuard, specifically when configured as a standard token-based API guard. Prior to versions 12.68.0 and 13.29.0, this flaw allows an attacker to bypass authentication by submitting a crafted non-string credential. Under certain ...

An authorization bypass vulnerability exists in the local management cluster shell feature of SUSE Rancher Manager. The security check intended to safeguard this feature was not comprehensively implemented across all API routes, allowing authenticated users to potentially execute unauthorized com...

A vulnerability in Google Chrome for Mac allows a remote attacker, who has compromised the renderer process, to execute arbitrary code outside the sandbox. This is accomplished through a specifically crafted HTML page, presenting significant security risks for users. The issue affects versions pr...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

Versions of AiSOC prior to 12.0.0 are susceptible to a command injection flaw in the actions service. This vulnerability arises due to the improper handling of action parameters in the 'crowdstrike_rtr.py' and 'endpoint.py' scripts. Authenticated users can exploit this issue by injecting unescape...

Rapyd Admin versions from 9.0.0 to 9.19.0 are susceptible to a hard-coded credentials vulnerability, allowing remote attackers to gain super-admin access. This flaw is due to an account created by the AuthSeeder during installation, which uses default credentials that are replicated in every envi...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A cross-site scripting (XSS) vulnerability exists in the query log handling of Neo4j Enterprise and Community Editions prior to version 2026.01. Due to insufficient escaping of Unicode characters, users may inadvertently expose themselves to XSS attacks when logs are opened in tools that render t...

The WooCommerce PDF Invoices & Packing Slips plugin, versions 5.16.2 through 5.16.4, fails to properly escape user-supplied order fields such as billing and shipping addresses, as well as customer order notes. This oversight allows unauthenticated users to inject malicious scripts when placing gu...

The pac4j-jwt library's JwtAuthenticator prior to versions 4.5.9, 5.7.9, and 6.3.3 is susceptible to an authentication bypass that could allow remote adversaries to create forged authentication tokens. By leveraging the server's RSA public key, attackers are able to craft a JWE-wrapped PlainJWT w...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

WIT SynApps Runtime versions up to 1.4.11 are susceptible to a browser-mediated cross-origin request forgery issue. This vulnerability enables attackers to specify arbitrary target addresses during the controller onboarding process. As a result, victims' browsers can unknowingly send discovery re...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

An out-of-bounds write vulnerability has been identified in various Apple operating systems, potentially allowing an application to execute code beyond its allocated memory space. This could lead to unexpected behaviors, including system instability and termination of the service. Apple has addre...

A vulnerability in the Cak File Management System has been identified that allows an attacker to exploit the move_uploaded_file function in admin/add_logs.php. By manipulating the File argument, unauthorized users can upload files without restriction, potentially leading to harmful outcomes, incl...

A SQL injection vulnerability exists in the Cak File Management System, specifically within the admin/save_student.php file's mysqli_query function. This flaw allows attackers to manipulate input parameters such as date, department, subject, forwarded_to, action_taken_by, section, and password to...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

Netsweeper versions before 4.0.11 and from 4.1.0 to 4.1.5 are susceptible to reflected cross-site scripting vulnerabilities in 'webadmin/reporter/view_server_log.php'. This flaw allows remote attackers to inject malicious JavaScript code through the 'log request' parameter, which is then reflecte...

Netsweeper versions before 4.0.11 and from 4.1.0 to 4.1.5 are susceptible to reflected cross-site scripting vulnerabilities in 'webadmin/reporter/view_server_log.php'. This flaw allows remote attackers to inject malicious JavaScript code through the 'log request' parameter, which is then reflecte...

DedeCMS versions prior to 5.7 are susceptible to a file inclusion vulnerability in the plus/carbuyaction.php file. This flaw allows remote attackers, without authentication, to manipulate the include path by altering the uninitialized 'code' parameter passed to the require_once function. By using...

DedeCMS versions prior to 5.7 are susceptible to a file inclusion vulnerability in the plus/carbuyaction.php file. This flaw allows remote attackers, without authentication, to manipulate the include path by altering the uninitialized 'code' parameter passed to the require_once function. By using...

The Firelight Lightbox WordPress plugin, prior to version 2.3.23, is vulnerable to Stored Cross-Site Scripting (XSS) due to inadequate URL escaping. This vulnerability allows users with as little as Contributor privileges to craft malicious links that, when clicked by others, can execute harmful ...

The BuddyForms plugin for WordPress prior to version 2.10.3 is vulnerable to unauthorized access, allowing unauthenticated users to download configuration settings of any form. This includes sensitive information such as notification recipient email addresses and reCAPTCHA secret keys that are no...

The BuddyForms WordPress plugin prior to version 2.10.1 has a significant flaw wherein it fails to ensure that users editing an existing entry are the original authors of the respective post. This oversight permits users with edit permissions, even those at the Subscriber level, to alter the titl...

The Joinchat WordPress plugin prior to version 6.4.2 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper escaping of button block messages. This flaw allows users with Author roles or higher to inject malicious scripts into the frontend output, potentially compromising the security...

The Fraud Prevention For WooCommerce and EDD plugin prior to version 2.3.6 allows users with a Subscriber role or higher to add legitimate customers to the store's fraud blacklist without appropriate permissions. This oversight could lead to unauthorized manipulation of customer orders, potential...

The User Frontend plugin for WordPress prior to version 4.3.14 fails to properly sanitize and escape user-supplied values, allowing reflected cross-site scripting (XSS) attacks via publicly accessible AJAX responses. This issue primarily affects logged-out visitors, as an anonymous nonce only val...

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress prior to version 8.8 is vulnerable due to insufficient sanitization of tracking data from public visitor requests. This flaw allows unauthenticated attackers to inject malicious scripts, which can execute in the context of a logge...

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress prior to version 8.8 contains a security flaw that fails to properly sanitize and escape a user-supplied parameter within an SQL statement. This vulnerability can be exploited by users with elevated permissions, such as administra...

The Enable Media Replace plugin for WordPress prior to version 4.2.3 contains a vulnerability that allows unauthenticated users to exploit the deserialization of stored metadata. This flaw occurs during the media replacement process, where the plugin fails to properly restrict allowed classes. As...