Publicly Disclosed
PoC Exploits

A cross-site scripting (XSS) vulnerability exists in the query log handling of Neo4j Enterprise and Community Editions prior to version 2026.01. Due to insufficient escaping of Unicode characters, users may inadvertently expose themselves to XSS attacks when logs are opened in tools that render t...

The pac4j-jwt library's JwtAuthenticator prior to versions 4.5.9, 5.7.9, and 6.3.3 is susceptible to an authentication bypass that could allow remote adversaries to create forged authentication tokens. By leveraging the server's RSA public key, attackers are able to craft a JWE-wrapped PlainJWT w...

A buffer overflow issue in the Brotli decoder (c/dec/decode.c) affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows remote unauthenticated attackers to manipulate adjacent decoder state memory. Consequences include the possibility of disclosing sensitive memory co...

WIT SynApps Runtime before version 1.4.11 is vulnerable to pre-authentication reflected cross-site scripting attacks. This flaw allows unauthenticated users to inject and run arbitrary JavaScript by manipulating the LINK query parameter in requests to the /System/Session-1 endpoint. Successful ex...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

An out-of-bounds write vulnerability has been identified in various Apple operating systems, potentially allowing an application to execute code beyond its allocated memory space. This could lead to unexpected behaviors, including system instability and termination of the service. Apple has addre...

A vulnerability in the Cak File Management System has been identified that allows an attacker to exploit the move_uploaded_file function in admin/add_logs.php. By manipulating the File argument, unauthorized users can upload files without restriction, potentially leading to harmful outcomes, incl...

A SQL injection vulnerability exists in the Cak File Management System, specifically within the admin/save_student.php file's mysqli_query function. This flaw allows attackers to manipulate input parameters such as date, department, subject, forwarded_to, action_taken_by, section, and password to...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

Netsweeper versions before 4.0.11 and from 4.1.0 to 4.1.5 are susceptible to reflected cross-site scripting vulnerabilities in 'webadmin/reporter/view_server_log.php'. This flaw allows remote attackers to inject malicious JavaScript code through the 'log request' parameter, which is then reflecte...

Netsweeper versions before 4.0.11 and from 4.1.0 to 4.1.5 are susceptible to reflected cross-site scripting vulnerabilities in 'webadmin/reporter/view_server_log.php'. This flaw allows remote attackers to inject malicious JavaScript code through the 'log request' parameter, which is then reflecte...

DedeCMS versions prior to 5.7 are susceptible to a file inclusion vulnerability in the plus/carbuyaction.php file. This flaw allows remote attackers, without authentication, to manipulate the include path by altering the uninitialized 'code' parameter passed to the require_once function. By using...

DedeCMS versions prior to 5.7 are susceptible to a file inclusion vulnerability in the plus/carbuyaction.php file. This flaw allows remote attackers, without authentication, to manipulate the include path by altering the uninitialized 'code' parameter passed to the require_once function. By using...

The Firelight Lightbox WordPress plugin, prior to version 2.3.23, is vulnerable to Stored Cross-Site Scripting (XSS) due to inadequate URL escaping. This vulnerability allows users with as little as Contributor privileges to craft malicious links that, when clicked by others, can execute harmful ...

The BuddyForms plugin for WordPress prior to version 2.10.3 is vulnerable to unauthorized access, allowing unauthenticated users to download configuration settings of any form. This includes sensitive information such as notification recipient email addresses and reCAPTCHA secret keys that are no...

The BuddyForms WordPress plugin prior to version 2.10.1 has a significant flaw wherein it fails to ensure that users editing an existing entry are the original authors of the respective post. This oversight permits users with edit permissions, even those at the Subscriber level, to alter the titl...

The User Frontend plugin for WordPress prior to version 4.3.14 fails to properly sanitize and escape user-supplied values, allowing reflected cross-site scripting (XSS) attacks via publicly accessible AJAX responses. This issue primarily affects logged-out visitors, as an anonymous nonce only val...

The Fraud Prevention For WooCommerce and EDD plugin prior to version 2.3.6 allows users with a Subscriber role or higher to add legitimate customers to the store's fraud blacklist without appropriate permissions. This oversight could lead to unauthorized manipulation of customer orders, potential...

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress prior to version 8.8 contains a security flaw that fails to properly sanitize and escape a user-supplied parameter within an SQL statement. This vulnerability can be exploited by users with elevated permissions, such as administra...

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress prior to version 8.8 is vulnerable due to insufficient sanitization of tracking data from public visitor requests. This flaw allows unauthenticated attackers to inject malicious scripts, which can execute in the context of a logge...

The Joinchat WordPress plugin prior to version 6.4.2 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper escaping of button block messages. This flaw allows users with Author roles or higher to inject malicious scripts into the frontend output, potentially compromising the security...

The Enable Media Replace plugin for WordPress prior to version 4.2.3 contains a vulnerability that allows unauthenticated users to exploit the deserialization of stored metadata. This flaw occurs during the media replacement process, where the plugin fails to properly restrict allowed classes. As...

The Security Plugin, Firewall & Malware Scanner for WordPress prior to version 2.191 presents a significant security issue wherein the authentication mechanism fails to verify a user's password before validating a two-factor authentication code. As a result, an attacker possessing the current aut...

The Security Plugin, Firewall & Malware Scanner with Auto Removal for WordPress prior to version 2.191 has a significant flaw that allows non-super-admin users, including subsite administrators on multisite installations, to access sensitive files. This includes the main configuration file which ...

A vulnerability in Apache Superset versions up to and including 2.0.1 allows session validation attacks when the default SECRET_KEY is used. This configuration flaw enables attackers to authenticate and gain unauthorized access to resources. Superset installations must adhere to security best pra...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

OpenIdentityPlatform's OpenAM, an access management solution, is susceptible to a pre-authentication Remote Code Execution vulnerability due to unsafe Java deserialization. This issue arises from the handling of the jato.clientSession HTTP parameter, allowing unauthenticated attackers to execute ...

The vulnerability affects Mozilla Firefox and Thunderbird, where improper handling of onreadystatechange events during page reloading can be exploited by remote attackers. This flaw may lead to application crashes or allow execution of arbitrary code by triggering attempts to execute data from un...

EDK2 BIOS by TianoCore exhibits a serious vulnerability that enables malicious users to perform an out-of-bounds write due to improper buffer size calculations. This could be exploited remotely, leading to arbitrary code execution on affected systems. The implications of such exploitation extend ...

A flaw in the JCE editor extension for Joomla permits unauthorized users to create new editor profiles. This malicious capability exposes the site to risks, including the ability to upload PHP code and execute it, potentially leading to a full compromise of the website security. Site administrato...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

This vulnerability allows remote attackers to perform a stored cross-site scripting (XSS) attack by exploiting unauthenticated updates to public UI settings in the Rancher interface. It affects multiple versions of SUSE Rancher, enabling potential unauthorized access and manipulation of sensitive...

The com.epson.InstallNavi.helper tool, part of the EPSON printer driver installer, is susceptible to a local privilege escalation issue due to multiple implementation flaws. The tool inadequately authenticates clients via the XPC protocol, failing to uphold the authorization model in macOS. This ...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The Linux kernel has a vulnerability in the SMB client, which can cause a heap overflow during the rewriting of discretionary access control lists (DACLs). This occurs when the size of SID (Security Identifier) replacement exceeds the allocated buffer size, particularly when transitioning from sh...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A path traversal vulnerability exists in Fortinet's FortiMail products, affecting multiple versions. This issue allows unauthenticated attackers to craft HTTP or HTTPS requests that can lead to unauthorized file writing on the underlying system. Implementing proper access controls and promptly ap...

A vulnerability in GitLab's CI/CD configuration could permit an unauthenticated attacker to execute arbitrary code on the server. This exploit arises from insufficient validation of a specially crafted regular expression. Affected versions include GitLab CE/EE 19.2 prior to 19.2.8, 19.3 prior to ...

The CoAP component of Apache Camel contains a vulnerability that allows the generation of error messages revealing sensitive information. When a response cannot be properly built due to issues such as type conversion failures, the system returns an error response containing internal details. This...

An issue has been identified in the Apache Camel A2A component that presents a Server-Side Request Forgery (SSRF) vulnerability. This flaw arises from discrepancies in how a webhook URL's host is validated. Specifically, hosts represented as IP literals can be matched against an outdated prefix l...

A vulnerability exists in Microsoft Windows Remote Desktop Protocol (RDP) that enables unauthorized attackers to execute arbitrary code over a network. The issue arises from the usage of uninitialized resources, which can lead to compromised systems if exploited. Proper patching and security meas...

The Apache Camel OAuth component experiences a vulnerability due to improper caching of OAuth 2.0 bearer tokens. The OAuthClientCredentialsTokenResolver stores tokens in a static cache, which is accessed by multiple instances and components. This design flaw allows different OAuth profiles, when ...

An improper limitation of a pathname in Apache Camel's Docling component allows arbitrary file writing in directories accessible to the Camel process. Specifically, when the CamelDoclingOutputFilePath header is set, it does not normalize the path, which means attackers can exploit this to create ...

A Path Traversal vulnerability exists in the Apache Camel Docling component, allowing external entities to influence command-line arguments. This flaw arises because the method intended to sanitize path-like arguments only checks for relative traversal, leaving absolute paths unverified. As a res...

The Apache Camel Keycloak component is vulnerable to insufficient session expiration due to the way token introspection results are cached. When the introspection feature is enabled, the system incorrectly accepts expired tokens, as it only checks if a token is active without comparing the expira...

An Expression Language Injection vulnerability in the AWS2-S3 component of Apache Camel allows unauthorized manipulation of expressions used in messages. The flaw exists because the producer of the AWS2-S3 component sometimes evaluates headers containing dynamic keys improperly, which can lead to...