Publicly Disclosed
PoC Exploits

A vulnerability exists in PackageKit, specifically in versions 1.0.2 to 1.3.4, allowing unprivileged users to exploit a time-of-check time-of-use (TOCTOU) race condition. This flaw enables attackers to manipulate transaction flags, facilitating the installation of arbitrary RPM packages as root w...

Marimo, a reactive Python notebook, exhibits a significant security vulnerability prior to version 0.23.0. The terminal WebSocket endpoint (/terminal/ws) allows unauthenticated access, enabling attackers to gain a complete pseudo-terminal shell and execute arbitrary commands on the host system. U...

The Huatian Dynamic OA8000 collaborative office system is exposed to an unauthenticated path traversal vulnerability through the /OAapp/jsp/trace/ntkodownload.jsp endpoint. The vulnerability arises from the usage of the filename request parameter, which allows attackers to manipulate the file pat...

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a...

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

The Integra32 Security Management System version 5.1.11 R5.0 is susceptible to an unauthenticated deserialization flaw within its deprecated .NET Remoting service. This vulnerability is exposed through TCP port 2001 via the AxcvcLt.dll library. Attackers can exploit this by sending specially craf...

The SAP NetWeaver Application Server ABAP is susceptible to a memory corruption vulnerability due to logical errors in the DIAG protocol parsing. This flaw allows an unauthenticated attacker to manipulate the system, potentially leading to the disclosure of sensitive information or a system crash...

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

A vulnerability exists in Quay where the robot account listing function improperly handles user-defined namespace names. By crafting a namespace containing wildcard characters, an attacker can exploit this flaw to match and retrieve sensitive information, such as the robot accounts and their decr...

A security flaw in RubyGem Safemode allows authenticated attackers to bypass method call mediations when using compound assignment expressions in sandboxed code. This vulnerability can result in the execution of arbitrary no-argument methods on objects exposed to the template renderer. As a conse...

A vulnerability exists in Git that affects how configuration values are read and written, particularly regarding trailing carriage returns. When a submodule path includes a trailing carriage return, it is altered when read back, which can cause the submodule to be checked out to an incorrect loca...

A vulnerability exists in Git that affects how configuration values are read and written, particularly regarding trailing carriage returns. When a submodule path includes a trailing carriage return, it is altered when read back, which can cause the submodule to be checked out to an incorrect loca...

OpsTree BuildPiper prior to version 2.7.0 is susceptible to a privilege escalation vulnerability. This flaw allows project users to submit unrestricted manifests via the Additional Manifest feature, which can be exploited to gain Kubernetes cluster-admin privileges. By deploying a ClusterRoleBind...

OpsTree BuildPiper versions prior to 2.7.0 are susceptible to a path traversal vulnerability, enabling authenticated users with build configuration permissions to access sensitive files on the build worker. By providing unvalidated inputs for dockerfile_path and build context parameters, attacker...

OpsTree BuildPiper versions earlier than 2.7.0 are susceptible to a path traversal vulnerability. This flaw enables authenticated users to manipulate file paths using traversal sequences, such as ../../../../etc/passwd, thereby gaining unauthorized access to arbitrary files. Consequently, sensiti...

OpsTree BuildPiper versions prior to 2.7.0 are susceptible to a broken access control vulnerability, allowing authenticated users to gain unauthorized access to Git repositories that should be restricted to other projects. Through the GET /api/v1/git_repo/?all=true endpoint, attackers can enumera...

OpsTree BuildPiper versions prior to 2.7.0 have a vulnerability that permits authenticated users to bypass authorization controls, enabling them to create environments on Kubernetes clusters that are not assigned to their project. By manipulating the 'cluster_id' and 'namespaces' values in reques...

The OpsTree BuildPiper product prior to version 2.7.0 is vulnerable due to the absence of rate limiting on the OTP verification process during password resets. This flaw allows attackers to exploit the system by initiating a password reset and submitting unchecked guesses at the 6-digit OTP, whic...

OpsTree BuildPiper prior to version 2.7.0 is vulnerable to an authorization bypass that grants authenticated users the ability to modify the environment configurations of other applications. By manipulating the project_env_id parameter, an attacker can link a foreign project's environment to thei...

OpsTree BuildPiper prior to version 2.7.0 features an improper authorization vulnerability that permits authenticated deploy users to create arbitrary hostPath volumes in Kubernetes. This oversight allows attackers to set the hostPath to '/' in the Define HostPath Volume configuration, effectivel...

The OpsTree BuildPiper software prior to version 2.7.0 contains a vulnerability that permits authenticated users to bypass project separation controls. By utilizing an incorrect project_env_id, users can link pipeline stages to environments belonging to other projects. This exploitation allows fo...

GPAC versions up to 26.07.0 contain a vulnerability that allows attackers to exploit NULL pointer dereference in the MPEG-4 Form spatial-constraint handlers. This occurs when an attacker provides a crafted XMT scene with Form constraints that reference a nonexistent group, which can lead to proce...

GPAC versions up to 26.07.0 exhibit a use-after-free vulnerability due to improper handling of scene prototypes. Specifically, the function gf_sg_proto_del() in src/scenegraph/vrml_proto.c fails to manage the memory correctly when gf_sg_reset() frees prototypes that are still in use by various sc...

The WP Ultimate CSV Importer plugin for WordPress, prior to version 9.2, lacks proper restriction on destination filenames and extensions during the import of remote media. This oversight allows a subsite Administrator to potentially execute arbitrary PHP code within the shared WordPress environm...

The Streamit WordPress plugin prior to version 1.3.10 is vulnerable due to a lack of authorization and nonce verification on unauthenticated AJAX routes. This oversight permits attackers to leverage attacker-supplied arguments to invoke arbitrary PHP functions, resulting in potential privilege es...

Multiple WordPress review plugins prior to version 14.3 are vulnerable to stored cross-site scripting (XSS) attacks. These vulnerabilities arise because the plugins do not properly sanitize and escape business details when rendered in review widgets. As a result, users with Editor roles or higher...

The Ahime Image Printer WordPress plugin, up to version 1.0.0, contains a critical security flaw due to improper validation of uploaded files. This vulnerability allows unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, which can lead to remote code execution on...

The Easy DragDrop File Uploader WordPress plugin, prior to version 1.1.10, is susceptible to a path traversal vulnerability. This allows unauthenticated attackers to manipulate file paths, potentially enabling them to delete critical files and directories, such as wp-config.php, from the server. ...

The WooCommerce Wishlist WordPress plugin prior to version 1.1.0 features unauthenticated AJAX actions lacking proper authorization and CSRF checks. This flaw permits an attacker to manipulate site options without any authentication, which can result in significant disruptions, such as the altera...

The Mine CloudVod plugin for WordPress prior to version 2.6.7 contains a security flaw where it fails to verify if a user is enrolled in a course or has the necessary authorization. This oversight allows unauthorized visitors to access comprehensive course curricula, including sensitive content l...

The WPCOM Member plugin prior to version 1.8.3 has a vulnerability that allows unauthorized attackers to exploit the WeChat login mechanism. Specifically, it fails to limit the number of attempts to verify login codes. This oversight permits an attacker to perform brute-force attacks on codes iss...

The WP Remote Users Sync plugin for WordPress versions before 2.2.1 contains a significant security flaw that permits unauthorized account field changes. Unsanctioned sites holding synchronization keys can create or update user profiles, resulting in the ability to assign administrator roles, alt...

The WooCommerce Vindi Pagamento plugin version 0.8.3 lacks proper authorization checks when updating an order's shipment tracking code and fails to escape that information when displayed on the order edit page. This oversight allows unauthenticated users to exploit the vulnerability, facilitating...

The Essential Real Estate WordPress plugin versions prior to 5.3.6 lacks adequate validation for the recipients of its contact email functionality. This flaw allows users with a self-registered Customer role to add any email address to a whitelist, enabling unauthorized users to send emails conta...

The Advance Guest Post plugin for WordPress lacks sufficient authorization checks when it comes to deleting media attachments. This oversight allows unauthenticated users to exploit a nonce that is publicly accessible, enabling them to permanently delete any media files from the Media Library. Th...

The Contact Form 7 plugin for WordPress prior to version 6.2.5 is susceptible to an input validation vulnerability that allows users with the Editor role or higher to manipulate form fields. This security flaw enables these users to access sensitive user data, including password hashes and two-fa...

The WP Remote Users Sync plugin for WordPress, prior to version 2.2.1, exposes a serious security flaw due to missing authorization and Cross-Site Request Forgery (CSRF) checks in its AJAX actions. This vulnerability enables any authenticated user, including those with minimal roles like subscrib...

The Advance Guest Post plugin for WordPress fails to adequately restrict file uploads, making it possible for unauthenticated users to upload arbitrary PHP files. The plugin utilizes an insecure method that leverages a nonce visible to all front-end visitors, allowing an exploit through improper ...

The AppPresser WordPress plugin prior to version 5.0.0 contains a vulnerability that allows unauthenticated users to access certain REST API endpoints. This oversight enables unauthorized visitors to retrieve sensitive information about the installed version of AppPresser, its add-ons, and variou...

The LetsRecover WordPress plugin through version 1.2.0 is vulnerable due to inadequate sanitization of user-supplied input used as a database column name in unauthenticated AJAX actions. This security flaw enables attackers to craft malicious SQL queries that can manipulate the database, potentia...

The Advance Guest Post plugin for WordPress, in versions up to 1.9, exhibits a significant vulnerability due to improper validation of file uploads. This weakness stems from a case-sensitive and incomplete check of file extensions, which unauthenticated users can easily bypass. As a result, attac...

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security ri...

An out of bounds write vulnerability in V8, the JavaScript engine of Google Chrome, potentially allows remote attackers to execute arbitrary code within the browser's sandboxed environment. This occurs when a specially crafted HTML page is processed, which triggers an unexpected write operation o...

A type confusion vulnerability has been identified in the V8 JavaScript engine of Google Chrome. Prior to version 152.0.7977.82, this flaw allows malicious attackers to execute arbitrary code within the browser's sandbox environment by crafting a specially designed HTML page. This vulnerability p...

A significant code execution vulnerability exists in the V8 engine of Google Chrome prior to version 146.0.7680.75. This flaw can be exploited by remote attackers through specially crafted HTML pages, allowing for arbitrary code execution within a sandbox environment. Such vulnerabilities pose se...

Adobe Acrobat Reader is impacted by a Prototype Pollution vulnerability that allows attackers to execute arbitrary code within the context of the current user. This flaw is triggered only when a user interacts with a malicious file, making user awareness essential. It is crucial for users to keep...

The ARForms plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to improper handling of user-uploaded files. All versions up to and including 7.2.4 allow attackers to exploit the file upload functionality via a form file-upload handler. An attacker can craft a reques...

The Ninja Forms - File Uploads add-on for WordPress presents a security flaw that allows unauthenticated attackers to delete arbitrary files from a site's server. This vulnerability arises due to improper handling of client-supplied file data during uploads. Specifically, if an attacker omits the...

A vulnerability exists in the SourceCodester Smart Attendance System with QR Code Scanner version 1.0, specifically within the file reset_password.php. An unchecked manipulation of the 'Username' parameter enables attackers to perform cross-site scripting attacks remotely. This could lead to unau...