Publicly Disclosed
PoC Exploits

A significant vulnerability has been discovered in Moonshot AI's Kimi Code, specifically affecting versions up to 2.0.2. This vulnerability lies within the '.kimi-code/local.toml' file of the WorkspaceDirsService component. An attacker can perform local input manipulation by altering the 'additio...

A security vulnerability has been identified in the Moonshot AI Kimi Code's Web UI, which affects versions up to 2.5.2. The vulnerability arises within the function 'isOriginAllowed' in the Javascript file located at 'apps/kimi-code/dist-web/assets/index-HU0LCM-X.js'. Attackers can manipulate the...

The Confection WordPress plugin, versions 0.4.0 to 0.4.7, presents a serious security risk by failing to conduct adequate capability or nonce checks before saving its settings. This flaw allows unauthenticated users to write an unmodified setting into a standalone PHP file, which subsequently get...

An integer overflow vulnerability exists in GitLab CE/EE that may allow an unauthenticated attacker to execute arbitrary code on the GitLab server. This issue affects all versions from 7.0 prior to 18.11.13, 19.0 prior to 19.0.10, and other specified versions up to 19.5.1. The exploitation arises...

An authentication bypass vulnerability in Apache Airflow's CeleryExecutor allows unauthorized users to enqueue malicious callback workloads. By exploiting this flaw, an attacker can run arbitrary code on connected CeleryExecutor workers without needing valid Airflow credentials. This occurs throu...

The OpsTree REMS application up to version 1.0.0 is vulnerable to a stored cross-site scripting flaw that enables authenticated attackers to inject malicious scripts. This vulnerability arises when attackers upload attachments with a deceptive Content-Type of text/html, such as files masquerading...

OpsTree REMS up to version 1.0.0 is susceptible to an improper attribution vulnerability that permits authenticated users to exploit the comment functionality. This can lead to lower-privileged attackers posting comments impersonating higher-privileged users, such as Super Users, thereby compromi...

OpsTree REMS versions up to 1.0.0 are affected by a server-side request forgery vulnerability that permits authenticated users to exploit the database Test Connection feature. This flaw allows an attacker to manipulate database entries, potentially connecting the backend to arbitrary destinations...

OpsTree REMS version 1.0.0 is affected by a vulnerability that allows unauthenticated remote attackers to access sensitive Governance API endpoints. Attackers can exploit this weakness by sending requests to endpoints like /api/v1/databases without the need for proper authentication. This can lea...

The REMS product by OpsTree, up to version 1.0.0, is susceptible to an authentication bypass scenario. By manipulating the is_local_auth field, attackers can craft a POST request to /api/v1/user/login/ for the admin account with an incorrect password and is_local_auth set to true. This allows una...

The OpsTree REMS product, up to version 1.0.0, is susceptible to a prompt injection vulnerability. This flaw allows authenticated users to exploit the chat functionality by submitting specially crafted inputs to the RCA chat API. As a result, attackers can bypass the intended constraints of the A...

OpsTree REMS versions up to 1.0.0 are affected by an improper authorization vulnerability that compromises the integrity of incident reporting. Authenticated users can exploit this flaw by manipulating the reporter field in incident requests. This enables attackers to attribute incidents to unint...

The GDrv low-level driver in GIGABYTE APP Center and various associated applications poses a security risk due to its exposure of ring0 memcpy-like functionality. This vulnerability creates an opportunity for local attackers to gain extensive control over the affected systems, allowing for potent...

A critical vulnerability in Google Chrome prior to version 157.0.8103.50 allows remote attackers to execute arbitrary code within the browser's sandbox environment. This is achieved through a specially crafted HTML page that exploits a use after free situation in the XML parsing component, leadin...

rConfig Core versions prior to 8.2.19 and rConfig Pro versions before 8.4.1 exhibit a vulnerability that allows unauthenticated network attackers to execute arbitrary code. This occurs through a deserialization flaw when attackers push a specially crafted serialized job onto the Redis-backed Lara...

A use-after-free vulnerability exists in the replication component of MongoDB Server, leading to potential server crashes or, in certain situations, arbitrary code execution. This issue can be triggered during the catch-up process of a newly elected primary in a replica set when authentication is...

Craft CMS, a customizable content management system, has a remote code execution vulnerability present in specific versions. Attackers could exploit this flaw to execute arbitrary code on the server, posing a significant security risk. The affected versions span from 3.0.0-RC1 to just before 3.9....

The heap buffer overflow vulnerability in Git arises during the three-way merge process, particularly affected by the inappropriate handling of conflict markers in a .gitattributes file. When the size of the output exceeds the buffer limit (4 GiB), it leads to integer overflow, allowing attackers...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

A heap buffer overflow vulnerability exists in the Vulkan component of Google Chrome prior to version 107.0.5304.62. This flaw allows an attacker to potentially exploit heap corruption by using a specially crafted HTML page. Successful exploitation may allow an attacker to execute arbitrary code ...

A spoofing vulnerability exists in Microsoft Office Outlook that allows unauthorized attackers to exploit the application by performing unsafe actions without user alerts. This flaw can enable the attacker to impersonate a legitimate entity over the network, potentially leading to unauthorized ac...

A vulnerability exists in the Windows Audio Service due to improper verification of cryptographic signatures. This flaw allows an authorized attacker to potentially elevate their privileges locally, which could enable them to execute unauthorized actions with elevated privileges on the affected s...

The WPS Bookings for WooCommerce plugin lacks adequate validation of user-supplied price values. This flaw enables unauthorized users to manipulate booking prices, even allowing them to set prices to zero, resulting in potential financial losses for service providers. The issue affects versions p...

The GetPaid WordPress plugin versions 2.8.63 and 2.8.64 exhibit a flaw in their payment processing system that fails to validate item quantities as whole numbers. This vulnerability enables unauthenticated users to manipulate payment forms, allowing them to create invoices for items marked as pai...

The NotificationX WordPress plugin versions before 3.3.7 lack proper capability, authentication, or nonce checks on the notification preview path. This oversight allows unauthenticated users to access and disclose private, draft, pending, and password-protected post content. Additionally, attacke...

The ProfilePress plugin for WordPress versions prior to 4.17.6 contains an access control weakness. This vulnerability allows unauthenticated users to bypass restrictions on member directories established by the site administrator. As a result, these users can list accounts that should remain hid...

The Advanced Product Fields (Product Addons) for WooCommerce plugin versions 1.6.22 to 1.7.3 is susceptible to an input validation issue. It fails to ensure that the required value for a paid product option aligns with the predefined choices, permitting unauthenticated users to add products to th...

The webpack-dev-middleware is vulnerable to a path traversal issue where the request pathname can circumvent restrictions and allow access to unauthorized files. This occurs due to an incomplete security guard that incorrectly verifies paths against malicious inputs, especially when the configure...

An unauthenticated remote code execution vulnerability exists in versions of the JetEngine plugin up to 3.8.14. The flaw allows unauthorized attackers to execute arbitrary code on vulnerable systems without requiring prior authentication. This potentially leads to full control of the affected ser...

The Security For WooCommerce plugin for WordPress, specifically versions up to 1.0.16, contains a significant access control vulnerability. This weakness allows unauthenticated users to leverage one of its REST API routes, enabling them to retrieve the email addresses of all site administrators. ...

The YITH WooCommerce Gift Cards plugin for WordPress fails to accurately reconcile the value of gift cards issued with the payment amount. Instead of crediting the gift card based on the actual amount paid, it incorrectly assigns the pre-discount price of items. This flaw allows customers to use ...

The Security For WooCommerce WordPress plugin version 1.0.16 is affected by a flaw that fails to verify whether a requester is authorized before terminating user login sessions. This vulnerability allows unauthorized individuals to log out any user, including those with admin privileges, potentia...

The Security For WooCommerce plugin for WordPress versions up to 1.0.16 is susceptible to improper access control vulnerabilities. This flaw enables unauthorized users to exploit specific REST API routes to gather sensitive server configurations. Exposed data may include details regarding the PHP...

The Security For WooCommerce plugin for WordPress, up to version 1.0.16, is vulnerable due to a lack of appropriate authorization checks. This vulnerability enables unauthenticated users to reset various settings to their default states. Consequently, critical security features such as custom log...

The Security For WooCommerce plugin for WordPress versions up to 1.0.16 contains a significant authorization bypass vulnerability. This flaw allows unauthorized users to regenerate sensitive secret keys and salts within the site's configuration file. As a result, it enables these users to log out...

The Security For WooCommerce plugin, up to version 1.0.16, has a critical vulnerability allowing unauthenticated users to access a REST API route. This security flaw enables unauthorized individuals to retrieve sensitive configuration details, including secret keys and the hidden login URL. Such ...

The Security For WooCommerce plugin for WordPress versions up to 1.0.16 has a serious flaw that permits unauthorized users to execute comment cleanup actions. This weakness allows these users to delete any comments on the site, including those that have been approved and even WooCommerce order no...

The Security For WooCommerce plugin through version 1.0.16 is susceptible to an authorization bypass flaw. This vulnerability permits unauthenticated users to execute bulk actions, which includes forcing the installation of pending WordPress core updates without proper authorization. Such unautho...

The Security For WooCommerce plugin for WordPress prior to version 1.0.16 is vulnerable due to improper access controls on its REST API routes. This flaw permits unauthenticated users to create login tokens for all users, including administrators, allowing unauthorized access to sensitive account...

The Security For WooCommerce plugin for WordPress versions up to 1.0.16 contains a serious security flaw that permits unauthorized users to reset two-factor authentication settings. This vulnerability allows anyone, without appropriate credentials, to disable the second authentication factor for ...

The Security For WooCommerce plugin for WordPress, affecting versions up to 1.0.16, has a significant flaw that allows unauthenticated users to access a user's current two-factor authentication code or secret. This vulnerability can be exploited to bypass essential security measures, enabling una...

The ProfilePress WordPress plugin prior to version 4.17.4 contains a security flaw that permits users to bypass active membership checks during subscription changes. This loophole allows subscribers to enroll in deactivated plans, potentially granting access to roles associated with inactive subs...

The Photo Engine plugin for WordPress, prior to version 6.6.2, exhibits a flaw where it fails to adequately sanitize and escape keyword names before storing and displaying them on its debugging page. This oversight enables users with Author roles and higher to execute Stored Cross-Site Scripting ...

The Photo Engine plugin for WordPress prior to version 6.6.2 features a significant flaw that allows users with the Author role and higher to delete media files without proper verification. This oversight enables unauthorized users to permanently remove synced media from other users, including ad...

The iChart WordPress plugin prior to version 2.2.4 contains a vulnerability that permits logged-in users, even those with minimal permissions such as Subscribers, to execute unauthorized actions. The plugin fails to implement proper capability or ownership checks for multiple AJAX actions, relyin...

The Event Tickets and Registration WordPress plugin versions prior to 5.30.3.1 contains a vulnerability that allows unauthenticated individuals to access the names of attendees for events that are configured not to display a public attendee list. This occurs because the plugin fails to check the ...

The WooCommerce plugin by Smoove, prior to version 4.3.6, is susceptible to a stored cross-site scripting vulnerability. This occurs because the plugin fails to properly sanitize and escape abandoned cart data submitted by users before displaying it in the admin dashboard. As a result, unauthenti...

The Event Tickets and Registration plugin prior to version 5.30.3.1 for WordPress contains a vulnerability that fails to restrict access to attendee data; this allows unauthenticated users to retrieve information about attendees from private events as well as events that are not public. This weak...

The ProfilePress WordPress plugin prior to version 4.17.6 is susceptible to an improper input validation issue. This flaw allows attackers to manipulate membership plan identifiers, enabling unauthenticated users to register for deactivated membership plans. By exploiting this vulnerability, they...

The ProfilePress WordPress plugin, prior to version 4.17.6, has a security flaw where it inadequately evaluates content protection rules under specific conditions. This issue permits unauthorized users to access protected content via the REST API, potentially exposing sensitive information that s...