Publicly Disclosed
PoC Exploits

OpenIdentityPlatform's OpenAM, an access management solution, is susceptible to a pre-authentication Remote Code Execution vulnerability due to unsafe Java deserialization. This issue arises from the handling of the jato.clientSession HTTP parameter, allowing unauthenticated attackers to execute ...

An authorization flaw exists in JFrog products, where improper validation of refresh token signatures allows non-admin users to acquire a signed administrator token. This vulnerability could lead to unauthorized access and can potentially compromise the integrity of sensitive operations within th...

A vulnerability has been identified in the D-Link R95 BE9500 router, specifically in the file /bin/ssi associated with the DHMAPI component. This issue arises from improper handling of the NTPServer argument, allowing for OS command injection. Exploitation of this vulnerability can occur remotely...

QloApps version 1.7.0 contains a path traversal vulnerability in the 'getEmailHTML' function of admin/ajax.php. This issue allows authenticated back-office users to perform unauthorized operations by supplying relative path sequences through the email parameter. As a result, attackers can bypass ...

A vulnerability in grimmory-tools' Download Endpoint allows an attacker to bypass authorization controls via manipulation of the bookId argument in the streamFileToResponse function of KoboController.java. This exploit can be initiated remotely, potentially exposing sensitive data or services to ...

The Concrete CMS Community Store prior to version 2.7.8 is vulnerable to a stored XSS issue where customer-supplied data in order fields, such as billing name, email, and phone number, is not properly sanitized. This flaw enables unauthenticated attackers to inject malicious scripts that execute ...

A notable security vulnerability exists within the Settings API Endpoint of grimmory-tools versions up to 3.3.3 and 3.4.1. The flaw is situated in the method AppSettingController.getAppSettings, located in the AppSettingController.java file. This vulnerability allows for manipulation that undermi...

The vulnerability in Apache Airflow arises from an oversight in permission checks for the asset queued-events DELETE endpoints. Instead of validating the caller's Dag-axis permission for EDIT, it incorrectly checks for READ permission. This allows any authenticated user with read access to a Dag ...

A command injection vulnerability has been identified in the Totolink A3002MU router specifically in the formWsc function located in the /boafrm/formWsc file. This weakness allows an attacker to manipulate the 'localPin' argument, leading to unauthorized command execution. The flaw is exploitable...

The Jenkins GitBucket Plugin, up to version 0.8, contains a vulnerability due to inadequate sanitization of Gitbucket URLs in build views. This flaw allows attackers with the ability to configure jobs to inject malicious scripts, which can be executed in the context of users viewing the affected ...

The Rede Itaú for WooCommerce plugin before version 5.4.7 lacks proper verification of the authenticity of its PIX payment webhook. This oversight allows malicious actors to exploit the system and change the status of pending orders to paid without completing the actual payment process. Such vuln...

The Hydra Booking - Appointment Scheduling & Booking Calendar plugin for WordPress versions prior to 1.2.3 is susceptible to an authorization bypass vulnerability. This flaw allows authenticated users with the host role to modify other hosts' profile information and transfer ownership of related ...

The Hydra Booking plugin, utilized for appointment scheduling in WordPress, has a significant security flaw that allows users with booking-provider-level access to manipulate other providers' bookings. Specifically, it fails to verify the ownership of bookings before allowing modifications or del...

The Hydra Booking plugin for WordPress, prior to version 1.2.4, contains a significant flaw that lacks proper object-level authorization checks across various host-management functionalities. This oversight allows users with administrator-assigned custom roles to manipulate sensitive data, includ...

The Mailchimp for WooCommerce plugin, prior to version 6.1.1, contains a significant security flaw that allows unauthenticated users to interact with sensitive REST API endpoints. This occurs due to inadequate checks in the permission callback, which permits unauthorized users to create persisten...

The Online Scheduling and Appointment Booking System WordPress plugin prior to version 28.2 fails to validate the ownership of conversations in its unauthenticated actions. This oversight permits any visitor to gain unauthorized access to messages within another user's AI booking-assistant conver...

The MgoSync plugin for WordPress lacks proper authorization controls on its REST API endpoints. This oversight enables unauthenticated users to access sensitive WooCommerce API credentials, which include a read/write consumer key and secret. Consequently, this vulnerability poses a significant ri...

The WPGraphQL Smart Cache plugin prior to version 2.3.2 is susceptible to an authorization bypass vulnerability. This flaw allows unauthenticated users to store arbitrary query documents by exploiting the lack of validation for caller-supplied query identifiers. As a result, malicious users can p...

The Secure Custom Fields WordPress plugin prior to version 6.9.4 suffers from a vulnerability where it fails to validate that a front-end form submission corresponds to the correct form instance displayed to a visitor. This flaw allows unauthenticated users to target different registered forms an...

The Master Blocks plugin for WordPress, prior to version 1.5.0, is vulnerable due to insufficient authorization on certain REST routes. This oversight permits unauthenticated users to modify plugin settings, including values displayed unescaped in the WordPress admin area. Consequently, this lead...

The VikRentItems Flexible Rental Management System WordPress plugin prior to version 1.2.4 is vulnerable due to inadequate sanitization and escaping of user input in SQL statements. This flaw allows unauthenticated attackers to execute arbitrary SQL queries, potentially compromising the database ...

The Unbounce Landing Pages plugin for WordPress prior to version 1.1.5 is vulnerable to an authorization bypass issue. This vulnerability allows authenticated users, including those with low privilege accounts like subscribers, to manipulate the configuration used by the plugin's front-end proxy....

The Botiga Pro plugin for WordPress prior to version 1.6.5 contains a serious flaw that permits unauthorized users to bypass authorization checks on certain REST routes. This vulnerability enables these users to alter WordPress options with arbitrary values, potentially leading to privilege escal...

The Ultimate Member plugin for WordPress versions prior to 2.13.1 contains a critical cross-site scripting (XSS) vulnerability. This flaw arises when user-supplied profile names are rendered in the page title without proper escaping, and HTML entities are decoded following initial sanitization. A...

The UsersWP plugin for WordPress fails to ensure that a social login provider validates the ownership of an email address before using it to link to an existing account. This flaw allows attackers without authentication to log in as any user, including administrators, simply by asserting control ...

The JetFormBuilder WordPress plugin before version 3.6.5.3 permits insufficiently restricted PHP functions as custom field-validation callbacks. This loophole allows users with form management privileges to execute arbitrary file deletions on the server. The vulnerability is exploited during form...

The WP Import Export Lite plugin allows unauthorized users to create and modify user accounts without proper permissions. Prior to version 3.9.35, it fails to verify the user's authority to manage user roles, enabling those with delegated permissions to establish administrator accounts and alter ...

The Estatik Real Estate Plugin for WordPress, prior to version 4.3.5, is susceptible to Reflected Cross-Site Scripting (XSS). This vulnerability arises due to the improper sanitization and escaping of user input when handled through unauthenticated AJAX calls, allowing attackers to inject malicio...

The Ultra Addons for Contact Form 7 plugin for WordPress prior to version 3.5.51 has a significant security flaw where it fails to validate the type or extension of files uploaded via its forms. This allows unauthenticated users to upload arbitrary files, potentially leading to serious security b...

The Business Name Generator Plugin for WordPress, in versions through 1.3, is susceptible to a stored Cross-Site Scripting vulnerability. This issue arises from the lack of proper sanitization and escaping on certain settings, enabling high privilege users, such as admin, to execute malicious scr...

The Nimble Page Builder WordPress plugin, up to version 3.3.8, lacks an authorization check when returning content through an authenticated AJAX action. This oversight allows any authenticated user with a role of Subscriber or higher to access and disclose the content of non-public posts and page...

A critical security issue has been identified in the Totolink A3002MU, specifically in the formWlWds function within the file /boafrm/formWlWds. This vulnerability allows for a buffer overflow through improper handling of the submit-url argument, making it susceptible to remote exploitation. As t...

The Erlang/OTP SSH server prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20 contains a critical flaw in SSH protocol message handling that allows attackers to bypass authentication and execute arbitrary commands remotely. This vulnerability can be exploited to gain unauthorized acces...

The WP MAPS PRO plugin for WordPress prior to version 6.1.3 lacks proper capability checks for certain AJAX actions. This oversights allows unauthenticated users to exploit these actions, leading to potential uncontrolled recursion. As a result, attackers may consume server resources excessively,...

The WP Maps plugin for WordPress, prior to version 4.9.7, lacks proper capability checks in its AJAX actions. This weakness allows users with a Subscriber account to execute uncontrolled recursive functions, subsequently exhausting server resources and leading to a Denial of Service. It is crucia...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A security flaw has been detected in the Totolink A3002MU router, particularly within the formWlEncrypt function located in the /boafrm directory. This vulnerability allows for a remote buffer overflow attack through manipulation of the 'submit-url' parameter. Attackers can exploit this flaw to e...

A buffer overflow vulnerability exists in the Totolink A3002MU router, specifically affecting the formWlAc function of /boafrm/formWlAc. By manipulating the submit-url argument, an attacker could exploit this issue remotely. This vulnerability has been publicly disclosed, indicating a potential r...

A buffer overflow vulnerability has been identified in the Totolink A3002MU, specifically affecting the formSchedule function in the /boafrm/formSchedule file. This vulnerability allows an attacker to manipulate the 'webpage' argument, leading to potential remote exploitation of the device. Explo...

Caucho Resin has a security flaw in its documentation webapp (resin-doc), which allows remote unauthenticated attackers to exploit path traversal techniques. By supplying a relative path via the inputFile request parameter in the jndi-appconfig tutorial servlet, attackers can gain access to arbit...

The Weaver E-cology mobile plugin is susceptible to an unauthenticated SQL injection vulnerability that enables remote attackers to execute arbitrary SQL commands. By manipulating the userIdentifiers GET parameter, attackers can exploit this flaw to perform UNION-based injections, effectively byp...

The Weaver E-cology mobile plugin is susceptible to an unauthenticated SQL injection vulnerability that enables remote attackers to execute arbitrary SQL commands. By manipulating the userIdentifiers GET parameter, attackers can exploit this flaw to perform UNION-based injections, effectively byp...

The Hongjing e-HR software prior to version 8.2 is susceptible to a SQL injection vulnerability located at the /servlet/codesettree endpoint. This flaw allows an unauthenticated remote attacker to inject a crafted UNION SELECT statement through the categories query parameter, potentially exposing...

The Hongjing e-HR software prior to version 8.2 is susceptible to a SQL injection vulnerability located at the /servlet/codesettree endpoint. This flaw allows an unauthenticated remote attacker to inject a crafted UNION SELECT statement through the categories query parameter, potentially exposing...

The Hongjing e-HR software prior to version 8.2 is susceptible to a SQL injection vulnerability located at the /servlet/codesettree endpoint. This flaw allows an unauthenticated remote attacker to inject a crafted UNION SELECT statement through the categories query parameter, potentially exposing...

A vulnerability exists in certain versions of Saleor, specifically within the get_client_ip function in throttling.py. This issue can lead to inadequate restrictions on excessive authentication attempts, allowing remote exploitation. The complexity of the attack is high, and while exploitability ...

A vulnerability in the Linux kernel related to posix CPU timers can lead to a use-after-free condition due to a race in non-leader exec() scenarios. When a timer associated with a process is deleted while concurrently executing an exec() command, it can cause access to freed memory. Specifically,...

A vulnerability exists in gedelumbung HospitalManagement that affects its Password Change Handler responsible for managing user password updates. This flaw allows attackers to manipulate user credentials, particularly the 'kode_user' or 'username' parameters, enabling unauthorized access. The iss...

The SOGo email server prior to version 5.12.11 contains a significant vulnerability that allows unauthorized attackers to exploit the password-reset process. By injecting a malicious Origin header when submitting password recovery requests, attackers can redirect valid password-reset tokens to th...

A vulnerability in gedelumbung's HospitalManagement system allows for cross-site request forgery (CSRF), enabling attackers to exploit the weakness remotely. Users may unknowingly trigger malicious requests while authenticated, potentially compromising sensitive data. An exploit for this flaw has...