Publicly Disclosed
PoC Exploits

The Nexi XPay Build plugin for WordPress, up to version 7.6.2, is susceptible to an improper input validation vulnerability. This issue allows attackers to manipulate the payment results supplied to several unauthenticated routes within the plugin. As a result, malicious actors can mark orders as...

The Nexi XPay Build plugin for WordPress, in versions up to 7.6.2, is susceptible to improper authentication due to inadequate validation of security tokens on its payment notification route. This vulnerability enables unauthenticated attackers to manipulate order statuses by either marking arbit...

The Magee Shortcodes WordPress plugin, up to version 2.1.1, is susceptible to an exploit that allows unauthenticated users to send unauthorized emails to any address via the site's contact form. This vulnerability occurs due to insufficient restrictions in the plugin's form actions, enabling pote...

The MetForm plugin for WordPress prior to version 4.3.1 is susceptible to Cross-Site Scripting (XSS) attacks. It allows adversaries to exploit a lack of sanitization and escaping of form-field values before they are embedded into the HTML body of email notifications. This oversight permits unauth...

The PowerPress Podcasting plugin by Blubrry for WordPress, in versions prior to 11.17.11, is vulnerable to Server-Side Request Forgery attacks. This issue arises due to improper validation of redirect destinations while fetching user-supplied media URLs. As a result, users with the contributor ro...

The String Locator plugin for WordPress prior to version 2.6.8 is vulnerable due to insufficient restrictions on classes allowed during deserialization of database content. This flaw enables unauthenticated attackers to store serialized PHP objects within database rows through the plugin's databa...

The If-So Dynamic Content WordPress plugin prior to version 1.10.2 fails to validate the URL scheme of user-supplied values. This oversight allows attackers to inject arbitrary JavaScript code into admin pages. If a logged-in user clicks on a crafted link, it could lead to the execution of malici...

The Optimole plugin for WordPress prior to version 4.2.15 has a security flaw that allows authenticated users, including those with limited permissions such as Subscribers, to access sensitive account data stored within the plugin. This issue arises due to a lack of proper capability checks befor...

The User Private Files plugin for WordPress prior to version 2.1.9 contains a vulnerability that fails to restrict access based on user permissions. This allows any authenticated user, including those with minimal roles such as Subscriber, to retrieve the email addresses of other registered accou...

The Koinonia Link plugin for WordPress, versions before 1.1.5, fails to properly verify user permissions when altering role selections during profile updates. This oversight can be exploited by any authenticated user, such as a subscriber, allowing them to upgrade their own role to Administrator,...

The WPCafe WordPress plugin prior to version 3.0.21 has a significant flaw in its REST API, where it fails to adequately restrict access to certain endpoints. This oversight allows unauthenticated users to infiltrate sensitive areas of the site, thereby gaining access to critical WooCommerce prod...

The CP Media Player plugin for WordPress, prior to version 1.3.4, suffers from an access control vulnerability. This issue arises because the plugin fails to implement proper capability checks on its settings-page handler. As a result, users with only Contributor-level permissions can create, mod...

The MPG WordPress plugin versions prior to 4.2.3 contains a vulnerability that fails to adequately validate the structure of imported project data before utilizing it in database queries. This oversight allows users with Editor roles or higher permissions to execute SQL injection attacks. Consequ...

The Magee Shortcodes plugin for WordPress versions up to 2.1.1 is vulnerable due to improper sanitization and escaping of user input in certain AJAX actions. This lack of sanitization allows unauthenticated users to inject malicious scripts, leading to reflected cross-site scripting (XSS) attacks...

The WP Coder plugin for WordPress prior to version 4.5.2 allows users with Editor-level access to execute arbitrary PHP code due to improper access controls. This vulnerability enables unauthorized users to exploit the PHP code-execution feature, potentially compromising the entire website by sav...

The Yaad Sarig Payment Gateway for WooCommerce plugin prior to version 2.2.13 contains an authorization bypass vulnerability that allows any authenticated user to access and modify orders belonging to other customers. This flaw arises from the plugin's failure to properly verify that the user req...

The Envira Gallery WordPress plugin prior to version 1.16.1 is vulnerable due to improper sanitization and escaping of user-provided gallery display configuration values. This flaw enables users with Author role or higher to inject arbitrary web scripts. These scripts are executed when any site v...

The Envira Gallery plugin for WordPress prior to version 1.16.1 is susceptible to an injection vulnerability. This issue arises because the plugin fails to properly sanitize and escape gallery item identifiers before rendering them in image tag attributes. As a result, users with the Author role ...

The Academy LMS WordPress plugin prior to version 4.0.0 exposes a flaw where it fails to confirm whether a quiz question is associated with the course that a requesting user is allowed to access. This oversight allows any authenticated user, such as an enrolled student, to retrieve answers for qu...

The Animated Number Counters WordPress plugin, prior to version 3.1, contains a serious security flaw that allows an Editor-level user to inject unsanitized values into SQL queries. This vulnerability enables unauthorized access to sensitive information, such as password hashes, through second-or...

The Epos Now integration for WooCommerce WordPress plugin versions prior to 4.11.2 lacks sufficient authorization checks on a critical REST API endpoint. This vulnerability allows unauthenticated users to access sensitive information, including details of scheduled background tasks and their para...

The Academy LMS plugin for WordPress prior to version 4.0.0 contains a vulnerability that fails to adequately verify user enrollment and ownership of course materials when utilizing its REST API. This oversight permits users with self-registerable student accounts to access and retrieve content f...

The Geliver Akıllı Kargo Pazaryeri WordPress plugin prior to version 3.1.1 contains a serious vulnerability that allows unauthorized access to a log file stored in its web-accessible directory. This log file includes the site's carrier integration key, which can be exploited by attackers to alter...

The Frontend Dashboard plugin for WordPress prior to version 3.0.0 is susceptible to improper access control due to its failure to enforce capability checks during AJAX actions. This oversight permits authenticated users with lower privileges, such as subscribers, to delete crucial settings assoc...

A vulnerability exists in Apache Artemis and ActiveMQ that allows an unauthenticated remote attacker to exploit the CORE protocol SESSION_REATTACH packet. This exploitation can potentially lead to unauthorized access by seizing control of an ongoing authenticated session. Users are urged to upgra...

The static code injection vulnerability in the Ajax File and Image Manager allows remote attackers to exploit crafted parameters to inject arbitrary PHP code into the data.php file. This can lead to unauthorized manipulation of the server environment, potentially compromising sensitive data and a...

A local privilege escalation vulnerability in Snapd on Linux systems allows attackers to exploit the automatic cleanup of Snap's private /tmp directory. By re-creating this directory under certain configurations of systemd-tmpfiles, an attacker can potentially gain root privileges. This issue imp...

A vulnerability in the Java integration of Apache OpenOffice versions 4.1.16 and earlier allows attackers to execute arbitrary code through carefully crafted untrusted documents. This can lead to unauthorized actions being performed on the user's system upon opening the compromised document. To m...

LibreOffice Calc allows users to link cell ranges to external data sources. This feature poses a risk, as documents can specify a Java database driver that points to a remote location. Consequently, when users open the document, Java code from that external source can be executed on their system,...

A race condition vulnerability has been identified in Apple iOS and macOS products, where improper state handling could lead to unexpected system terminations or allow an app to write unauthorized kernel memory. This flaw has been addressed in recent updates across various Apple platforms, includ...

The Strong Testimonials plugin for WordPress contains a Cross Site Scripting (XSS) vulnerability that affects versions up to 3.3.11. An attacker could exploit this weakness to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized actions or data theft. Websi...

A vulnerability exists within the SourceCodester Simple Company Website 1.0, specifically affecting the processing of the file /admin/services/manage.php. An attacker can exploit this vulnerability through a manipulation of the argument ID, enabling SQL injection attacks. This issue poses a risk ...

This vulnerability allows unauthorized command execution in the GPU micronode, leading to potential memory corruption when a specific sequence of commands is executed. Attackers could exploit this weakness to disrupt system functionality or gain access to sensitive areas of memory, posing risks t...

A vulnerability affecting the SourceCodester Performance Indicator System 1.0 has been identified, which allows for SQL injection through the manipulation of the 'Category' argument in the /opils/admin/view_product.php file. This flaw facilitates remote exploitation, raising significant security ...

A security flaw has been identified in the vLLM product of vllm-project, affecting versions up to 0.31.0. This vulnerability is rooted in the function get_token_bin_counts_and_mask located in the utils.py file of the Penalty Handler component. An attacker could exploit this issue to manipulate th...

A vulnerability exists in the Kusalkasilva Learning-Management-System that allows an attacker to manipulate the argument 'school_year' via the file search_class.php. This SQL injection vulnerability can be exploited remotely, potentially leading to unauthorized access or modification of the syste...

A remote code execution vulnerability found in React Server Components allows attackers to exploit improperly handled payloads. This issue affects versions 19.0.0 through 19.2.0, compromising server function endpoints through unsafe deserialization of HTTP request payloads. As a result, this flaw...

The Kusalkasilva Learning-Management-System is subject to a SQL injection vulnerability in the student_signup.php file within the Student Registration Endpoint component. This vulnerability enables an attacker to execute arbitrary SQL queries, potentially compromising sensitive data. The vulnerab...

A SQL injection vulnerability has been identified in the Kusalkasilva Learning-Management-System, specifically within the Administrator Login Endpoint function mysql_query located in admin/login.php. By manipulating the arguments for the username and password, attackers can exploit this vulnerabi...

A vulnerability exists in the Kusalkasilva Learning-Management-System affecting the login endpoint's mysql_error function in the login.php file. By manipulating the username and password arguments, an attacker can perform SQL injection attacks remotely. Despite early notifications regarding this ...

A weakness in the authorization mechanisms of Microsoft Exchange Server can be exploited by authenticated attackers, allowing them to gain elevated privileges over the network. This vulnerability poses significant risks as it can enable attackers to manipulate sensitive data or compromise additio...

A cross-site scripting vulnerability has been identified in the SourceCodester Simple Student Information System 1.0. This issue specifically affects the processing of user input in the file /register.php, where the arguments 'firstname' and 'lastname' can be manipulated. This allows attackers to...

A vulnerability exists in the SourceCodester Simple Student Information System version 1.0 within the searchresults.php file's clean function. This flaw allows for remote cross site scripting attacks through manipulation of the searchbox argument. Attackers can execute payloads that may compromis...

A vulnerability has been identified in the Tenda AC5 router, specifically within the Wifi Handler component at the /goform/setWifi endpoint. This flaw allows for manipulation of the wifiPwd argument, potentially leading to a stack-based buffer overflow. The exploitation of this vulnerability can ...

The Slider Pro plugin for WordPress, up to version 1.0.0, contains a vulnerability that allows unauthenticated users to exploit an AJAX action without any capability or authorization checks. This could enable these users to access sensitive information such as the titles, excerpts, and permalinks...

The File Media Renamer plugin for WordPress has a flaw that fails to validate user authorization for modifying media attachments. This vulnerability allows any user with file-upload privileges to rename media files belonging to other users, including site administrators. As a result, it can lead ...

The Fast Courier WordPress plugin, up to version 5.2.3, contains a significant security flaw that exposes a REST API endpoint without proper authentication. This vulnerability allows unauthorized attackers to modify order fulfillment data, including the courier status and customer-facing tracking...

The elegro Crypto Payment WordPress plugin prior to version 1.0.1 has a serious security flaw that allows attackers to deceive the payment system. Specifically, it fails to enforce the requirement for a shared secret, enabling unauthorized individuals to send fraudulent payment notifications. As ...

The Deema Payment Gateway plugin for WordPress, up to version 1.1.2, has a significant security issue due to its failure to verify the authenticity of incoming payment provider notifications. This vulnerability occurs because the verification feature is disabled by default, enabling unauthorized ...

The Deema Payment Gateway for WordPress, up to version 1.1.2, contains a vulnerability that permits unauthenticated users to mark orders as paid without any legitimate payment verification with the payment provider. This occurs due to the plugin's failure to verify the payment status or amount wh...