Publicly Disclosed
PoC Exploits

The Wallet System for WooCommerce plugin suffers from an improper input validation flaw that allows authenticated attackers with Subscriber-level access to manipulate wallet transfer amounts. An attacker can exploit this vulnerability by minting wallet funds, as the system fails to ensure that tr...

The Easy Digital Downloads plugin for WordPress prior to version 3.7.1 contains a security flaw that permits unauthenticated users to create accounts without properly checking the user registration settings of the site. This issue enables unauthorized account creation and grants the created accou...

The TutorStarter WordPress theme prior to version 4.0.4 contains a vulnerability where one of its AJAX registration handlers fails to respect the site's user registration setting. This weakness enables unauthenticated visitors to create user accounts on the WordPress site even when user registrat...

The Airwallex Online Payments Gateway plugin for WordPress lacks proper verification of incoming payment notifications when a webhook secret is not configured. This issue enables attackers to forge notifications, potentially leading to unauthorized marking of orders as paid. Website owners using ...

An OS Command Injection vulnerability exists in the login.xgi CGI endpoint of Iskratel Innbox GPON ONT devices, allowing unauthorized remote attackers to execute arbitrary commands with root privileges using specific parameters. This security flaw poses a significant risk as it can lead to unauth...

The Wallet System for WooCommerce plugin for WordPress prior to version 2.8.0 contains an authorization flaw that allows authenticated users, such as subscribers, to make unauthorized withdrawal requests. This issue arises because the plugin fails to confirm that the specified wallet account for ...

The SMS Alert plugin for WordPress has a significant information disclosure flaw found in versions prior to 4.0.1. This vulnerability enables an unauthorized administrator within a multisite network to access and reveal the billing phone numbers of users across different sites. The issue arises f...

The Track Orders for WooCommerce plugin prior to version 1.2.7 contains a security flaw that allows unauthorized access to sensitive customer information. This vulnerability permits unauthenticated attackers to view critical personal details of users simply by providing their email addresses. As ...

The Wallet System for WooCommerce plugin for WordPress prior to version 2.8.0 contains a security flaw that permits authenticated users to execute wallet transfers without the necessary permissions. Specifically, this vulnerability allows any authenticated individual, including those with minimal...

The Wallet System for WooCommerce plugin for WordPress versions prior to 2.8.0 lacks proper capability checks, allowing any authenticated user to access sensitive wallet transaction reports. This oversight can lead to unauthorized disclosure of sensitive user data, including customer names, email...

The BackWPup plugin for WordPress, prior to version 5.7.7, is susceptible to a vulnerability that permits unauthenticated attackers to trigger backup jobs on the system. By exploiting this flaw, attackers can initiate any scheduled backup task regardless of its original trigger conditions or timi...

The BackWPup plugin for WordPress prior to version 5.7.7 has a security flaw that fails to adequately restrict the destination path for files extracted during backup restores. This issue arises when the fallback archive library is utilized, allowing high-privileged users to manipulate the backup ...

A security flaw has been identified in the Database Addon for WPForms plugin. The vulnerability arises from the lack of proper CSRF nonce verification and insufficient capability checks. As a result, attackers can potentially exploit this weakness to delete arbitrary stored form entries. This is ...

The Appointment Booking Plugin for WordPress, prior to version 5.6.9, contains an authorization vulnerability associated with the AI Abilities API. This flaw permits authenticated users with the LatePoint Agent role to bypass restrictions, allowing them to access, read, and even modify other agen...

The Appointment Booking Plugin for WordPress prior to version 5.7.3 contains an improper authentication vulnerability. This flaw allows unauthenticated users to access sensitive customer information such as names, contact details, and order confirmation codes by manipulating the order-item identi...

The BackWPup plugin for WordPress, prior to version 5.7.7, suffers from improper access control, allowing unauthorized users to access the plugin's working directory. This flaw enables unauthenticated attackers to download backup archives containing sensitive information like database dumps, site...

The Appointment Booking Plugin for WordPress versions earlier than 5.6.5 contains an authorization flaw that permits an authenticated user with a staff role to delete any order, customer, or transaction record. This happens even if the records belong to different staff members or exceed their des...

The Easy Digital Downloads plugin for WordPress prior to version 3.7.1 is vulnerable due to inadequate restrictions on order data visibility. This flaw allows users with only subscriber-level access to view details of other customers' recent orders, including signed download links that provide un...

The Booking Calendar plugin for WordPress, prior to version 11.8.3, features inadequate restrictions allowing users with Editor roles and higher to access and disclose values of arbitrary WordPress options. This vulnerability can potentially expose sensitive configuration details of the WordPress...

The Booking Calendar plugin for WordPress prior to version 11.8 is susceptible to a vulnerability that compromises the integrity of access hashes. This flaw arises from the generation of hashes that lack sufficient entropy, as they are based on low-entropy time-seeded values. An unauthenticated a...

The Image Photo Gallery Final Tiles Grid plugin for WordPress prior to version 3.6.14 is susceptible to a JavaScript injection flaw. This vulnerability arises from inadequate sanitization of gallery configuration values that can be manipulated via the gallery shortcode. Users with contributor-lev...

The Frontend Dashboard WordPress plugin prior to version 3.0.5 lacks proper authorization checks, allowing unauthenticated users to invoke arbitrary PHP functions or class methods. This vulnerability poses a significant risk as it enables attackers to perform actions that could lead to the takeov...

The Ultimate Multisite Plugin for WordPress, prior to version 2.17.0, contains a significant vulnerability that allows unauthenticated attackers to log into existing user accounts, including those of Network Super Admins. This exploit occurs when a checkout form is utilized without a password fie...

The Image Photo Gallery Final Tiles Grid plugin prior to version 3.6.14 is susceptible to an authorization bypass vulnerability. This security flaw arises from improper verification of user permissions in multiple gallery and image management operations. The plugin erroneously checks ownership ag...

The GPTranslate plugin for WordPress, prior to version 2.34.14, is susceptible to stored cross-site scripting attacks. This vulnerability arises from the plugin's failure to adequately restrict who can save translations. Furthermore, it does not correctly escape translations when rendering them o...

The User Private Files plugin for WordPress, prior to version 2.2.0, suffers from an access control issue on multisite installations. The plugin fails to enforce access restrictions on private files, as the essential rewrite rule for routing file requests and conducting access checks is not execu...

In Stump API versions up to 0.1.10, a flaw exists in the GraphQL mutations for updating and deleting smart lists. These mutations rely solely on the shared AccessSmartList permission, neglecting to verify the creator's identity of the smart list. This oversight allows any authenticated user with ...

The Heimdall application from LinuxServer is vulnerable to Server-Side Request Forgery (SSRF) due to its insufficient protection mechanisms. While the SafeUrlFetcher is intended to mitigate SSRF risks, it is only applied to the ItemController. Other endpoints, like POST /test_config and GET /get_...

iperf3, in versions earlier than 3.22, is susceptible to a denial of service vulnerability that allows remote, unauthenticated attackers to disrupt server functionality. By sending a specifically crafted control-channel parameter message followed by a single 16-byte UDP datagram, attackers can fo...

A vulnerability exists in the Ultimate Member plugin which allows attackers to bypass authorization controls via user-controlled keys. This flaw can lead to privilege escalation, enabling unauthorized access to user accounts and sensitive information. The affected versions range from n/a to 2.13....

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A type confusion vulnerability resides in the V8 engine of Google Chrome, making it possible for remote attackers to execute a malicious payload that could lead to heap corruption. By exploiting this vulnerability, an attacker can craft a specific HTML page that, when interacted with by a user, m...

A use-after-free vulnerability exists in the Android Binder service, which could allow attackers to elevate privileges from an application to the Linux Kernel. Exploitation of this vulnerability does not require any interaction from the user; however, it necessitates either the installation of a ...

A vulnerability exists in the Linux kernel that concerns the handling of shared skb fragments during the decryption process in ESP-in-UDP packets. When pages are attached from a pipe directly to an skb using MSG_SPLICE_PAGES, the kernel marked these SKBs with SKBFL_SHARED_FRAG, which plays a cruc...

A missing authentication flaw in the Kernel Memory Access Driver (PSKMAD) employed by WatchGuard endpoint security products enables local, authenticated attackers to circumvent the driver's access-control mechanisms. This can lead to the execution of unauthorized privileged commands, ultimately a...

LiteLLM is impacted by a vulnerability that permits attackers to utilize a valid JSON Web Token (JWT) from a designated identity provider to impersonate any existing user. The flaw arises from an email-based fallback lookup process in the authentication flow which bypasses verification of the ema...

A vulnerability has been reported in Open5GS versions up to 2.7.7 in the GTP-U Receive Path function ogs_pfcp_xact_local_create, which allows remote attackers to manipulate resource allocations. This issue can potentially be exploited without authentication, making it critical to address. Users a...

Gophish versions 0.11.0 to 0.12.1 are prone to a server-side request forgery vulnerability that can be exploited by authenticated low-privileged users. Through the endpoint POST /api/import/site, attackers are able to submit internal URLs that are not blocked by the default dialer deny list. This...

The shell-quote library's `quote()` function poses a security risk by improperly handling comment tokens within command strings. Specifically, when a `{ comment }` token is included, it generates a line starting with `#`, which comments out subsequent input that follows it, including the opening ...

Smarty prior to version 4.5.8 and 5.x before 5.8.5 has a code injection vulnerability that arises due to improper handling of the nocache_hash during template inheritance. This oversight allows attackers to introduce malicious code through crafted assigned data containing a forged SmartyNocache m...

Telegram Desktop prior to version 7.2.9 is susceptible to an IPC record-separator injection vulnerability present in Core::Sandbox. This flaw permits remote attackers to craft tg:// links embedded with unescaped semicolons. By exploiting this vulnerability, an attacker can manipulate the interpre...

OpenIdentityPlatform's OpenAM, an access management solution, is susceptible to a pre-authentication Remote Code Execution vulnerability due to unsafe Java deserialization. This issue arises from the handling of the jato.clientSession HTTP parameter, allowing unauthenticated attackers to execute ...

The Nexi XPay Build plugin for WordPress, in versions up to 7.6.2, is susceptible to improper authentication due to inadequate validation of security tokens on its payment notification route. This vulnerability enables unauthenticated attackers to manipulate order statuses by either marking arbit...

The Nexi XPay Build plugin for WordPress, up to version 7.6.2, is susceptible to an improper input validation vulnerability. This issue allows attackers to manipulate the payment results supplied to several unauthenticated routes within the plugin. As a result, malicious actors can mark orders as...

The Magee Shortcodes WordPress plugin, up to version 2.1.1, is susceptible to an exploit that allows unauthenticated users to send unauthorized emails to any address via the site's contact form. This vulnerability occurs due to insufficient restrictions in the plugin's form actions, enabling pote...

The MetForm plugin for WordPress prior to version 4.3.1 is susceptible to Cross-Site Scripting (XSS) attacks. It allows adversaries to exploit a lack of sanitization and escaping of form-field values before they are embedded into the HTML body of email notifications. This oversight permits unauth...

The PowerPress Podcasting plugin by Blubrry for WordPress, in versions prior to 11.17.11, is vulnerable to Server-Side Request Forgery attacks. This issue arises due to improper validation of redirect destinations while fetching user-supplied media URLs. As a result, users with the contributor ro...

The User Private Files plugin for WordPress prior to version 2.1.9 contains a vulnerability that fails to restrict access based on user permissions. This allows any authenticated user, including those with minimal roles such as Subscriber, to retrieve the email addresses of other registered accou...

The Optimole plugin for WordPress prior to version 4.2.15 has a security flaw that allows authenticated users, including those with limited permissions such as Subscribers, to access sensitive account data stored within the plugin. This issue arises due to a lack of proper capability checks befor...

The String Locator plugin for WordPress prior to version 2.6.8 is vulnerable due to insufficient restrictions on classes allowed during deserialization of database content. This flaw enables unauthenticated attackers to store serialized PHP objects within database rows through the plugin's databa...