Publicly Disclosed
PoC Exploits

A vulnerability exists in the SourceCodester Performance Indicator System 1.0, specifically in the sales_history.php file. Manipulation of the argument ID can lead to SQL injection, allowing attackers to remotely exploit the system. This risk has been made public, increasing the potential for mal...

A security flaw has been identified in the SourceCodester Performance Indicator System 1.0, specifically within an unspecified function in the file /opils/staff/edit_credit.php. This vulnerability allows for SQL injection through manipulation of the 'credit' argument. The exploit can be executed ...

A security flaw has been identified in SourceCodester's Performance Indicator System 1.0, specifically within the processing of the file /opils/staff/product.php. This vulnerability arises when the input category is manipulated, thereby allowing an attacker to execute SQL injection attacks remote...

A vulnerability exists in the Performance Indicator System 1.0 developed by SourceCodester, specifically within the /opils/staff/edit_quantity.php file. An attacker can exploit this vulnerability through improper handling of the 'pqty' argument, leading to SQL injection. This remote exploitation ...

A security vulnerability exists in the SourceCodester Performance Indicator System version 1.0, specifically within the /opils/admin/addproduct.php file. The issue arises from improper handling of input parameters, allowing SQL injection attacks to be executed remotely. As a result, an attacker c...

A vulnerability exists in the Tiiny-AI PowerInfer's FFN GPU-split Loader within the create_striped_mat_to_gpu function, located in the ggml-cuda.cu file. This flaw leads to out-of-bounds read conditions that could be exploited locally. Attackers can leverage this vulnerability, which is already p...

A vulnerability has been discovered in the itsourcecode Online Cake Ordering System version 1.0, specifically affecting an unspecified function within the 'addtransacdetail.php' file. This flaw arises from improper handling of the ID argument, leading to potential SQL injection attacks. Exploitin...

A vulnerability has been discovered in TensorLayer, impacting versions up to 2.2.4. This issue is present in the load_hdf5_graph function of the utils.py file, specifically relating to HDF5 Loading. By manipulating the model_config argument, an attacker can perform remote deserialization attacks....

A security flaw has been identified in the TinyLLaVA_Factory product, specifically within the _load_text_config function located in the configuration_tinyllava.py file. This vulnerability allows an attacker to manipulate the 'llm_model_name_or_path' argument leading to potential code injection. I...

A SQL injection vulnerability has been identified in the Online Reviewer System 1.0 from Code-Projects. The affected component, User Update Handler, contains an unknown function located in the file /reviewer/system/system/admins/manage/users/btn_functions.php. This vulnerability could allow remot...

A vulnerability exists in Tiiny-AI PowerInfer, particularly in the GGUF Parser component's gguf_init_from_file function. This flaw results from improper handling of the data_offset argument, which can lead to an out-of-bounds read scenario. Attackers with local access could potentially exploit th...

A buffer overflow vulnerability exists in the Offline Transducer Greedy Search Decoder of k2-fsa Sherpa ONNX up to version 1.13.8. It occurs due to the manipulation of the vocab_size argument within the Decode function. An attacker can exploit this vulnerability remotely by providing malformed or...

A vulnerability exists within the Online Reviewer System's User Profile Update Handler that allows for manipulation of the usertype_id argument. This manipulation can lead to dynamically-determined object attributes, enabling an attacker to exploit the system remotely. The vulnerability has been ...

A vulnerability has been identified in the Yoshitomo Matsubara Torchdistill library, specifically within the load_ckpt function located in torchdistill/common/main_util.py. This flaw allows an attacker to manipulate the src_ckpt argument, leading to potential insecure deserialization. Although th...

A vulnerability in the Matrimonial System version 1.0 by Code-Projects has been identified, affecting the processing of the db/matrimony.sql file. This flaw allows unauthorized access to certain files and directories, potentially enabling remote attackers to exploit the issue. The exploit has bee...

A use after free vulnerability exists in the PDF processing component of Google Chrome, allowing remote attackers to execute arbitrary code within the browser's sandbox environment through specially crafted HTML content. This flaw affects Google Chrome versions released prior to 153.0.8010.47, hi...

A vulnerability has been identified in the Online Ticket Reservation System, specifically in the code handling the medallion.sql database file. Attackers can exploit this weakness to gain unauthorized access to sensitive file and directory information, potentially leading to the exposure of confi...

A Pre-authentication Server-Side Request Forgery (SSRF) vulnerability has been identified in the SonicWall SMA1000 Appliance's Work Place interface. This issue arises from an unintended alternate access path that could be exploited by a remote unauthenticated attacker. By manipulating this path, ...

A security vulnerability in the Edimax BR-6208AC router has been identified, particularly affecting the QoS Page component located at /goform/formQoS. This vulnerability allows attackers to execute cross site scripting (XSS) attacks remotely, potentially compromising user data and system integrit...

A vulnerability exists in the Edimax BR-6208AC router, specifically in the Port Forwarding Page functionality found in the /goform/formPortFw file. This weakness allows for cross-site scripting attacks, which can be initiated remotely. The exploit has been publicly disclosed and has the potential...

A security flaw in the Edimax BR-6208AC version 1.32 exposes users to cross-site scripting attacks through a vulnerability in the HTTP Blocking Page functionality. This misconfiguration allows attackers to exploit a specific input in the file /goform/formUrlb, enabling them to inject malicious sc...

A vulnerability exists in the Edimax BR-6208AC router affecting version 1.32. The flaw resides in the /goform/formFilter file, resulting in cross site scripting (XSS) that can be exploited remotely. Attackers may leverage this vulnerability to inject harmful scripts through web interfaces. Despit...

A vulnerability has been identified in Netcore NR268 version 1.7.121109, specifically in the function eval of the dhcp_dynamicip_show.cgi file within the DHCP Handler component. This flaw allows an attacker to manipulate the Hostname argument, leading to cross site scripting attacks that can be e...

The Fire-Boltt BSW013 smartwatch firmware version V0.0.8 has a missing authentication vulnerability that allows unauthorized Bluetooth devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). This flaw enables attackers within Bluetooth range to intercept the user's live heart ...

A security vulnerability has been identified in itsourcecode's Online Admission System version 1.0, specifically in the file /admin/sum.php. This vulnerability allows an attacker to manipulate the ID argument, potentially leading to unauthorized SQL queries being executed. The exploit can be cond...

A security weakness has been detected in the itsourcecode Baptism Information Management System 1.0, particularly within the pbaptism.php file. This vulnerability allows for SQL injection attacks through manipulation of the b_id argument, potentially enabling remote exploitation. As the exploit d...

Tink-go through version 2.8.0 contains an input-validation vulnerability that allows attackers to bypass structural validation checks when creating a keyset handle. Specifically, methods like keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the crucial Validate() step, thereby permitt...

A security flaw has been identified in the itsourcecode Baptism Information Management System version 1.0, specifically affecting the file ebaptism.php. This vulnerability arises from improper handling of the argument ID, allowing remote attackers to execute SQL injection attacks. Exploiting this...

A security issue has been identified in 1024-lab smart-admin, specifically within the Support Config Query component. The vulnerability arises from improper access controls related to the manipulation of the 'configKey' argument in the /support/config/queryByKey file. This flaw can be exploited r...

A security flaw exists in the KusalkaSilva Learning-Management-System, specifically within the getimagesize function of the upload_save.php file. This flaw enables attackers to manipulate the uploaded_file/image argument, facilitating unrestricted file uploads. As the system operates on a rolling...

A security vulnerability has been discovered in KusalkaSilva Learning-Management System that affects the mysql_query function within the remove_announcements.php file. This vulnerability is due to inadequate authentication mechanisms, allowing attackers to manipulate the ID argument and perform u...

A command injection vulnerability exists in the Edimax BR-6208AC router, specifically within the handling of the readE2P argument in the '/goform/formWlanMP' file. This flaw can be exploited remotely, allowing attackers to inject and execute arbitrary commands on the device. The exploit is curren...

A command injection vulnerability exists in the Edimax BR-6208AC router, specifically affecting version 1.32. This issue arises from improper processing of the /goform/formAutoFWupgrade file, where manipulation of the 'tftpsIP' argument can be exploited remotely. Despite the vulnerability being p...

A command injection vulnerability exists in the Edimax BR-6208AC router version 1.32, specifically related to the /goform/formAccept file. By manipulating the submit-url argument, an attacker can execute arbitrary commands remotely. This risk is exacerbated by the fact that the affected product i...

A vulnerability has been identified in the Edimax BR-6208AC router running firmware version 1.32, which exposes an exploit related to an unchecked argument in the /goform/formWlanMP file. This buffer overflow can be triggered remotely, placing devices at risk of unauthorized access and manipulati...

A buffer overflow vulnerability exists in the Edimax BR-6208AC router version 1.32, affecting the functionality within the /goform/formWlSiteSurvey file. This flaw can be exploited by manipulating the 'ifname' argument, allowing remote attackers to execute arbitrary code, potentially impacting de...

A cross-site scripting vulnerability has been identified in the Netcore NR268 Web UI, specifically within the eval function located in /router/l7_call_board_user_set.cgi. The vulnerability allows remote attackers to manipulate the arguments such as title, note, URL, or content. This exploitation ...

A significant security flaw has been identified in the Netcore NR268 router version 1.7.121109. The vulnerability arises within the 'user_ok' function of the CGI Execution component, allowing for incorrect user authentication. This flaw enables attackers to initiate remote exploits, potentially c...

An out-of-bounds read vulnerability has been identified in the Netcore NR268 Router due to improper handling of arguments in the filter_arp_put_file_cgi function. This flaw can be exploited remotely, allowing an attacker to read memory regions without authorization through crafted requests. The a...

A vulnerability exists in Shenzhen HCC Technology's MPOS M6 PLUS related to the functionality of the Display QR Code Rendering component. This issue arises from improper restriction of rendered user interface layers when manipulating the argument alignment. The vulnerability could be exploited by...

A serious SQL injection vulnerability exists in Exponent CMS versions up to 3.0.2patch2, specifically within the userLogin function found in the xmlrpc.php file of the XML-RPC component. This flaw enables attackers to manipulate SQL queries, potentially compromising the database remotely. The vul...

Pimcore versions up to 2026.3.1 are susceptible to a stored cross-site scripting (XSS) vulnerability. Authenticated backend users with data object edit permissions can exploit the ExternalImage fields by injecting unescaped URLs containing malicious scripts. This occurs when these scripts are ren...

The vulnerability in Square Squash arises from an insecure deserialization mechanism, allowing unauthenticated users to manipulate the application. Specifically, the vulnerability exists within the '/api/1.0/symbolication' endpoint, where attackers can send crafted YAML data. This data, when link...

A vulnerability exists in TobyChui Zoraxy versions up to 3.3.4, specifically within the handleBasicAuth function of the Path Exception Matcher component. This flaw allows for improper authorization due to manipulation of the PathPrefix argument. Importantly, this vulnerability is exploitable remo...

A flaw exists in the SHAREit App version 6.27.38_ww for Android, specifically within the syncInvoke function of the WebView JS Bridge component. This vulnerability allows attackers to remotely execute malicious routines, potentially compromising user data and device integrity. Despite notificatio...

A critical security flaw exists in the Linksys E1700 router that allows an attacker to execute arbitrary commands on the operating system. This vulnerability arises from improper handling of user-supplied input in the setLinksysIpv6 function of the router's web interface. By manipulating the _6rd...

A significant weakness has been detected in the Linksys E1700 version 1.0.0.4.003, specifically affecting the setDMZ function in the /goform/setDMZ file. This vulnerability allows for the manipulation of the MAC_addr argument, leading to the potential execution of OS commands. The exploit is remo...

A security flaw in Linksys E1700 version 1.0.0.4.003 has been identified, impacting the functionality of the static route handler. Specifically, vulnerabilities exist in the addStaticRoute function located in /goform/addStaticRoute, allowing attackers to manipulate arguments related to static rou...

A stack-based buffer overflow vulnerability exists in the Linksys E1700 router within the setVlan function of the /goform/setVlan file. This flaw allows an attacker to manipulate the vlan_set argument, potentially leading to remote code execution. Public exploits for this vulnerability are availa...

The Linksys E1700 router version 1.0.0.4.003 is susceptible to a stack-based buffer overflow in the ssid1MACFilter function. This vulnerability arises from improper handling of user input in the newap_text_%d parameter, which can be exploited remotely. Attackers can leverage this flaw to inject m...