Publicly Disclosed
PoC Exploits

Certain versions of JFrog Artifactory (Self Hosted) are at risk of a privilege escalation vulnerability due to inadequate validation of token signatures and issuers. This weakness allows an attacker to exploit improper token validation, potentially leading to unauthorized access and elevated priv...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

The out-of-bounds read vulnerability in Windows Paint enables unauthorized attackers to potentially execute arbitrary code within a network context. This flaw could allow malicious entities to manipulate the application, leading to unauthorized actions being performed on affected systems. Users a...

The Userplace plugin for WordPress versions up to 1.2.0 contains a significant security issue where authorization checks are not enforced on specific AJAX actions. This flaw allows unauthenticated users to exploit the exposed nonce, enabling them to create an administrator account or manipulate s...

The Sync Post With Other Site plugin for WordPress prior to version 1.9.4 is susceptible to an improper authorization vulnerability. This flaw permits users with Contributor-level access or higher to create and modify arbitrary custom post types. Consequently, it poses risks including potential u...

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin allows unauthenticated attackers to exploit a security flaw by failing to properly verify the authenticity of incoming bank transfer payment notifications. This can lead to unauthorized marking of WooCommerce orders as paid, potentially resu...

The Productive Commerce WordPress plugin, prior to version 1.1.54, contains a flaw where it fails to properly sanitize and escape user-supplied parameters in SQL statements. This oversight exposes the plugin to unauthorized SQL injection attacks, enabling attackers to manipulate database queries ...

The Razorpay for WooCommerce plugin for WordPress prior to version 4.8.9 is susceptible to SQL injection due to inadequate sanitization and escaping of values received from webhook requests. This vulnerability can potentially allow users with access to the webhook secret, specifically administrat...

The Ecommerce Affiliate WordPress plugin, up to version 1.0.0, contains a significant security flaw that allows attackers to issue and verify one-time passwords without proper authentication. This vulnerability permits unauthorized individuals to potentially seize control of any user account, inc...

The Turisbook Booking System plugin for WordPress, up to version 1.3.8, is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate authorization and Cross-Site Request Forgery (CSRF) checks. This oversight allows attackers to inject malicious scripts through unsanitized outpu...

The BackUpWordPress plugin, prior to version 3.15, is vulnerable due to a lack of necessary capability or nonce checks on specific AJAX actions. As a result, any authenticated user with a minimum role of Subscriber can exploit this weakness to delete crucial backup protection files and disrupt on...

The Contact Form 7 plugin for WordPress versions prior to 6.2.4 has a critical flaw in its handling of file uploads. It fails to properly validate the type or extension of files uploaded through form fields. Furthermore, inadequate temporary file clean-up protocol leaves uploaded files on the ser...

The Razorpay for WooCommerce plugin for WordPress, prior to version 4.8.9, has a significant security flaw that allows unauthorized users to bypass authorization checks on specific REST routes. This vulnerability enables attackers to exploit the plugin by executing requests as different user acco...

The Razorpay for WooCommerce WordPress plugin versions preceding 4.8.9 is susceptible to an improper order verification issue. This vulnerability allows unauthenticated individuals to exploit the system by retrieving discount values linked to arbitrary customer orders without sufficient authoriza...

The Pie Register WordPress plugin, up to version 3.8.4.15, lacks proper authorization checks in one of its AJAX actions. This oversight allows users with minimal privileges, such as contributors, the ability to alter administrator-created invitation code records. This vulnerability poses a signif...

The Secure Custom Fields plugin for WordPress, prior to version 6.9.8, contains a flaw that allows users with contributor-level access and above to bypass restrictions and create custom fields typically reserved for administrators. This happens because the plugin fails to re-apply its field-group...

The Secure Custom Fields plugin for WordPress prior to version 6.9.8 is vulnerable to JavaScript injection attacks. This vulnerability arises from the failure to properly sanitize persisted field definitions, allowing users with configuration permissions to inject malicious scripts as HTML attrib...

The Antom Payments WordPress plugin, specifically version 2.0.11, lacks essential authorization checks when providing confirmation links for customer orders. This oversight permits unauthenticated users to access sensitive information such as customer names, addresses, phone numbers, and email ad...

The Secure Custom Fields plugin for WordPress versions prior to 6.9.8 fails to properly validate user permissions for editing target objects during bidirectional relationship synchronization. This weakness allows users with contributor-level access or higher to manipulate object references on pos...

The Pie Register plugin for WordPress (versions up to 3.8.4.15) is vulnerable to an unauthenticated access flaw due to its failure to validate capabilities, nonce, or authentication on certain request handlers. This weakness enables attackers to modify the plugin settings, effectively resetting t...

The Secure Custom Fields plugin for WordPress lacks proper read-permission checks when displaying relational field values. This vulnerability allows users with post-editing capabilities, such as Contributors and above, to gain access to unpublished posts' titles and non-public statuses created by...

The WP Recipe Maker plugin for WordPress prior to version 10.9.2 contains a vulnerability that allows unauthorized users to access the complete content of recipes embedded in password-protected posts. This occurs due to the plugin's failure to verify whether the post containing the recipe is secu...

The Event Tickets Manager for WooCommerce plugin prior to version 1.6.0 lacks proper authorization checks and nonce validations on its ticket-transfer functionality. This flaw permits unauthenticated users to transfer tickets meant for legitimate attendees to any email address of their choice. Co...

The FV Flowplayer Video Player plugin for WordPress is vulnerable due to a lack of authorization checks on specific AJAX actions. This flaw enables authenticated users, regardless of their role, to execute a site-wide content rewrite. As a result, even users with minimal permissions can modify po...

The Pronamic Pay WordPress plugin and its Mollie extension prior to their respective versions are vulnerable to unauthorized access. This issue stems from insufficient restrictions on stored form submissions accessible via the REST API. As a result, unauthenticated users may exploit this weakness...

The DBCPConnectionPool and HikariCPConnectionPool services in Apache NiFi versions 0.0.2 through 1.21.0 are susceptible to a vulnerability that allows an authenticated and authorized user to configure a Database URL leveraging the H2 driver, leading to potential execution of custom code. The reco...

A security flaw in certain versions of SaltStack's Salt product allows remote users to bypass authentication for method calls. This weakness stems from improper validation in the salt-master process's ClearFuncs class, enabling attackers to execute commands on salt minions or retrieve sensitive u...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

The Contact Form 7 plugin prior to version 5.3.2 for WordPress is susceptible to an unrestricted file upload vulnerability. This issue arises from improper handling of filenames that may contain special characters, potentially allowing attackers to upload malicious files. If successfully exploite...

The TOTOLINK CA300-PoE 6.2c.884 is susceptible to a buffer overflow vulnerability in the UploadCustomModule function located in the cgi-bin/cstecgi.cgi file. An attacker can exploit this issue by manipulating the File argument, potentially allowing for remote execution of arbitrary code. Given th...

A security vulnerability has been identified in the TOTOLINK CA300-PoE device related to the function setWiFiWdsAddConfig located in /cgi-bin/cstecgi.cgi. This vulnerability arises from inadequate input validation in the ApCliKeyStr argument, enabling a potential buffer overflow exploit. This fla...

A buffer overflow vulnerability exists in the 'setWiFiRepeaterConfig' function of the TOTOLINK CA300-PoE firmware version 6.2c.884. An adversary could exploit this flaw by manipulating the 'ApCliKeyStr' argument, potentially leading to unauthorized access or control over the device. This issue is...

A significant security flaw has been identified in the TOTOLINK CA300-PoE device affected by a buffer overflow in the setWiFiMultipleConfig function located within /cgi-bin/cstecgi.cgi. This vulnerability allows an attacker to manipulate the Key1Str1 argument, potentially leading to unauthorized ...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability in the SililaWijesinghe Food Ordering System allows for unauthorized exposure of sensitive information through directory listing. This issue arises from improper processing of files within the admin directory, enabling attackers to potentially access data remotely. The lack of ver...

A vulnerability exists in the Tenda AC19 router, specifically in the function saveParentControlInfo located in the /goform/saveParentControlInfo file. This vulnerability arises from improper handling of the deviceId argument, leading to a potential heap-based buffer overflow. The issue allows for...

A vulnerability has been identified in the OpenBMB Internet of Agents, specifically within the collaboration layer's launch_goal function. An attacker can manipulate the max_turns argument in communication_layer.py, leading to an infinite loop state. This issue can be exploited remotely, posing a...

A significant security vulnerability exists in OpenBMB Internet of Agents prior to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a, affecting the Agent Registry component specifically within the function register in im_server/app.py. This vulnerability arises due to inadequate authentication mech...

A security flaw has been identified in the TOTOLINK CA300-PoE, specifically affecting the setWiFiBasicConfig function located in the /cgi-bin/cstecgi.cgi file. This vulnerability arises from improper handling of the KeyStr argument, allowing for a buffer overflow condition. An attacker may exploi...

A vulnerability has been discovered in the TOTOLINK CA300-PoE device version 6.2c.884 related to the setWanConfig function in the cgi-bin/cstecgi.cgi file. This weakness arises from improper handling of the pppoeUser, priDns, and secDns arguments, potentially leading to a buffer overflow. The fla...

A significant security flaw has been identified in the TOTOLINK CA300-PoE product, specifically within the function setLanguageCfg located in /cgi-bin/cstecgi.cgi. This vulnerability occurs when an attacker manipulates the langType argument, resulting in a buffer overflow that can be exploited re...

The vulnerability in iTerm2 affects versions prior to 3.7.7beta2 and is characterized by an argument injection flaw in the x-man-page URL handler. An attacker can exploit this vulnerability by convincing a user to open a specially crafted URL, which allows the execution of arbitrary commands usin...

A vulnerability exists in the TOTOLINK CA300-PoE 6.2c.884 router that affects the setLanConfig function within the /cgi-bin/cstecgi.cgi file. By manipulating the parameters lanDns, lanSecDns, and langType, an attacker can trigger a buffer overflow. This can potentially allow for remote exploitati...

A buffer overflow vulnerability exists in the TOTOLINK CA300-PoE, specifically within the setIpQosRules function in the /cgi-bin/cstecgi.cgi file. This vulnerability is triggered by manipulating the ipStart argument, which allows attackers to remotely exploit the device. The exploit has been made...

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Conseque...

A vulnerability exists in OpenBMB Internet of Agents that affects the fetch_chat_record function within the Message Handler component. This issue allows for improper access control when manipulating the comm_id argument, enabling potential unauthorized access. The vulnerability can be exploited r...

The iLeads SMS Gateway plugin for WordPress, prior to version 2.0.0, contains a vulnerability due to insufficient validation for AJAX actions that update site options. This oversight allows any authenticated user, including subscribers, to manipulate WordPress settings without appropriate permiss...

The Event Tickets with Ticket Scanner WordPress plugin fails to adequately escape user input when executing SQL queries in its admin interface. This flaw permits authenticated users—typically admins or those granted specific permissions—to conduct SQL injection attacks, potentially leading to una...

The Komfortkasse for WooCommerce plugin prior to version 1.4.9 is susceptible to an authentication bypass flaw. This vulnerability allows attackers to forge REST API requests without proper nonce verification, effectively bypassing WordPress's standard security measures. Consequently, a malicious...

The Fiber Admin plugin for WordPress prior to version 4.0.1 is susceptible to an authorization bypass vulnerability. This flaw allows unauthenticated users to manipulate the ordering of posts, including drafts and private content, as well as navigation menu items. Furthermore, if term ordering is...