Publicly Disclosed
PoC Exploits

A significant vulnerability in Ivanti Connect Secure version 22.8R2.4 allows attackers to exploit issues in the way DSCache configuration data is handled by the dsinvoked broker. This flaw can lead to unauthorized privilege escalation to root level. Exploits for this vulnerability have already be...

MaxKB, an open-source AI assistant designed for enterprise use, is susceptible to a command injection vulnerability in versions prior to 2.10.5-lts. This flaw arises from the misuse of the SandboxShellBackend, which improperly exposes an execute shell tool and neglects to implement necessary secu...

LightLLM version 1.2.0 presents a denial of service vulnerability that enables unauthenticated attackers to disrupt the inference worker. By sending a carefully crafted request to the /generate endpoint that includes the internal pd_kv_trans_params field, an attacker can trigger a failure in the ...

The libewf product by libyal contains a vulnerability that allows attackers to exploit a heap out-of-bounds read condition in the function libewf_lef_extended_attribute_read_data(). This issue arises due to improper validation of UTF-16 name and value sizes prior to being doubled. By crafting a m...

SoX versions up to 14.4.2 are susceptible to a heap out-of-bounds write vulnerability located in the function lsx_ms_adpcm_block_expand_i() within the file src/adpcm.c. This issue arises from the processing of WAV files with an anomalous samplesPerBlock value in the fmt chunk. Attackers can explo...

EarthScope libmseed versions up to 3.5.4 are vulnerable to a heap out-of-bounds read issue in the ms3_detect() function located in parseutils.c. Exploitation of this vulnerability allows attackers to supply a buffer of 40 to 47 bytes, potentially leading to an over-read of up to 8 bytes beyond th...

libTiMidity versions up to 0.2.8 contain a vulnerability in the init_soundfont() function, located in src/sndfont.c, which can lead to out-of-bounds memory access. This allows attackers to exploit unvalidated SF2 preset header bank and preset values. By crafting a malicious .sf2 file with indexes...

Game Music Emu (libgme) versions prior to 0.6.5 are prone to a global out-of-bounds read vulnerability within the Classic_Emu::mute_voices_ method. This flaw enables attackers to induce application crashes by supplying crafted NSF files with a voice count exceeding the predefined 16-entry voice-t...

OpenJPH, up to version 0.32.0, features a vulnerability in the HTJ2K cleanup-pass decoder that permits an attacker to execute a heap out-of-bounds write. This is achievable by supplying a specially crafted .j2c or .jph codestream with small precinct sizes, leading to memory corruption as the deco...

The libvgm library developed by ValleyBell exhibits a heap out-of-bounds read vulnerability within its PCM data-block decompressor. An attacker can exploit this flaw by crafting a specially designed .vgm file that utilizes a type 0x7F table containing wider compressed values. This manipulation le...

A heap out-of-bounds read vulnerability exists in FreeImage (danoli3 fork) versions up to 3.19.23 within the Unpack32Bits() function of the PluginPICT.cpp file. This issue arises because the rowBytes parameter is not validated against the PixMap width, allowing attackers to craft PICT files with ...

The libsidplayfp library is vulnerable to a heap out-of-bounds read, allowing attackers to manipulate PSID/RSID files by supplying unchecked data offsets. This vulnerability permits attackers to exceed the file size limitations, which enables the resolveAddrs() function to attempt reading up to 6...

Libyal Libesedb through version 20260704 is affected by a heap out-of-bounds read vulnerability within the function libesedb_record_get_multi_value(). This issue allows attackers to read past allocated buffers by exploiting unbounded multi-value offset tables. By supplying a specially crafted ESE...

The ytnef library version 2.1.2 and earlier contains a heap out-of-bounds read vulnerability within the MAPIPrint() function. Attackers can exploit this vulnerability by providing specially crafted winmail.dat files that contain compressed RTF properties lacking a NUL terminator. This can lead to...

The libansilove library versions 1.3.0 through 1.4.2 exhibit a NULL pointer dereference vulnerability within the ansilove_xbin() function. This issue arises when an attacker supplies a specially crafted XBIN file, which can lead to application crashes. Specifically, if the 512-character flag is s...

The libregf library through version 20260526 is susceptible to a heap out-of-bounds read due to improper handling of value data sizes in its function libregf_value_item_read_value_data(). An attacker can create a malicious version 1.0/1.1 REGF hive that, when processed, can lead to the exposure o...

The libnsbmp library, used by the NetSurf browser, contains an out-of-bounds read vulnerability in the bmp_decode_mask() function. By supplying a specially crafted ICO file with a bitmap width that is not a multiple of 8, attackers can exploit this flaw to read one byte past the image buffer. Thi...

The libsmi library, up to version 0.5.0, contains a critical out-of-bounds write vulnerability in the smiValueAsString() function located in lib/smi.c. This flaw allows attackers to exploit a fixed 1024-byte buffer. By supplying a maliciously crafted Management Information Base (MIB) that include...

CFITSIO versions through 4.7.0 contain a vulnerability that allows for a heap-based out-of-bounds read via the HCOMPRESS tile decoder. By crafting a specially designed FITS file that declares oversized tile geometry, an attacker may exploit this flaw through the input_nnybble function in fits_hde...

AdPlug, through version 2.4, is affected by a heap out-of-bounds read vulnerability in the CdmoLoader::load() function located in src/dmo.cpp. This issue occurs when attackers exploit a vulnerability that allows reading beyond allocated memory by supplying a truncated TwinTeam DMO file. Specifica...

Aureus ERP version up to 1.6.0 is susceptible to a stored cross-site scripting vulnerability. This issue arises due to the lack of proper input validation, allowing authenticated users to inject malicious scripts through unescaped input fields for Operation Type and Location names. When warehouse...

The SimplePie library, up to version 1.9.0, is vulnerable to a local file read attack. This occurs when malicious feed servers can exploit the library's handling of file redirects or autodiscovery links using file:// URLs. By manipulating the Location header or feed link to point to a file path, ...

A reflected cross-site scripting vulnerability exists in the pfSense CE web interface, specifically within the firewall_rules.php script. This vulnerability enables remote attackers to execute arbitrary scripts by enticing users with elevated firewall rules privileges to click on a specially craf...

Netgate pfSense CE versions 2.3.0 through 2.9.0 are susceptible to a stored cross-site scripting (XSS) vulnerability. This issue allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject malicious scripts via the separator color field in the WebGUI. Attackers explo...

Netgate pfSense CE through version 2.9.0 is susceptible to an authorization bypass that enables read-only WebGUI users to manipulate the config.xml file. This occurs due to the negligence of 'User - Config: Deny Config Write' privilege within the config_restore() and config_install() functions. I...

A command injection vulnerability exists in pfSense CE versions 2.7.0 through 2.9.0, impacting the Captive Portal functionality. Users with the Captive Portal HA privilege can exploit this flaw to execute arbitrary commands with root privileges. This vulnerability arises when an attacker manipula...

The pfSense CE version up to 2.9.0 is susceptible to a local file read vulnerability due to improper handling of Dynamic DNS client privileges. By setting a malicious file:// custom Update URL in the services_dyndns_edit.php, attackers can manipulate the logging mechanism to read sensitive files ...

Netgate pfSense CE versions 2.7.1 to 2.9.0 are affected by a CRLF injection vulnerability located in services_unbound_advanced.php. Authenticated users with DNS Resolver: Advanced privileges can exploit this flaw by injecting CR/LF characters into the unvalidated sock_queue_timeout parameter. Thi...

Netgate pfSense CE versions up to 2.9.0 are vulnerable to a CRLF injection flaw, which impacts the services_unbound_acls.php file. Authenticated users with the 'DNS Resolver: Access Lists' privilege can exploit this vulnerability. By injecting carriage return and line feed (CR/LF) characters into...

The OS command injection vulnerability in pfSense CE versions 2.4.5 through 2.9.0 allows users with Advanced Admin Access to execute arbitrary commands as root. By manipulating settings within the Login Protection configuration, specifically the sshguard thresholds (such as block time or detectio...

An OS command injection flaw exists in Netgate pfSense CE versions 2.5.0 through 2.9.0 within the openvpn.learn-address.sh script. This vulnerability can be exploited by authenticated VPN clients, who can inject shell metacharacters into their certificate common name or username. If DNS Resolver ...

The pfSense CE platform, specifically version 2.9.0, is vulnerable to OS command injection through the OpenVPN script. Authenticated users, particularly those utilizing RADIUS or LDAP for authentication, can exploit this vulnerability by crafting usernames that include single quotes and shell met...

Netgate pfSense CE versions 2.7.0 through 2.9.0 are impacted by a configuration injection vulnerability. This issue arises when authenticated users with IPsec Mobile privileges can manipulate the login_banner field to execute commands with root privileges. By inserting a crafted single-line banne...

Netgate pfSense CE versions up to 2.9.0 are susceptible to a php.ini injection vulnerability, which allows authenticated users with General Setup privileges to manipulate settings by submitting unvalidated timezone values. This vulnerability can enable attackers to inject directives like `auto_pr...

Netgate pfSense CE, up to version 2.9.0, is vulnerable to a configuration injection flaw that enables authenticated WebGUI users to inject mpd5 commands. This vulnerability arises when an attacker with edit privileges for L2TP or PPPoE Server submits an unescaped RADIUS shared secret containing q...

The pfSense CE software, through version 2.9.0, is vulnerable to a crontab injection attack via the interfaces_ppps_edit.php script. This vulnerability allows authenticated users, particularly those with 'WebCfg - Interfaces: PPPs: Edit' privileges, to manipulate command execution as root. By inj...

Netgate pfSense CE through version 2.9.0 is affected by a newline injection vulnerability present in the services_pppoe_edit.php script. This flaw enables attackers with the necessary PPPoE Server Edit permissions to insert malicious mpd.secret entries. By crafting unvalidated username POST field...

Netgate pfSense CE versions 2.7.0 through 2.9.0 are susceptible to an OS command injection flaw that can be exploited by authenticated users who have Traffic Shaper Limiters privileges. This vulnerability allows attackers to execute root commands by manipulating the limiter number field. Specific...

Netgate pfSense CE, through version 2.9.0, is vulnerable to an OS command injection that can be exploited by authenticated users with Virtual IP edit privileges. This vulnerability arises from improper validation of the CARP Virtual Host Identifier (VHID). Attackers can manipulate the VHID to inc...

Netgate pfSense CE versions up to 2.9.0 contain a vulnerability that allows authenticated users with gateway edit permissions to perform OS command injection. This vulnerability arises when shell metacharacters are injected into an IPv6 link-local zone index. Attackers can exploit this flaw by se...

The Netgate pfSense CE software, up to version 2.9.0, is subject to an OS command injection vulnerability that facilitates the execution of arbitrary commands by authenticated users with limited privileges. By inputting crafted values, such as ath0;<cmd>, through the interfaces_wireless_edit.php ...

Netgate pfSense CE versions 2.7.0 to 2.9.0 are susceptible to an OS command injection vulnerability. Authenticated users with QinQ edit privileges have the potential to execute arbitrary commands. This is achievable through the manipulation of an unvalidated parent interface name, where an attack...

The Netgate pfSense CE software, up to version 2.9.0, is subject to an OS command injection vulnerability that facilitates the execution of arbitrary commands by authenticated users with limited privileges. By inputting crafted values, such as ath0;<cmd>, through the interfaces_wireless_edit.php ...

A vulnerability in IBM webMethods Integration products allows unauthenticated remote attackers to execute arbitrary code on the system through the deserialization of untrusted data. This can lead to significant risks, making it critical for organizations using affected versions to apply security ...

In DragonFly BSD versions up to 6.4.2, an existing vulnerability in the ARP input handling functions allows an unauthenticated attacker on the adjacent network to craft ARP requests with fabricated hardware and protocol address lengths. This exploitation results in memory access violations, enabl...

An expression language injection vulnerability exists in Apache Struts that enables attackers to craft specific requests to inject OGNL expressions, potentially leading to remote code execution. This primarily affects applications using the legacy RESTful action mapper when the OGNL allowlist is ...

A heap-based buffer overflow vulnerability exists in the Wavlink WN530HG4B due to improper handling in the api.cgi file. This flaw allows attackers to execute remote exploits. The issue can be mitigated by updating the firmware to the latest version, which resolves the vulnerability by eliminatin...

A vulnerability exists in the Wavlink WL-WN530BE2-A's login processing component, specifically in the api.cgi file's function sub_12580. This flaw allows attackers to manipulate the REMOTE_ADDR argument, leading to remote command injection vulnerabilities. This can potentially compromise the affe...

An information disclosure vulnerability exists in the Copilot Chat feature of Microsoft Edge due to improper neutralization of special elements in output, allowing unauthorized attackers to potentially disclose sensitive information over a network.

A flaw in the certificate validation process has been identified, allowing malicious applications to potentially bypass signature validation checks. This vulnerability affects various versions of iOS prior to 16.7, as well as macOS Ventura 13.6 and iPadOS before version 16.7. Apple has addressed ...