Publicly Disclosed
PoC Exploits

The PublishPress Revisions plugin prior to version 4.3.1 is susceptible to an access control flaw that allows users with contributor-level or higher permissions to duplicate posts that they do not own. This vulnerability permits unauthorized access to private, draft, pending, or scheduled posts, ...

The PublishPress Revisions plugin for WordPress, prior to version 4.3.1, contains a vulnerability that allows users with limited editing capabilities, such as Contributors, to publish content without proper oversight. This flaw bypasses the established editorial approval process, enabling unrevie...

The PublishPress Revisions plugin for WordPress, specifically versions before 4.3.1, exhibits a significant flaw where it fails to adequately verify user permissions for accessing post content. This oversight permits any authenticated user, including those with minimal roles such as Subscribers, ...

The Mailchimp for WordPress plugin prior to version 4.15.0 has a security flaw where it fails to properly validate the Mailchimp audience associated with email sign-up forms. This oversight permits unauthenticated individuals to subscribe any email address to audiences in the connected Mailchimp ...

The AutomatorWP plugin for WordPress prior to version 6.0.7 contains a significant access control flaw. This vulnerability enables unauthenticated attackers to exploit the plugin’s Zoom and AWeber integration functionalities by replacing the authenticated user's stored credentials with their own....

A vulnerability in the CleanTalk Anti-Spam WordPress plugin prior to version 6.91 allows unauthenticated users to exploit the application by injecting arbitrary web scripts. The plugin fails to adequately escape user input on the administrative spam-review screen, potentially leading to the execu...

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon for WordPress, prior to version 2.4.4, contains a security vulnerability in its AJAX actions. This flaw arises from inadequate validation of user capabilities and the ownership of targeted posts. Specifically, it fails to ensure that users...

The Advanced Custom Fields (ACF) WordPress plugin prior to version 6.8.11 is susceptible to a cross-site scripting (XSS) vulnerability. This occurs due to inadequate sanitization of stored field definitions that can be manipulated via comment handling. Consequently, unauthenticated users are capa...

The GS JWT Authentication for WP REST API WordPress plugin, versions up to 1.0.0, is susceptible to SQL injection due to insufficient sanitization and parameterization of request values within several unauthenticated REST routes. This flaw permits unauthenticated attackers to craft malicious quer...

The iubenda plugin for WordPress versions prior to 3.13.7 contains a security flaw that fails to properly sanitize user input in its integrated HTML parser. This vulnerability enables unauthorized users to inject malicious scripts into web pages, which can be executed in the browser sessions of a...

The Cool Media Filter WordPress plugin, up to version 1.0.1, lacks proper capability and nonce verification when updating user roles. This allows any authenticated user, including those with lesser privileges, to escalate their permissions and assume administrative roles, potentially leading to f...

The All-in-One Video Gallery plugin for WordPress prior to version 5.1.0 has an improper input validation flaw that allows unauthenticated users to manipulate the metadata related to view count and video duration for any post. This vulnerability enables attackers to modify even private or draft p...

The Surfer WordPress plugin prior to version 1.8.1.759 contains a vulnerability that inadvertently exposes sensitive API credentials to users with limited access, such as contributors. This exposure occurs through the post editor page. The vulnerability relies on these credentials as the only mea...

A security issue in the WCFM Membership WordPress plugin before version 2.12.1 allows authenticated users with Subscriber or Customer roles to bypass payment verification. This flaw enables these users to activate a paid vendor membership without completing the payment process, effectively granti...

The All-in-One Video Gallery plugin for WordPress before version 5.1.0 fails to properly escape video thumbnail URLs when displaying them in the admin video list. Additionally, the plugin does not sanitize these URLs when written outside its editor, empowering users with minimal permissions, such...

The Ever Accounting plugin for WordPress prior to version 2.3.3 is susceptible to an improper input validation vulnerability in its CSV import routine. This flaw allows users with the custom Accounting Manager role, which lacks administrative privileges, to specify unrestricted file paths. Conseq...

The Static Snapshot plugin for WordPress prior to version 0.2.1 is susceptible to a command injection vulnerability. This arises from the improper sanitization of shell metacharacters in user-supplied inputs. As a result, unauthorized users can exploit this weakness to execute arbitrary commands ...

The WHIZZ WordPress plugin version 1.1.8 has a significant security vulnerability that fails to properly validate the password-reset key. This oversight allows attackers, who do not need authentication, to exploit a nonce exposed to unauthorized users. Consequently, they can reset passwords for a...

The GutenKit WordPress plugin prior to version 2.5.5 is susceptible to a security flaw that fails to sanitize custom CSS input. This oversight enables users with roles of Author and above to inject malicious JavaScript. When the script is stored within an inline style block on a published page, i...

The Mail Mage WordPress plugin, up to version 0.0.25, is susceptible to SQL injection attacks due to inadequate sanitization and escaping of user-supplied inputs. This flaw can allow unauthorized attackers to manipulate SQL queries, potentially leading to unauthorized data access or manipulation....

The Wurdey WordPress plugin, up to version 1.0.0, is susceptible to an authentication bypass flaw. This vulnerability permits unauthorized individuals to authenticate as administrators by simply knowing the administrator's username, bypassing the need for a valid request signature. This allows at...

The MCB WordPress plugin prior to version 1.0.0 is vulnerable due to improper sanitization and escaping of request header values. This flaw allows unauthenticated users to inject malicious JavaScript code, which can then execute within the browser sessions of administrators viewing the statistics...

The Placester plugin for WordPress prior to version 1.4.3 lacks proper validation on an AJAX action that updates user account details. This flaw allows unauthenticated users to modify any registered user's email address, including administrative accounts. By doing so, attackers can exploit the st...

The CVE-2024-26229 vulnerability in the Windows CSC Service is being exploited with proof-of-concept (PoC) exploit code available on GitHub. This high-severity vulnerability could allow attackers to gain SYSTEM privileges on a Windows system, posing a significant risk. This type of elevation of p...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

This vulnerability in WordPress Core allows unauthenticated attackers to execute arbitrary code on the server during the upgrade process. The issue arises from predictable, web-accessible staging paths that are utilized while performing full-package core upgrades. This exposure specifically affec...

The ClickDatos Protección de Datos RGPD plugin for WordPress is susceptible to a reflected Cross-Site Scripting (XSS) vulnerability in versions up to 3.1.0. This flaw allows attackers to inject malicious scripts into web pages, potentially compromising users' sensitive data and accounts. By explo...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A security flaw in libyal's libvmdk component, specifically within the Extent Data File Handler, allows for memory corruption due to improper handling in the libvmdk_extent_table_get_extent_data_file_path function. This vulnerability can be exploited remotely, posing a significant risk to users. ...

An attacker capable of manipulating HTTP traffic on Debian and Ubuntu systems can exploit vulnerabilities within the APT client. By improperly utilizing hard links and necessitating the client to follow redirects, attackers can coerce the installation of unverified packages, which could allow the...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

This vulnerability affects multiple configurations of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. It allows unauthenticated attackers with network access to compromise these platforms via various protocols. Successful exploitation can lead to unauthorized creation, deletion, ...

A remote code execution vulnerability exists in the langgenius Dify application, specifically affecting versions up to 1.18.0 and 2.0.0-beta.2. This flaw lies within the file api/configs/feature/__init__.py of the Sandbox Run Handler component, where it exposes hard-coded credentials. This vulner...

A vulnerability within the Linux kernel related to POSIX timers cleanup can lead to a use-after-free situation. When a non-leader thread invokes exec(), the thread's PID reference in the timer system becomes invalid due to changes in task ownership. If the task fails subsequently in certain opera...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A vulnerability in PHP allows for the possibility of remote code execution due to improper management of global state that can reference freed memory. In certain scenarios, the global state retains stale information from previous requests, potentially enabling an attacker to execute arbitrary cod...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

A command injection vulnerability has been identified in the Edimax BR-6208AC router running firmware version 1.32. This flaw exists within the processing logic of the /goform/mp file, where improper validation allows attackers to execute arbitrary commands remotely. Although the exploit has been...

The vulnerability in libwebsockets arises from improper handling of PUBACK packets within the MQTT Protocol, allowing remote attackers to exploit the flaw. This security issue stems from insufficient validation of input data, leading to the potential for arbitrary code execution by writing beyond...

A security flaw in the OpenBMB Internet of Agents affects the WebSocket Connection Manager's ConnectionManager.connect function. The vulnerability allows manipulation of the agent_name argument, which can lead to missing authentication. This can potentially enable attackers to launch attacks remo...

A SQL injection vulnerability has been discovered in itsourcecode's Online Book Store version 1.0. The flaw resides in the /admin_edit.php file, where improper handling of the 'bookisbn' parameter can allow remote attackers to exploit the application. This vulnerability allows them to manipulate ...

An uncontrolled recursion vulnerability in Elasticsearch can lead to a denial of service through serialized data with nested payloads. Attackers with network access to the cluster's server interface can craft malicious requests that may cause the node to terminate. Since no authentication is need...

A missing authentication vulnerability has been identified in AgentScope's Agent Service, particularly in the 'get_current_user_id' function of the 'deps.py' file. This flaw allows an attacker to manipulate the 'X-User-ID' argument, potentially bypassing authentication mechanisms. The vulnerabili...

A significant flaw exists in the Bash Tool component of the agentscope-ai AgentScope application, specifically in the check_permissions function located in the file src/agentscope/tool/_builtin/_bash.py. This vulnerability leads to incorrect authorization, enabling potential attackers to exploit ...