Publicly Disclosed
PoC Exploits

An SQL injection vulnerability exists in Friendica through the 2026.08-dev branch. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. As this parameter is concatenated without proper escaping into a SHOW COLUMNS query through ...

A vulnerability has been identified in the 648540858 wvp-GB28181-pro product version 2.7.4-20260107, specifically within the Log File Download Endpoint in the LogController.java file. This flaw allows an attacker to manipulate the fileName argument, potentially leading to path traversal attacks. ...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A path traversal vulnerability was identified in the 648540858 wvp-GB28181-pro version 2.7.4-20260107. The issue resides in the PlayController.java file, specifically concerning the Snapshot Endpoint. An attacker can manipulate the deviceId or channelId arguments, allowing unauthorized access to ...

A security flaw exists in the 'logDetailCat' endpoint of alldatacenter Alldata up to version 0.6.8, specifically within the FileInputStream function in the JobLogController.java file. This vulnerability arises from improper validation of user input, allowing attackers to perform path traversal by...

A vulnerability has been identified in alldatacenter alldata version 0.6.8, impacting the Hessian2Input.readObject function within the /serialize/impl/HessianSerializer.java file of the xxl-rpc Listener component. This deserialization issue allows remote attackers to manipulate data, leading to p...

A security vulnerability has been identified in SourceCodester Simple Client Management System 1.0, specifically affecting a function within the file /classes/Master.php?f=save_service. By manipulating the argument ID, an attacker can launch a SQL injection attack remotely. The exploit has been m...

A vulnerability has been discovered in the Tenda W20E router that allows for a stack-based buffer overflow through the ipMacBindListStore function in the /goform/addIpMacBind file. By manipulating the IPMacBindRule argument, an attacker can exploit this weakness remotely, potentially leading to u...

A security vulnerability has been identified in the Tenda W20E router that affects the QoS Rule Deletion feature. The issue resides within the formQOSRuleDel function located in the /goform/delQos file. An attacker can exploit this flaw by manipulating the qosIndex argument, leading to a stack-ba...

A security issue was identified in the Tenda W20E router that affects the QoS Edit functionality. Specifically, the vulnerability resides in the lstAdd function located in the /goform/editQos file, allowing for a stack-based buffer overflow due to improper handling of the qosListConnecttedNum arg...

A vulnerability exists in the Tenda AC12's web management interface within the formSetRebootTimer functionality located in the file /goform/SetSysAutoRebbotCfg. This flaw allows an attacker to manipulate the rebootTime argument, causing a buffer overflow that could enable remote exploitation. The...

A critical flaw has been identified in the TOTOLINK A800R firmware version 4.1.2cu.5137_B20200730, specifically within the setParentalRules function of the firewall component (file: /cgi-bin/cstecgi.cgi). This vulnerability allows for a stack-based buffer overflow that can be triggered by manipul...

A vulnerability has been identified in the TOTOLINK A800R router, specifically within the setMacQos function located in the /cgi-bin/cstecgi.cgi file of the firewall component. By manipulating the macAddress argument, a remote attacker could exploit this flaw, leading to a stack-based buffer over...

A vulnerability has been identified in the TOTOLINK A800R router, specifically within the firewall component's setMacFilterRules function. This issue arises due to improper handling of the Comment argument in the /cgi-bin/cstecgi.cgi file, leading to a stack-based buffer overflow condition. Attac...

A vulnerability has been found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730, specifically in the UploadCustomModule function located in the /cgi-bin/cstecgi.cgi file of the product.so component. This vulnerability allows an attacker to manipulate the File argument, potentially lead...

A security flaw has been identified in the TOTOLINK A800R router affecting the setIpQosRules function within the firewall component. This vulnerability enables a remote attacker to manipulate the Comment argument, leading to a stack-based buffer overflow. The Public exploitation of this flaw pose...

The Epeken All Kurir for WooCommerce plugin version 2.1.2 contains a vulnerability where it fails to authenticate payment-confirmation requests. This oversight allows unauthorized users to falsely confirm orders without verifying their origin or the occurrence of actual transactions. As a result,...

The Paymob for WooCommerce plugin prior to version 4.1.9 fails to adequately sanitize a user-supplied identifier used in SQL queries within its public payment callback. This occurs before the payment provider's HMAC signature is verified. As a result, it exposes the plugin to SQL injection attack...

The Essential Addons for Elementor plugin for WordPress, prior to version 6.7.2, contains a vulnerability that permits unauthenticated users to manipulate user registration fields. This flaw allows attackers to overwrite predefined user attributes, enabling them to assign arbitrary roles—includin...

The Embed Google Photos album plugin for WordPress versions up to 2.2.1 is susceptible to a JavaScript injection vulnerability due to improper escaping of shortcode attribute values. This flaw enables authenticated users with a Contributor role or higher to inject malicious JavaScript code. When ...

The Netis NC63 router firmware version 3.0.0.3327 has a significant vulnerability that allows attackers to initiate an unauthorized firmware update due to inadequate authentication checks in the web server. This security flaw enables malicious users to upload unsigned firmware images without requ...

A post-authentication command injection vulnerability exists in the management commands of Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615. This flaw allows an authenticated attacker to execute arbitrary operating system commands via Telnet, potentially compromising the security and i...

A vulnerability in the web management interface of Tenda G0 devices allows remote attackers to exploit buffer overflow via manipulated arguments in the setPortMapping function. This issue was found in the /goform/module file, which compromises the application's ability to handle input correctly, ...

A vulnerability has been discovered in the Tenda G0 router related to its web management interface. Specifically, the function addStaticRoute in the /goform/module file has a flaw that allows for a stack-based buffer overflow. By manipulating the argument staticRouteNet, an attacker can execute a...

A vulnerability exists in the Tenda G0's Web Management Interface, specifically within the function formSetPortMirror located in the /goform/module file. This issue arises from improper handling of the argument portMirrorMirroredPorts, leading to a stack-based buffer overflow. The vulnerability c...

A security flaw exists in the Tenda AC1206 router's web management interface, specifically within the function set_wl_guest_iplist located in /goform/WifiGuestSet. This vulnerability allows for a stack-based buffer overflow due to improper handling of the shareSpeed argument. Successful exploitat...

A stack-based buffer overflow vulnerability exists in the Tenda AC1206 web management interface, specifically within the set_device_name function of the /goform/SetOnlineDevName endpoint. By manipulating the devName parameter, an attacker can exploit this vulnerability remotely, leading to potent...

A vulnerability exists in the SourceCodester Air Cargo Management System version 1.0 that allows for SQL injection through the manipulation of the ID parameter in the Master.php file, specifically within the save_cargo_type function. This vulnerability can be exploited remotely, enabling attacker...

A vulnerability has been identified in RosarioSIS versions prior to 12.9, specifically affecting the DBUpdate function within Discipline/Referrals.php. This flaw results in an authorization bypass that can be exploited remotely. The exploit is publicly available, posing substantial risks to users...

A vulnerability exists in the Baicells EG3661M due to improper handling of MaxHops, Timeout, and Size parameters in the LuCI Web Interface. This flaw allows an attacker to execute arbitrary commands on the operating system through remote exploitation. Without a timely vendor response to reported ...

A security vulnerability exists in Feedmob's FM-MCP-Servers version 0.0.3, specifically within the 'downloadReport' function located in the Download Endpoint module. This issue arises from the manipulation of the 'downloadUrl' argument, enabling an attacker to perform server-side request forgery ...

A vulnerability has been detected in the itsourcecode Hospital Management System 1.0, specifically in the file viewdoctortimings.php. This issue arises from improper handling of input parameters, primarily the 'delid' argument, which enables remote attackers to execute SQL injection attacks. Such...

The affected versions of cPanel and WHM contain a serious authentication bypass flaw in the login flow. This vulnerability enables unauthenticated remote attackers to bypass authentication mechanisms, allowing them to gain unauthorized access to the control panel. Users of the specified versions ...

A security flaw has been identified in eyaushev swagger-testcase-mcp, specifically impacting the loadSource function within the swagger-parser.ts file. This vulnerability allows remote attackers to manipulate requests and exploit the application for server-side request forgery. The issue was repo...

A SQL injection vulnerability has been discovered in the Raisecom Communication Command and Dispatch Management Platform, specifically affecting the /app/users/getpwd.php file in versions up to 7.6.5. This flaw allows attackers to manipulate the 'sip' argument, potentially leading to unauthorized...

A vulnerability has been identified in Dromara Lamp-Cloud versions up to 5.10.0, specifically within the FileChunkController.java component associated with the chunk-check endpoint. This flaw allows an attacker to manipulate the 'Name' argument, potentially leading to a path traversal attack. Suc...

A buffer overwrite vulnerability exists in the annotator function of Zoom Clients, enabling a malicious meeting participant to execute arbitrary code on another participant's device by exploiting this flaw via network access. This security concern underscores the importance of keeping Zoom Client...

A path traversal vulnerability exists in the File-Upload Controller (FileAnyoneController.java) of Dromara's lamp-cloud product versions up to 5.10.0. By manipulating the 'bucket' or 'bizType' parameters, an attacker can access restricted directories and potentially execute arbitrary code. Althou...

Langflow, a tool for constructing and deploying AI-driven agents and workflows, is susceptible to a vulnerability in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint in versions before 1.9.0. This vulnerability enables an attacker to build public flows without authentication, leveraging ...

FUXA, a web-based Process Visualization software, is susceptible to an authentication bypass vulnerability when the Node-RED plugin is enabled. This flaw allows an unauthenticated remote attacker to execute arbitrary code on the server, posing a significant risk to system integrity. This issue ha...

A path traversal vulnerability has been identified in the Dromara Lamp-Cloud software's Code Generator component, specifically within the DefGenProjectController.java file. Attackers can exploit this vulnerability by manipulating the outputDir, parent, or projectPrefix arguments, enabling remote ...

A server-side request forgery vulnerability has been identified in MCP-RDF-Explorer version 1.0.0. This issue arises in the explore_url function within the server.py file of the MCP Server component. By manipulating the url argument, an attacker can execute unauthorized requests from the server, ...

The vulnerability found in the PDF Parsing function of EnzoVezzaro's mcp-dominican-layer allows attackers to exploit a flaw in argument manipulation, specifically with the pdfUrl parameter. This enables unauthorized server-side request forgery (SSRF) attacks, which can be executed remotely. Despi...

A vulnerability exists in the EnzoVezzaro mcp-dominican-layer related to the axios.get function in the parse-csv tool's src/index.ts file. This flaw can lead to server-side request forgery, enabling attackers to manipulate CSV URLs and potentially gain unauthorized access to sensitive server reso...

A security flaw has been identified in Tenda CH, CP, and TX3 product lines, specifically affecting the SSH component, which utilizes hard-coded passwords. This vulnerability can potentially allow unauthorized remote access to affected devices, enabling attackers to exploit the known credential we...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A CSRF vulnerability exists in phpList versions prior to 3.7.0-RC5, specifically affecting the lists/admin/admins.php file. This vulnerability allows an attacker to exploit the admin deletion functionality without needing authentication. Through maliciously crafted links, an attacker can trick a ...

The affected versions of phpList fail to adequately enforce CSRF token validation on the bounce rule deletion endpoint. Specifically, the vulnerability allows an attacker to delete arbitrary bounce rules from the database by tricking an authenticated administrator into triggering a crafted GET re...

Next AI Draw.io prior to version 0.4.16 is susceptible to a server-side request forgery vulnerability within its POST /api/parse-url endpoint. The flaw arises from insufficient hostname validation, which relies on pattern matching instead of DNS resolution. This vulnerability allows unauthenticat...

Next AI Draw.io versions 0.2.1 through 0.4.16 are susceptible to a reflected cross-site scripting (XSS) flaw stemming from the mcp query parameter not being properly sanitized. This allows attackers to construct malicious URLs that, when accessed, can execute arbitrary JavaScript code in the cont...