Publicly Disclosed
PoC Exploits

A remote code execution vulnerability exists in SonicCloudOrg's sonic-agent, specifically in the evalIsFailed function located within the Groovy Script Handler component. This flaw allows attackers to manipulate operating system commands remotely, potentially leading to unauthorized access or con...

A remote OS command injection vulnerability exists in the Android WebSocket Server component of SonicCloudOrg's sonic-agent, affecting versions up to 2.7.2. The flaw resides in the AndroidWSServer.java file, where improper handling of the argument path enables an attacker to execute arbitrary com...

A vulnerability exists in the AMTT Hotel Broadband Operation System version 1.0, impacting the functionality of the file manager, specifically within the 'switch_status.php' file. This flaw allows remote attackers to manipulate the 'ID' argument, potentially leading to SQL injection attacks. Succ...

A significant vulnerability affecting the Jenkins Pipeline: Groovy Plugin versions 2.63 and earlier allows attackers with control over pipeline scripts to bypass the intended sandbox environment. This flaw permits execution of arbitrary code on the Jenkins master JVM, posing serious security risk...

A command injection vulnerability exists in the Trendnet TEW-635BRM router with firmware versions up to 1.00.03. This flaw affects the ipoa_test function within the /sbin/rc file for the IPoA WAN Connection Setup component. An attacker can exploit this vulnerability remotely by manipulating the i...

A stack-based buffer overflow vulnerability has been identified in the web service functionality of Trendnet TEW-635BRM routers running firmware version 1.00.03 and earlier. The flaw resides in the start_httpd function located in the /sbin/rc file, where improper handling of the device_name argum...

A vulnerability in H3C NX15 V100R017 affects the password modification endpoint, allowing attackers to exploit weak password recovery processes through the 'newPass' argument. This issue enables remote manipulation of administrator credentials, posing significant risks to system integrity. The vu...

A vulnerability has been identified in IceHRM versions up to 35.0.1, specifically affecting the UserReport Endpoint within the EmployeeAttendanceReport.php file. This flaw allows an attacker to manipulate the 'employeeList' argument, which can result in SQL injection. Such exploitation can be lau...

A security flaw has been identified in QILING Disk Master 6.0.0.0, stemming from an unknown function within the diskbckp.sys library of the kernel driver. This vulnerability compromises access controls, leading to potential unauthorized operations within a local environment. Given that the exploi...

A local privilege escalation vulnerability has been discovered in MiniTool Partition Wizard versions up to 13.6 due to improper access controls in the Signed Kernel Driver component (pwdrvio.sys). This vulnerability allows local attackers to manipulate function calls and gain elevated privileges....

A deserialization vulnerability exists in Apache Camel components, allowing attackers to send maliciously crafted Java-serialized payloads. When affected consumers deserialize a HashMap that includes java.net.URL keys, the JVM may perform DNS queries to an attacker-controlled host. This happens d...

A critical security flaw has been identified in the Eleveo Call Recording Software version 9.7.0, specifically related to the Call Recording Handler component. The vulnerability exists due to improper handling of the 'callId' argument within the audio.jsp file, allowing unauthorized users to gain...

A significant vulnerability exists in Eleveo Call Recording Software version 9.7.0, specifically within the file processing of /callrec/restoreCallAction.do on the Recorded Calls Page. This flaw enables an attacker to manipulate access permissions improperly, potentially allowing unauthorized acc...

A race condition has been identified in the Linux kernel related to the handling of device resources, specifically within the Direct Rendering Manager (DRM). This vulnerability arises during the prime swap operation where a single object can spawn two ID references. A concurrent operation, such a...

A vulnerability in Eleveo Call Recording Software version 9.7.0 has been identified, specifically in the file responsible for email composition functionality (/callrec/composeEmailAction.do). This flaw allows unauthorized manipulation through remote execution, leading to potential security breach...

A vulnerability has been identified in Eleveo Call Recording Software version 9.7.0, specifically affecting the /callrec/pci_dss_status.jsp file. This vulnerability allows for improper authorization due to manipulation of the affected part of the software. It poses a risk of remote exploitation, ...

MCPJam Inspector, designed for local-first development on MCP servers, has a vulnerability allowing remote code execution (RCE) due to improper binding settings. In versions 1.4.2 and earlier, the platform listens on 0.0.0.0 by default, enabling attackers to exploit this configuration through cra...

An issue exists in the Linux Kernel where improper handling of copy-on-write (COW) operations can lead to page cache corruption. This is due to the tcf_pedit_act() function, which computes the COW range without considering runtime header offsets added by typed keys. As a result, portions of the w...

A command injection vulnerability in Dahua EIMS allows unauthenticated remote attackers to execute arbitrary system commands. This issue arises from inadequate input validation on the captureCommand parameter processed via the capture_handle.action interface. Attackers can exploit this flaw by se...

A security issue has been discovered in various Dahua security products that may allow an attacker to acquire the device’s CA root certificate. If this certificate is installed and trusted on client systems, it could enable an attacker to create fraudulent certificates that would be accepted as l...

A vulnerability identified in various Dahua security products enables an authenticated remote attacker to transmit a specially crafted packet. This can trigger an exception within the system, leading to an unexpected reboot of the device. Consequently, this vulnerability poses a risk of denial of...

A vulnerability has been identified in various Dahua security products that enables an unauthenticated remote attacker to send a specially crafted packet. This can lead to an exception that causes the affected system to reboot unexpectedly, subsequently resulting in a denial of service. Users are...

A memory management vulnerability in the Linux kernel's eventpoll subsystem allows for a misuse of freed memory, resulting from improper handling of file structures during critical operations. The flaw occurs when an ep_remove operation clears a file pointer under lock while allowing concurrent o...

A race condition exists in the Linux kernel that allows local users to gain elevated privileges. By exploiting improper handling of copy-on-write (COW) memory mappings, an attacker could modify files that are meant to be read-only. This vulnerability, known as 'Dirty COW', was notably used in att...

The authentication vulnerability in Etcd-io v3.4.10 allows remote attackers to exploit the debug function, potentially enabling them to escalate their privileges. This flaw can be leveraged by malicious entities to gain unauthorized access, exposing sensitive information and compromising the inte...

MotionEye versions up to and including 0.43.1b4 are susceptible to OS Command Injection through improperly sanitized configuration parameters like image_file_name. This vulnerability allows remote authenticated users with administrative privileges to inject malicious commands into Motion configur...

A critical vulnerability in Mautic's theme engine allows authenticated users to upload and execute potentially malicious Twig templates. This design flaw grants users with theme upload permissions an opportunity to execute arbitrary code on the hosting server, thereby compromising system integrit...

The MCP Server Kubernetes is affected by an argument injection vulnerability that impacts structured tools such as kubectl_get, kubectl_describe, and kubectl_delete. This flaw allows malicious actors to bypass the security checks by using specially crafted resourceType and name parameters with le...

Krayin CRM versions up to 2.2.3 are susceptible to an insecure direct object reference vulnerability affecting several key controllers, including LeadController, PersonController, OrganizationController, QuoteController, and ActivityController. This flaw enables authenticated users to gain unauth...

A vulnerability exists in the Apache Camel JMS Component where the deserialization of ObjectMessage payloads occurs without an ObjectInputFilter. This flaw could allow an attacker to publish a specially crafted ObjectMessage to a queue or topic consumed by a Camel application, resulting in remote...

Dify, prior to version 1.16.0-rc1, is susceptible to a SQL injection vulnerability within its MyScale vector store backend. This issue arises from the failure to properly sanitize search parameters in the search_by_full_text method, allowing attackers to execute arbitrary SQL commands. By injecti...

A deserialization vulnerability has been identified in the Apache Camel framework, specifically in the camel-vertx-http component. The flaw arises from improper handling of HTTP response bodies containing the Content-Type application/x-java-serialized-object. When configured with certain options,...

ZoneMinder, a popular open-source closed-circuit television software, has a vulnerability that exposes versions v1.37.* up to and including v1.37.64 to a boolean-based SQL injection attack through the web/ajax/event.php endpoint. This flaw can allow an attacker to manipulate SQL queries, potentia...

The vulnerability in Apache Camel's Infinispan component arises from an insecure deserialization process involving ProtoStream. Specifically, the component employs java.io.ObjectInputStream to deserialize data from a remote Infinispan cache without utilizing an ObjectInputFilter, exposing the app...

The Eleveo Call Recording Software 9.7.0 contains a vulnerability related to improper authorization in the file handling process of /callrec/sendlogfile. This flaw allows attackers to exploit the system remotely, potentially gaining unauthorized access to sensitive information. The issue was publ...

A serious vulnerability has been identified in Eleveo Call Recording Software version 9.7.0, specifically involving the file /callrec/statisticReportAction.do. This issue allows for improper authorization, which means that unauthorized users can gain access to sensitive functionalities of the sof...

A vulnerability has been identified in Eleveo Call Recording Software 9.7.0, affecting the LDAP User Interface located at /callrec/users_ldap.jsp. This security flaw allows unauthorized access, potentially enabling attackers to manipulate files remotely. The exploit has been made public, increasi...

A security flaw in Eleveo Call Recording Software version 9.7.0 has been identified, affecting an element of its group interface. This vulnerability allows attackers to manipulate the file /callrec/roleAddAction.do, potentially leading to unauthorized access via remote execution. Despite early no...

A vulnerability exists in Eleveo Call Recording Software version 9.7.0, where manipulation of the 'role' argument in the endpoint /callrec/userAddAction.do leads to improper authorization. This flaw allows an attacker to exploit the system remotely, granting unauthorized access to sensitive funct...

The Lucee CFML Server versions 5.3.x, 6.1.x, 6.2.x, and 7.0.x are vulnerable to a reflected cross-site scripting vulnerability due to improper input handling in URL path parsing. This flaw allows unauthenticated remote attackers to inject arbitrary JavaScript into the server's responses. Attacker...

MISP Core features critical access control flaws that allow authorized users to delete event reports and sharing groups owned by other organizations. Specifically, the deleteSelection handlers for both Event Reports and Sharing Groups leverage broad role permissions instead of stringent ownership...

A stack-based buffer overflow vulnerability affects multiple Ivanti products, including Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways. This flaw allows remote unauthenticated attackers to exploit the vulnerability and achieve remote code execution. It is crucial for users o...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A notable vulnerability exists in the jwe-decrypt plugin of Apache APISIX, which permits an authentication bypass under default configurations. This flaw can potentially allow unauthorized access to sensitive data or functions, thereby compromising the security of applications utilizing the affec...

The EscortWP WordPress theme, specifically version 3.6.2, contains a vendor-created obfuscated backdoor allowing unauthenticated attackers to execute damaging actions on the site. This vulnerability enables malicious actors to delete all content permanently by utilizing a hard-coded, per-build ke...

The LA-Studio Element Kit for Elementor WordPress plugin, prior to version 1.6.1, suffers from a security flaw where it permits unauthenticated users to register accounts even when user registration is disabled across the WordPress site. This vulnerability arises from the plugin's failure to veri...

A vulnerability in the email template editor of LibreBooking allows an attacker with admin credentials to manipulate the file path of saved templates. This flaw enables the remote execution of arbitrary code outside the specified template directory. Vulnerable versions of LibreBooking prior to 5....

A security flaw in zhayujie CowAgent, affecting version 2.1.0 and earlier, allows remote attackers to exploit an unknown function in channel.py of the Message Endpoint. This vulnerability results in missing authorization checks, potentially compromising the application's security. Despite early n...

A server-side request forgery (SSRF) vulnerability was identified in the zhayujie CowAgent Vision Tool, specifically in the function _build_image_content/_download_to_data_url located in agent/tools/vision/vision.py. By manipulating the 'image' argument, an attacker can exploit this vulnerability...

A vulnerability exists in the zhayujie CowAgent's Browser Tool that allows for the potential unauthorized disclosure of sensitive information via the BrowserTool._do_navigate function in browser_tool.py. This issue can be triggered remotely, exposing users to data risks. The project maintainers h...