Publicly Disclosed
PoC Exploits

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

IBM Langflow OSS versions 1.0.0 through 1.12.8 are susceptible to a remote code execution vulnerability due to improper control of code generation. This weakness could potentially allow an attacker to execute arbitrary code on the affected systems if exploited. Users are advised to review the ven...

A Path Traversal vulnerability has been identified in the multipart file handling within the AdonisJS framework. This vulnerability could allow an attacker to write arbitrary files to unintended locations on the server's filesystem, potentially compromising the integrity and security of the appli...

The Sudo software, prior to version 1.9.17p1, contains a vulnerability that enables local users to gain root access through improper handling of configuration files. Specifically, when the optional --chroot command is used, the software incorrectly processes the /etc/nsswitch.conf file from a use...

A vulnerability in GNU Tar allows attackers to exploit crafted tar files. By manipulating the header size to zero, this flaw can lead to an out-of-bounds read, potentially impacting the stability and security of the system. This issue affects multiple versions of the GNU Tar software and requires...

Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

A buffer overflow vulnerability exists in the way GIMP parses APNG files. This flaw allows remote attackers to execute arbitrary code if a user opens a specially crafted APNG file or visits a malicious webpage. The issue stems from inadequate validation of the data size being copied to a stack bu...

This vulnerability in PHP relates to how it handles out-of-memory (OOM) errors. When a context triggers an OOM condition, it may fail to appropriately manage memory, leaving it in an uninitialized state. Consequently, during the cleanup process of a request, this uninitialized memory could potent...

A vulnerability in the Linux kernel's TCP socket management has been identified, allowing for a use-after-free scenario that can impact network security. Specifically, the issue arises when ownership of certain socket options is transferred between parent and child sockets without proper manageme...

The Simple Download Monitor plugin for WordPress has a vulnerability that fails to adequately verify the visibility of content accessed through its shortcodes. This loophole potentially allows users with minimal permissions, such as the Contributor role, to view sensitive information including ti...

The All-in-One Video Gallery plugin for WordPress has a vulnerability that allows users with contributor roles and above to exploit unvalidated and unescaped shortcode attributes. When these attributes are output on pages or posts where the shortcode is used, it opens the door for Stored Cross-Si...

The EventPrime WordPress plugin, prior to version 4.3.6.1, fails to maintain the confidentiality of the Pending Review post status, allowing unauthenticated users to gain visibility into posts, pages, and other content that are meant for internal review only. This oversight poses a risk of exposi...

The Premium Packages WordPress plugin lacks proper verification, enabling any authenticated user to claim guest orders. This flaw permits access to sensitive buyer information, including billing details and purchased files, solely by providing the order identifier. Such vulnerabilities necessitat...

The VikWidgetsLoader plugin for WordPress, prior to version 1.12.3, has a security issue where it fails to properly sanitize or escape multiple block attributes before embedding them in HTML output. This weakness permits users with Contributor roles to inject arbitrary JavaScript into posts, whic...

The Stape Conversion Tracking WordPress plugin prior to version 2.3.11 lacks proper validation for the sub-path appended to its same-origin proxy's upstream endpoint. This oversight enables unauthorized users to redirect server-side requests to arbitrary hosts. Consequently, the response body alo...

The Premium Packages plugin for WordPress, versions prior to 7.3.1, contains a vulnerability that fails to validate the ownership of guest orders. This oversight permits unauthenticated users to retrieve sensitive order information—including order status, payment status, and total amounts—by simp...

The Premium Packages WordPress plugin prior to version 7.3.1 contains a flaw that permits any unauthenticated user to gain access to another user's shopping cart by exploiting a lack of verification for ownership when loading saved carts. This oversight allows a malicious user to use the saved-ca...

The WP Roster plugin for WordPress prior to version 2.36 contains a significant security vulnerability that allows unauthenticated users to access and manipulate stored roster data. By bypassing necessary capability checks and nonce verification, attackers can overwrite, erase, or restore any ros...

The Duplicator WordPress plugin, both in its free and Pro versions prior to 5.1.0, is vulnerable to SQL injection attacks. This vulnerability arises because the plugin does not adequately restrict database charset and collation during the restoration of backups. Specifically, if a Subscriber's pr...

The WPvivid Backup, Migration & Staging WordPress plugin before version 0.9.138 fails to validate the backup storage directory path adequately. This security lapse allows administrators to create directories and files outside the designated backup location through a path traversal attack, potenti...

The Text Typing WordPress plugin prior to version 2.2.2 is vulnerable due to improper sanitization and escaping of a block attribute before it is stored and subsequently output in a page element. This flaw enables users with Contributor roles and above to conduct Stored Cross-Site Scripting attac...

The WPvivid Backup, Migration & Staging plugin for WordPress prior to version 0.9.137 is susceptible to a file upload flaw. This vulnerability arises because the plugin fails to appropriately validate the file extension of uploads. When handling import uploads, instead of checking the actual file...

The WPvivid Backup, Migration & Staging WordPress plugin before version 0.9.137 contains a directory traversal vulnerability due to improper sanitization of user-provided input for the staging destination folder. An authenticated administrator can exploit this weakness by providing a path with tr...

The Duplicator WordPress plugin and its Pro variant prior to version 5.1.0 are susceptible to unauthorized access. An attacker may exploit this vulnerability to gain direct access to certain bundled PHP files. This oversight allows these files to initialize without the expected context, potential...

The Enable Media Replace plugin for WordPress prior to version 4.2.3 is susceptible to a file upload vulnerability that exploits the handling of SVG files. Specifically, the plugin fails to process replaced media files through the WordPress upload pipeline. As a result, an authenticated user with...

The WPvivid Backup, Migration & Staging plugin for WordPress versions prior to 0.9.137 features a critical flaw that allows authenticated administrators to bypass safeguards related to snapshot identifiers. Specifically, the plugin fails to verify that the submitted snapshot identifier correspond...

The Duplicator and Duplicator Pro plugins for WordPress prior to version 5.1.0 are susceptible to a reflected cross-site scripting vulnerability. This issue occurs due to the failure to properly sanitize and escape a parameter before reflecting it on certain administrative pages. An attacker can ...

The WP Remote Users Sync plugin for WordPress, prior to version 2.2.0, suffers from inadequate access controls, especially concerning the user export files stored beneath the public web root. The plugin depends on an Apache access-control file, which does not provide protection for servers such a...

The Post Duplicator plugin for WordPress versions prior to 3.0.17 allows users with lower-level roles, such as Contributors, to inadvertently access draft and private posts belonging to other users. This vulnerability arises from inadequate checks on user roles before displaying post details. As ...

The PowerPack Addons for Elementor plugin prior to version 3.1.3 contains a vulnerability where it fails to properly validate user-supplied URLs before utilizing them in server-side HTTP requests. This oversight allows users with contributor roles or higher to exploit the system and potentially e...

The Essential Real Estate plugin for WordPress, specifically versions prior to 5.3.5, contains a vulnerability that fails to validate whether a media attachment belongs to the requesting user prior to its deletion. This flaw permits users with a self-registration at the customer level to delete m...

The FV Flowplayer Video Player plugin for WordPress lacks sufficient authorization checks in its video-migration functions, relying solely on nonces for protection. This oversight enables users with Contributor-level privileges and above to access and modify the plugin's stored video records site...

The Form Maker plugin developed by 10Web prior to version 1.15.51 is susceptible to an arbitrary web script execution vulnerability. This security issue arises due to the inconsistent escaping of user-submitted field values, which are displayed on the submissions admin page. As a result, unauthen...

The Kali Forms plugin for WordPress, prior to version 2.4.29, contains a vulnerability that permits users with author-level access and higher to inject arbitrary JavaScript into form button configurations. This injected code executes in the browser session of any user who interacts with the butto...

The SEOPress WordPress plugin prior to version 10.4 has a flaw that allows for Stored Cross-Site Scripting attacks. This occurs because the plugin fails to properly sanitize and escape certain analytics tracking settings before embedding them in an inline script across all front-end pages. Users ...

The FV Flowplayer Video Player plugin for WordPress prior to version 7.5.56.7212 has a flaw in its record ownership verification process. This vulnerability allows authenticated users with Contributor-level access or higher to modify or delete video and metadata records belonging to other users. ...

The Booking Package plugin for WordPress, prior to version 1.7.34, has a security flaw that allows unauthenticated users to create confirmed bookings without completing payment. This vulnerability poses a risk as it enables unauthorized users to reserve slots in calendars set to require online pa...

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin prior to version 1.17.11 contains a security flaw that fails to properly check user capabilities during a specific AJAX action. This oversight permits any authenticated user, even those with minimal permissions like Subscri...

The Mollie Payments for WooCommerce plugin prior to version 8.2.0 exhibits a flaw in its validation process, allowing unauthenticated users to create orders for products that are either in draft status or unpublished. This security loophole arises specifically through the PayPal express-checkout ...

The CookieYes WordPress plugin prior to version 3.5.8 fails to properly restrict access to its cookie-category script fields, allowing users with a Contributor role to inject unvalidated JavaScript. This vulnerability can lead to arbitrary code execution in the browsers of users and administrator...

The Mollie Payments for WooCommerce plugin prior to version 8.2.0 is susceptible to a vulnerability that enables unauthenticated users to alter the total amount of an order by removing configured payment-surcharge fees without verifying the payment state or the selected payment gateway. This flaw...

A vulnerability has been identified in the Linux kernel's crypto subsystem, specifically within the algif_aead component. This issue arises from an unnecessary complexity in operating in-place, which has been reverted for improved security and performance. The change eliminates the need for in-pl...

A vulnerability in GitLab's CI/CD configuration could permit an unauthenticated attacker to execute arbitrary code on the server. This exploit arises from insufficient validation of a specially crafted regular expression. Affected versions include GitLab CE/EE 19.2 prior to 19.2.8, 19.3 prior to ...

Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable ker...

A vulnerability has been discovered in the Linksys E5600 Router version 1.1.0.26, affecting a component known as Factory Quality Control located at /cgi-bin/fqc.cgi. This weakness allows for potential information disclosure, enabling remote attackers to exploit the vulnerability. Publicly availab...

A security flaw has been identified in Linksys E5600 firmware version 1.1.0.26, specifically in the init_multipart function of the /cgi-bin/upload_fw.cgi component. This vulnerability allows for out-of-bounds write operations that can be exploited remotely. The issue affects products that are no ...

A vulnerability has been found in Linksys E5600 router version 1.1.0.26, specifically within the strcpy function of the /cgi-bin/mesh_login.cgi file, associated with the JSON Request Parser component. Exploitation of this vulnerability involves manipulation of the input parameters such as usernam...

A vulnerability has been identified in the Linksys E5600 router, specifically within the login handler component located at /cgi-bin/mesh_login.cgi. This flaw allows for exploitation through improper authentication methods, enabling malicious actors to potentially access the system without proper...

A security flaw has been identified in FunAdmin version 7.1.0, specifically in the Curd::selectList function located in the /frontend/ajax/index file of the Frontend List Endpoint. This vulnerability allows an attacker to manipulate the selectFields argument, resulting in a potential SQL injectio...

A vulnerability in the Qihoo 360 Whole Home Router M5 affects the boot script, exposing hard-coded credentials. This flaw enables remote exploitation, potentially allowing unauthorized access to the router's functionalities. The vendor, Qihoo 360, was notified but has not addressed the issue publ...