Publicly Disclosed
PoC Exploits

The Phoca Cart extension for Joomla contains a vulnerability that allows unauthenticated attackers to exploit specific GET parameters ('a[]' and 's[]') on the public shop items page. By manipulating these parameters, attackers can create unfiltered SQL queries, leading to unauthorized access to s...

An SQL injection vulnerability has been identified in the itsourcecode Hospital Management System version 1.0. The flaw arises from an unspecified function in the file /viewprescriptionrecord.php, where manipulation of the argument 'delid' allows attackers to execute arbitrary SQL queries. This v...

A security vulnerability in Open Asset Import Library Assimp's Bone Transformation Key Parser allows for buffer overflow due to improper handling of the transmatrix_count/pcBoneTransforms argument in the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7. This flaw can be exploited remote...

A vulnerability has been discovered in the Code-Projects Online Shopping System, specifically within the 'offersmail.php' file. This issue arises from improper handling of user input in the email argument, which makes it susceptible to cross-site scripting attacks. Remote attackers could exploit ...

A security flaw has been identified in Webkul Bagisto that impacts versions up to 2.4.4. This vulnerability arises from improper handling of the /admin/sales/rma/requests endpoint within the Backend Sales RMA component, enabling remote attackers to bypass authorization controls. Although the vend...

A vulnerability exists in Webkul Bagisto, specifically impacting versions up to 2.4.4. This flaw is located in the Backend Customer Behavior Data Endpoint, where manipulation of the argument ID can result in improper privilege management. This allows an attacker to potentially exploit the system ...

A cross-site scripting vulnerability exists in Webkul Bagisto versions up to 2.4.4 in the RMA Message Handler component. This weakness can be exploited by manipulating the 'Message' argument in the /customer/account/rma/send-message file, potentially allowing attackers to execute arbitrary script...

A vulnerability exists in Webkul Bagisto versions up to 2.4.4, specifically affecting the configuration management functionality located at /admin/configuration/cache-management/execute. By manipulating the 'action' argument, an unauthorized party could bypass expected permissions. This flaw enab...

The ShopSmart Loyalty for WooCommerce plugin version 1.0.0 lacks essential authorization checks for phone number lookups. This oversight permits unauthenticated users to access sensitive customer profiles by simply knowing a customer's phone number. Once accessed, an unauthorized individual can v...

The WooMS WordPress plugin, up to version 9.14, is susceptible to a vulnerability that allows an attacker to craft a malicious URL. This exploitation occurs due to improper validation of user-supplied URLs before executing them in server-side requests. Consequently, stored third-party integration...

A vulnerability exists in Webkul Bagisto prior to version 2.4.4 in the RMA State Validation component, specifically concerning the file /customer/account/rma/update-status. This issue enables a potential attacker to enforce behavioral workflows through unauthorized manipulation. The attack can be...

A vulnerability has been identified in the Orange View Limited DualSafe Password Manager & Digital Vault Extension for Chrome, specifically within the postMessage-based bridge function. This flaw allows attackers to potentially manipulate the component, leading to unauthorized information disclos...

Alaev SEO Tools Extension for Chrome versions up to 1.0.10 has a vulnerability in its Popup UI component, specifically in the addDiv function within src/popup.html. This vulnerability allows remote attackers to execute scripts in the context of the user’s browser, leading to potential unauthorize...

A vulnerability has been detected in the Adblock for Youtube Extension version 7.2.1 for Chrome, originating from a flaw in the updateDynamicRules function within contentscript.js. This vulnerability allows attackers to exploit the argument yt-anti-adblock-detected, which can lead to improper aut...

A security flaw in the jkawamoto mcp-florence2 plugin, specifically in the get_images function of src/mcp_florence2/__init__.py, allows for server-side request forgery. This vulnerability enables an attacker to manipulate input arguments and potentially exploit server weaknesses from remote locat...

A flaw exists in the jiantao88 Android MCP Server, specifically in the Command Execution function located in build/index.js. This vulnerability allows for OS command injection by manipulating parameters such as deviceId, packageName, permission, and extras[].key or extras[].value. The exploit is ...

A vulnerability has been identified in the EFM ipTIME A3004T router, specifically within the httpcon_check_session_url function associated with session validation. This flaw enables improper authentication, which could allow attackers to exploit the system remotely. The vulnerability has been mad...

A command injection vulnerability exists in the COMFAST CF-N1-S version 2.6.0.1. The flaw lies in the unvalidated handling of the 'macaddress' parameter in the sub_44A968 function within the /cgi-bin/mbox-config path. An attacker can exploit this to execute arbitrary commands on the device remote...

A security flaw has been identified in the itsourcecode Hospital Management System version 1.0, specifically within the /viewpaymentreport.php file. This vulnerability allows attackers to manipulate the 'delid' argument, leading to SQL injection attacks. The issue can be exploited remotely, makin...

A vulnerability exists in the itsourcecode Hospital Management System version 1.0 due to improper handling of inputs in the remote file /viewpatient.php. This weakness allows attackers to manipulate the 'delid' argument, resulting in SQL injection. Successful exploitation could enable unauthorize...

A vulnerability was identified within the Open Asset Import Library Assimp, specifically in the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 located in the MDLLoader.cpp file. This vulnerability arises from improper handling of the argument bones_num, leading to a potential heap-ba...

An improper authentication flaw exists in the 'social_login.cgi' CGI program within Zyxel WAX650S firmware, allowing attackers connected to the WLAN to bypass captive portal authentication protocols. This vulnerability could enable unauthorized access to network resources, posing a significant ri...

A post-authentication command injection vulnerability exists in the 'export-cgi' CGI program of Zyxel WAX650S firmware, allowing authenticated users with administrator privileges to execute arbitrary operating system commands on the device. This vulnerability poses significant risks as it could b...

A security vulnerability identified in the Open Asset Import Library Assimp version 17c12da affects the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 within the MDLLoader.cpp file. This vulnerability allows for a buffer overflow due to improper handling of input data, which could p...

A weakness exists within the Open Asset Import Library Assimp specifically related to the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7. This vulnerability can potentially lead to a heap-based buffer overflow, allowing attackers to execute malicious code. The exploit can be initiated remotely...

A security flaw has been identified in the Open Asset Import Library Assimp, specifically within the Assimp::Compression::decompressBlock function in the Common/Compression.cpp file. This vulnerability may allow an attacker to exploit a heap-based buffer overflow through manipulation of the input...

A vulnerability has been discovered in the CodeCanyon TimeCamp Integration for CRM plugin, affecting versions up to 2.8. This issue occurs during the processing of the 'save_contact' file in the Contact Information Update component, specifically through manipulation of the 'contact_id' argument. ...

A remote code execution vulnerability found in React Server Components allows attackers to exploit improperly handled payloads. This issue affects versions 19.0.0 through 19.2.0, compromising server function endpoints through unsafe deserialization of HTTP request payloads. As a result, this flaw...

A code injection vulnerability exists in the Jij-Inc Jij-MCP-Server 0.1.0, specifically in the PythonREPL.run function within the file jij_mcp/python_repr.py. This issue allows for remote code execution due to improper handling of input arguments, enabling attackers to manipulate the 'code' argum...

A command injection vulnerability has been identified in the Edimax EW-7478APC at version 1.04. The flaw resides in the 'stainfo' function located in the /goform/stainfo file, where improper handling of the 'interface' argument allows for remote code execution. This vulnerability poses significan...

A command injection vulnerability exists in the Edimax EW-7478APC network device due to improper validation of user input in the setWAN function located at /goform/setWAN. By manipulating the parameters pppUserName, pptpUserName, or L2TPUserName, an attacker can execute arbitrary commands on the ...

A buffer overflow vulnerability has been identified in the Edimax EW-7478APC's formWlSiteSurvey function, specifically in the /goform/formWlSiteSurvey file. Manipulating the 'selSSID' argument could allow remote attackers to execute arbitrary code. This vulnerability is particularly concerning as...

A serious command injection vulnerability has been identified in the Edimax EW-7478APC, specifically within the formWlbasic function of the /goform/formWlbasic file. This vulnerability arises from improper handling of the rootAPmac parameter, allowing an attacker to execute arbitrary commands rem...

A buffer overflow vulnerability has been identified in the Edimax EW-7478APC routing device, specifically within the function formWanTcpipSetup located at /goform/formWanTcpipSetup. The issue arises from improper handling of the pppUserName argument, allowing for stack-based buffer overflow condi...

A vulnerability has been identified in the iatsiuk pptr-mcp execute Tool, specifically within the executeCode function located in the src/vm-executor.ts file. This flaw allows for remote code injection, opening a path for attackers to execute malicious scripts remotely. Despite the discovery of t...

A vulnerability has been discovered in version 1.0.1 of the Graphlit MCP Server, specifically within the fetch function in the src/tools.ts file associated with the ssrf-test endpoint. This vulnerability allows for potential server-side request forgery, enabling attackers to manipulate URL parame...

A vulnerability in TrailDB version 0.6 affects the TOC Validation component, specifically the tdb_open function located in /src/tdb.c. Exploitation of this issue allows for out-of-bounds read operations, which can be executed remotely. Although early notifications were sent to the project maintai...

An information exposure vulnerability exists in Hitachi's Ops Center API Configuration Manager, Configuration Manager, and Device Manager, which could enable unauthorized session hijacking. This flaw affects multiple product versions, potentially exposing sensitive information to attackers. It is...

A vulnerability in the Unicode Specification, particularly in the Bidirectional Algorithm, allows adversaries to manipulate the visual order of characters. This can lead to confusion when analyzing source code, as the logical order of tokens processed by compilers and interpreters may differ from...

A vulnerability exists in PHP that allows an attacker to manipulate input to the bccomp() function, potentially leading to out-of-bounds write conditions. This flaw can cause significant issues, including stack and heap corruption, in various PHP versions, notably impacting those prior to their r...

A critical security vulnerability exists in Python StateMachine versions prior to 3.2.0, allowing remote code execution through unsafe evaluation of crafted SCXML documents. Attackers can inject malicious expression strings that, when processed by the SCXMLProcessor, are passed to Python's eval()...

The Visualizer Plugin for WordPress, prior to version 4.0.7, contains an authorization flaw that allows users with Contributor privileges and higher to access sensitive chart configurations. This vulnerability enables these users to read full configurations of charts, including those that should ...

The Simple JWT Login plugin for WordPress prior to version 3.6.8 fails to properly validate the audience of Google identity tokens. This flaw enables unauthenticated users to authenticate themselves as any user associated with the email address contained in such tokens. Consequently, this vulnera...

The Masteriyo LMS WordPress plugin prior to version 2.3.3 lacks proper sanitization and escaping of quiz fields, enabling instructor role users to store unfiltered HTML. This vulnerability could lead to Stored Cross-Site Scripting attacks, affecting all visitors, including administrators, of the ...

The Extra Product Options Builder for WooCommerce plugin prior to version 1.2.176 lacks sufficient verification for user entitlements when serving customer-uploaded files. This vulnerability allows unauthenticated users to retrieve these files if they are aware of their stored names. The plugin's...

The WPvivid — Backup, Migration & Staging WordPress plugin prior to version 0.9.131 contains a vulnerability that allows an unauthenticated attacker, armed with a site-to-site transfer key, to manipulate log file paths. This occurs due to inadequate sanitization of inputs, enabling the attacker t...

The CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 contains an authorization flaw in specific REST API endpoints. This vulnerability allows unauthenticated users to access sensitive information such as the title, type, size, and URL of media attachments linked to ...

The All-in-One WP Migration and Backup plugin for WordPress prior to version 7.108 presents a significant security flaw in multisite environments. This vulnerability permits an administrator of a single subsite to access and execute arbitrary PHP code across the entire network. Without sufficient...

The WP Directory Kit plugin for WordPress, versions prior to 1.5.7, is vulnerable due to improper sanitization and escaping of parameters used in SQL statements. This flaw allows an administrator on a multisite installation to execute SQL injection attacks, potentially granting them unauthorized ...

The ECS WordPress plugin prior to version 4.3.10 features a security flaw where it fails to enforce proper ownership and post-status checks when retrieving custom field values based on user-supplied post identifiers. This oversight permits users with contributor-level access or higher to access a...