Publicly Disclosed
PoC Exploits

Craft CMS contains an input-handling flaw that allows authenticated users to manipulate configuration settings and execute arbitrary commands on the server. This vulnerability arises from a flaw in the Yii object creation path, where request-controlled condition fields are incorrectly handled. Du...

OpenPrinting's CUPS, an open source printing system for Linux and other Unix-like operating systems, is susceptible to a local privilege escalation vulnerability. An unprivileged user can exploit this flaw to trick the cupsd service into authenticating with an attacker-controlled IPP service on l...

Craft CMS suffers from a Remote Code Execution vulnerability due to an authenticated admin exploit via Server-Side Template Injection. This flaw arises from the use of the create() Twig function, which allows attackers to instantiate arbitrary PHP classes, leveraging the Symfony Process component...

A vulnerability exists in the Athlon1600 YouTube-Downloader, specifically in the `stream` function of `public/stream.php`. This weakness allows an attacker to manipulate the `url` argument, which could lead to unauthorized server-side requests. The issue can be exploited remotely, putting servers...

A server-side request forgery (SSRF) vulnerability exists in the DevaslanPHP project-management tool, specifically within the updateJiraProjects function located in the /jira-import component. This flaw allows an attacker to manipulate the host, username, and token parameters, potentially leading...

A significant vulnerability has been identified in the DevaslanPHP project management platform that could allow remote attackers to execute SQL injection attacks. This flaw specifically affects the 'whereRaw' function within the 'MonthlyReport.php' file of the Timesheet Dashboard component, where...

A SQL injection vulnerability exists in the DevaslanPHP project management application's Timesheet Dashboard. Specifically, the issue is located in the app/Filament/Widgets/Timesheet/ActivitiesReport.php file within the whereRaw function. This vulnerability allows attackers to exploit improperly ...

A vulnerability has been discovered in the TOTOLINK N150RT router that allows for OS command injection via the web management interface. This issue is specifically related to the manipulation of the 'wlanif' argument in the /boafrm/formWlSiteSurvey function. Attackers can remotely exploit this we...

The User Profile Builder WordPress plugin prior to version 4.0.1 exhibits a flaw in its deserialization process, failing to properly validate the data when importing configuration files. This vulnerability enables high privilege users, such as administrators, to potentially perform PHP Object Inj...

A vulnerability in Trusted Domain Project OpenARC has been identified in the arc_parse_canon_t function within the libopenarc/arc-canon.c library, specifically impacting versions up to 1.0.0.Beta1. This security loophole allows for a potential null pointer dereference, enabling attackers to explo...

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project, particularly affecting the updateguest.php script. By manipulating the 'gname' parameter, an attacker could execute unauthorized SQL commands. This remote exploit poses a risk as attackers might utilize publicly ...

A security flaw has been identified in the Privoce VoceChat Server, specifically impacting the open_graph::fetch function within the src/api/resource.rs component. This vulnerability allows an attacker to manipulate the 'url' argument, potentially leading to server-side request forgery. The explo...

A vulnerability exists in the Linux kernel that concerns the handling of shared skb fragments during the decryption process in ESP-in-UDP packets. When pages are attached from a pipe directly to an skb using MSG_SPLICE_PAGES, the kernel marked these SKBs with SKBFL_SHARED_FRAG, which plays a cruc...

A vulnerability has been identified in the Trusted Domain Project OpenDKIM, specifically within the dkim_qp_decode function in the util.c file. This flaw can lead to an off-by-one error, which poses a risk of exploitation by remote attackers. The exploit details have been made public, indicating ...

A vulnerability has been located in the Trusted Domain Project's OpenDKIM versions up to 2.11.0, specifically in the function dkim_canon_selecthdrs, part of the DKIM Signature Header Selection component. This issue arises from a manipulation of arguments leading to potential out-of-bounds write c...

A vulnerability has been identified in PDF.js, specifically related to a missing type check when processing fonts. This oversight permits arbitrary JavaScript execution within the PDF.js environment. As a result, users of affected versions of Mozilla Firefox and Thunderbird could be vulnerable to...

A security flaw has been located in the Mini Inventory and Sales Management System developed by amirsanni. The vulnerability lies within the 'order_by' function in the DB_query_builder.php file of the Database Query Builder component. By manipulating the 'orderBy' argument, an attacker can potent...

A vulnerability has been identified in Seetong’s product line, specifically within the Debug Service component, used in models T8108, T8108P, T8116, and T8232. This flaw allows for improper authentication, making it possible for attackers to exploit the system remotely. The exploit is readily ava...

A vulnerability in Krayin Laravel-CRM versions up to 2.2.4 allows for authorization bypass through an unspecified function in the admin-config-setup API endpoint, specifically located in CanInstall.php. This vulnerability can be exploited remotely, posing a significant security risk. Users are st...

A vulnerability in the Krayin Laravel CRM, specifically in versions up to 2.2.5, has been identified. The flaw lies in the Storage::download function within the acl.php file of the attachment-download endpoint, where inadequate control over resource identifiers allows for potential exploitation. ...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A vulnerability exists in versions up to 2.2.5 of Krayin Laravel-CRM, specifically within the acl.php file, where an unknown function can be exploited to manipulate access controls improperly. This issue can be triggered remotely, posing a significant risk to the application. The vulnerability ha...

A cross-site scripting vulnerability exists in the Krayin Laravel-CRM platform, specifically affecting the Admin Settings Endpoint in versions up to 2.2.5. This vulnerability is due to improper handling of user-supplied input, allowing attackers to manipulate the argument 'general.settings.footer...

A vulnerability has been identified in zhistaredu's StarTraining product, specifically affecting versions up to 3.8.1. This flaw involves improper handling of the application.yml file, allowing an attacker to manipulate the xss.enabled argument. As a result, the application is susceptible to cros...

A vulnerability has been discovered in the upload endpoint of zhistaredu StarTraining versions up to 3.8.1. This issue resides within the MimeTypeUtils.java file, where inadequate validation of uploaded files can lead to cross-site scripting (XSS) attacks. Attackers could exploit this vulnerabili...

A security vulnerability exists in zhistaredu StarTraining versions up to 3.8.1, specifically in the dataScope Endpoint's function checkRoleAllowed found in SysRoleServiceImpl.java. This flaw enables attackers to manipulate authorization checks, potentially allowing unauthorized actions without p...

An authorization bypass vulnerability exists in the zhistaredu StarTraining application, specifically within the SysUser.isAdmin function in the authRole Endpoint. This issue arises due to inadequate validation of the userId and roleIds parameters, allowing an unauthorized user to gain administra...

The Roundcube Webmail application versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1 contain a pre-authentication SQL injection vulnerability in the virtuser_query plugin. This issue arises from a bypass of backslash escape sequences in the preg_replace() function, which may allow an attacke...

A vulnerability exists in the CloudClassroom-PHP-Project, specifically in the functionality of registrationform.php. This flaw allows for cross site scripting via manipulation of the FName, LName, and Addrs arguments. Due to this vulnerability, remote attackers could execute malicious scripts, pu...

The Contrast software by Edgeless Systems prior to version 1.16.0 is vulnerable to remote attestation relay attacks. This occurs when an attacker can intercept network traffic and manipulate attestation reports. Contrast's system accepted any attestation report that validated correctly, irrespect...

A vulnerability exists in the mathurvishal CloudClassroom-PHP-Project primarily located in the loginlinkstudent.php file. This flaw arises from the improper handling of the user email argument, allowing unauthorized access due to missing authentication checks. The vulnerability has been exploited...

A vulnerability exists in mathurvishal's CloudClassroom-PHP-Project that affects the 'updatedetailsfromfaculty.php' file. This issue allows for SQL injection through manipulation of the 'myfid' parameter, potentially enabling remote attackers to execute arbitrary SQL code. As the product follows ...

Craft CMS contains an input-handling flaw that allows authenticated users to manipulate configuration settings and execute arbitrary commands on the server. This vulnerability arises from a flaw in the Yii object creation path, where request-controlled condition fields are incorrectly handled. Du...

The Wyoming application prior to version 1.10.2 is vulnerable to a server-side request forgery attack. This vulnerability allows unauthenticated attackers with network access to manipulate the application's outgoing connections by passing malicious `uri` query parameters to the HTTP API. Specific...

A vulnerability exists in MLflow Tracking Server that allows remote attackers to exploit improper validation in model file paths. This oversight can lead to directory traversal attacks, enabling malicious users to execute arbitrary code within the context of the service account. Importantly, this...

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log messag...

The Ultra Addons for Contact Form 7 plugin for WordPress contains a vulnerability that allows unauthorized file uploads due to inadequate validation of file types in the 'uacf7_wpcf7_mail_components' function. This weakness affects all versions up to and including 3.5.50. When exploited, particul...

The PowerPress Podcasting plugin, developed by Blubrry, is susceptible to a stored cross-site scripting vulnerability due to inadequate sanitization and escaping of a block attribute before it is rendered on a webpage. This flaw permits users with contributor privileges and higher to inject malic...

The Optima Express IDX plugin for WordPress prior to version 8.7.6 has a serious issue where it fails to implement authorization checks for certain AJAX actions accessible to users who are not logged in. This could allow unauthorized attackers to create an account with fixed author-role privilege...

The Optima Express IDX WordPress plugin versions prior to 8.7.6 are vulnerable due to inadequate sanitization of script values submitted via its REST endpoints. This oversight potentially allows users with even minimal permissions, such as authors, to execute Stored Cross-Site Scripting (XSS) att...

The Malcure Malware Shield plugin for WordPress before version 19.9.7 is susceptible to an authorization bypass vulnerability. This flaw allows individuals with a subsite administrator role on a multisite WordPress network to perform AJAX actions without proper authorization checks. As a result, ...

The NextScripts: Social Networks Auto-Poster plugin for WordPress, versions before 4.4.8, suffers from improper access control. It fails to implement adequate capability and ownership checks on several AJAX actions, relying solely on a nonce for security. This oversight enables users with adminis...

The WP YouTube Lyte plugin for WordPress, prior to version 1.7.31, contains a vulnerability that fails to properly escape YouTube embed block attributes. This inadequate escaping can lead to the execution of stored Cross-Site Scripting (XSS) attacks by users with minimal privileges, such as contr...

The Verge3D Publishing and E-Commerce WordPress plugin prior to version 4.13.0 exhibits improper access control, which allows unauthenticated users to access sensitive file-download handlers. As a result, attackers may exploit this vulnerability to gain unauthorized access to digital goods files ...

The WPeMatico RSS Feed Fetcher plugin for WordPress prior to version 2.8.27 has a serious oversight in its handling of imported feed content. It fails to properly sanitize this content before it is saved as post content. This flaw permits users with Contributor roles and higher to exploit the vul...

The WPeMatico RSS Feed Fetcher plugin for WordPress prior to version 2.8.27 suffers from improper access control. This vulnerability allows users with contributor-level access and above to publish posts without adequate permissions. Users can attribute published content to any registered user, in...

The Mailchimp for WooCommerce plugin prior to version 6.3 is susceptible to an authentication bypass vulnerability. This issue arises from the plugin's failure to require proper authentication or verify ownership when loading a saved cart using a request-supplied identifier linked to a customer's...

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable due to inadequate capability checks when processing user-supplied URLs. This flaw allows users with contributor-level access and higher permissions to manipulate the plugin into making unauthorized requests to internal servers, the...

The Online Scheduling and Appointment Booking System plugin for WordPress fails to adequately verify the ownership of appointment and payment records during AJAX requests made by staff members. This flaw allows authenticated users with staff-level accounts to access, alter, and delete appointment...

The WPeMatico RSS Feed Fetcher plugin, prior to version 2.8.27, lacks proper capability checks and does not validate the destination of user-supplied feed URLs. This oversight permits users with contributor-level access or higher to generate server-side requests to internal-only resources, potent...