Publicly Disclosed
PoC Exploits

The miniOrange Social Login and Register plugin for WordPress allows attackers to exploit a flaw in the email verification process. Specifically, prior to version 7.8.0, the plugin does not associate the one-time code generated for the email verification feature with the intended user account. Th...

The WOLF WordPress plugin, prior to version 1.1.0, is vulnerable to a Stored Cross-Site Scripting (XSS) attack due to the absence of nonce or capability checks in an AJAX action. This flaw allows unauthenticated attackers to exploit the vulnerability by tricking a logged-in administrator into exe...

The Easy Appointments WordPress plugin, up to version 3.12.26, contains a weakness in its customer-data update process. This vulnerability allows an authenticated user to exploit the nonce verification mechanism. By using a nonce from their own appointment edit form, a subscriber can overwrite th...

The Streamit WordPress theme, up to version 4.5.0, has a significant security vulnerability that lacks proper authorization and nonce verification on certain AJAX routes. This weakness enables unauthenticated attackers to invoke arbitrary PHP functions using custom arguments, potentially allowing...

The PhotoSwipe WordPress plugin is susceptible to a cross-site scripting (XSS) vulnerability due to improper handling of the title attribute in author-supplied link markup. The plugin writes this title attribute as a lightbox caption into the page DOM without applying proper escaping. This oversi...

The PayU CommercePro Plugin for WordPress, specifically versions up to 3.8.9, contains a significant security oversight where it fails to validate payment-gateway signatures prior to executing modifications on orders. This allows unverified attackers to manipulate critical components of WooCommer...

The UsersWP WordPress plugin, prior to version 1.2.67, is susceptible to an authentication bypass vulnerability in its two-factor login handler. This issue arises due to a failure to validate the selected authentication provider, enabling attackers who have obtained a user's credentials to circum...

The wp-media-folder-addon plugin for WordPress (versions up to 4.1.6) is susceptible to security vulnerabilities allowing unauthenticated users to exploit AJAX actions. The plugin fails to properly validate user-supplied parameters during file read operations, which could result in unauthorized a...

The ShinyStat Analytics plugin for WordPress, prior to version 1.0.17, lacks proper authorization checks on one of its REST API endpoints. This flaw allows unauthenticated users to access sensitive information regarding non-published WooCommerce products, including drafts and private listings. As...

The vulnerability allows an attacker to send specially crafted payloads to Microsoft Office SharePoint, potentially resulting in unauthorized remote code execution. This security flaw occurs due to the improper handling of untrusted data. If exploited, it could enable malicious actors to execute ...

An authentication bypass vulnerability exists in the Check Point SmartConsole that enables an unauthenticated attacker to obtain a login token for the application. This allows the attacker to authenticate with full administrative privileges, giving them the ability to alter security policies and ...

The sigstore-js library allows for interactions with Sigstore services but contains a vulnerability where the getRegistryCredentials() function can inadvertently select incorrect credentials. This occurs because the function checks for substring matches with the target registry, rather than ensur...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A buffer overflow vulnerability exists in the httpd daemon of TP-Link TL-WR841N V12 (firmware version 3.16.9) devices, allowing an authenticated remote attacker to execute arbitrary code. This can be exploited through a specially crafted GET request directed at the System Tools page, potentially ...

A cryptographic issue has been identified in IBERMATICA RPS version 2019, allowing unauthorized access to sensitive data. By downloading the log file, an attacker can retrieve SQL queries in plaintext, exposing password hashes encrypted with the AES-CBC-128 bit algorithm. These hashes can be decr...

A race condition vulnerability exists in the Linux kernel that can arise when the NEWTFILTER and DELFILTER actions are executed concurrently. This flaw may lead to a use-after-free (UAF) scenario, resulting in system instability or potential exploitation. The issue was addressed by modifying the ...

A stored Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter's Media Manager due to inadequate validation and sanitization of SVG files. An authenticated user with minimal privileges can upload a malicious SVG file embedded with JavaScript. When administrators view the file, the malic...

The vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows unauthenticated attackers to chain two API endpoints. This exploitation can occur via the /api/v1/auto_login endpoint, which generates SUPERUSER tokens for any caller, in conjunction with the /api/v1/validate/code endpoint...

The TinyWeb server, through version 0.0.8, is susceptible to a path traversal vulnerability that enables unauthorized attackers to access arbitrary files on the server. By exploiting the vulnerability, attackers can manipulate the URL path using '../' sequences, which are directly concatenated to...

NGINX Plus and NGINX Open Source are impacted by a vulnerability in the ngx_stream_ssl_module that arises from improper management of revoked certificates. When both ssl_verify_client and ssl_ocsp directives are enabled, the system may incorrectly allow a TLS handshake to proceed even if an OCSP ...

TinyWeb versions up to 0.0.8 are vulnerable due to a null pointer dereference issue that can be exploited by unauthenticated remote attackers. By sending a malformed HTTP request containing an invalid version string, attackers can trigger a failure in the HttpParser::execute() function. This fail...

TinyWeb, up to version 0.0.8, has a vulnerability that enables unauthenticated attackers to cause significant memory consumption by sending standard HTTP requests. Each request triggers the `HttpParser::execute()` function, which allocates various objects such as Url and HttpHeaders without appro...

Rouille versions 0.3.3 to 3.6.2 are susceptible to an HTTP request smuggling issue. This vulnerability enables remote attackers to circumvent access control mechanisms by injecting bare line feed characters (0x0A) into the request header values. These headers are then sent to upstream connections...

Rouille, a HTTP server framework, has a vulnerability in versions 0.3.3 through 3.6.2 that allows remote attackers to exploit improper header forwarding in its proxy implementation. This flaw occurs when the proxy forwards the client's Transfer-Encoding header to upstream servers without proper m...

Rouille, a web framework by Theopaid, is susceptible to an HTTP response splitting vulnerability that affects versions 0.4.0 through 3.6.2. This security issue arises when attackers embed carriage return (0x0D) or line feed (0x0A) bytes into user-controlled inputs. Such manipulation can allow the...

Rouille versions 0.1.6 through 3.6.2 contain a reachable assertion vulnerability in the Request::remove_prefix function. This flaw enables remote attackers to exploit specific characteristics in crafted percent-encoded URLs, leading to server crashes. When a request is made with a decoded path th...

The tiny-http library, up to version 0.12.0, is susceptible to an HTTP header injection vulnerability. Due to inadequate validation in its header parsing and serialization processes, attackers can inject carriage return (0x0D) and line feed (0x0A) characters into HTTP header values during both re...

The tiny-http library, up to version 0.12.0, is susceptible to an HTTP request smuggling vulnerability due to improper handling of the Transfer-Encoding header. Attackers can exploit this flaw by sending crafted Transfer-Encoding headers, leading tiny-http to incorrectly parse requests and genera...

This vulnerability allows unauthorized command execution in the GPU micronode, leading to potential memory corruption when a specific sequence of commands is executed. Attackers could exploit this weakness to disrupt system functionality or gain access to sensitive areas of memory, posing risks t...

The vulnerability present in Let's Chat versions 0.3.0 through 0.4.8 allows any authenticated user to archive any room on the server via an unrestricted DELETE request to the rooms handler, bypassing necessary ownership checks. This exploitation lets malicious users permanently remove access to p...

The Let's Chat application versions 0.3.0 through 0.4.8 are exposed to a broken access control vulnerability that permits authenticated users to download file attachments from private and password-protected rooms they do not belong to. This vulnerability arises from insufficient checks in the fil...

A null dereference vulnerability has been identified in versions 0.4.0 through 0.4.8 of Let's Chat. This flaw allows authenticated attackers to crash the server by providing a malformed 24-character hexadecimal string as the room parameter in a GET /messages request. If the specified room does no...

Camaleon CMS versions 2.1.1 through 2.9.1 exhibit a security flaw that allows users with specific permissions to execute arbitrary Ruby code. This vulnerability arises from the 'select_eval' custom field type, which permits the storage of malicious Ruby expressions. When a post edit page is rende...

A vulnerability has been identified in the nextlevelbuilder GoClaw product, specifically in the ExecTool.Execute function located in the tools_invoke.go file of the jq Handler component. This flaw allows unauthorized parties to exploit the vulnerability remotely, leading to potential information ...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...

n8n, an open-source workflow automation platform, has a vulnerability that allows authenticated users to exploit crafted expressions within workflow parameters. This can lead to unintended system command execution on the host machine. Versions 2.10.1, 2.9.3, and 1.123.22 have addressed these issu...

The vBulletin platform, including versions 5.x up to 5.7.5 and 6.x up to 6.2.1, is susceptible to an eval injection vulnerability found in the vB5_Template_Runtime::runMaths() method. This issue can be leveraged by unauthenticated attackers who submit specially crafted inputs through the pagenav[...

The vulnerability allows an attacker to exploit an XSS flaw through the naming of uploaded files in SPIP versions prior to 4.1.14 and 4.2.8. This impacts users as malicious scripts can be injected via user-uploaded file names, potentially leading to unauthorized access or data manipulation. Affec...

The FluentCart A New Era of eCommerce WordPress plugin, prior to version 1.4.0, is susceptible to an improper access control vulnerability. This flaw permits authenticated users to manipulate other users' subscriptions without authorization. Specifically, it fails to ensure that a subscription re...

A vulnerability exists in the WPforms plugin for WordPress due to insufficient sanitization and escaping of parameters reflected in the admin page. This oversight may enable attackers to conduct reflected cross-site scripting attacks, targeting users with high-level access, including administrato...

The Tablesome Table plugin for WordPress, specifically versions prior to 1.1.31, has a significant vulnerability that allows unauthenticated users to perform malicious actions. This security flaw arises from the lack of necessary authentication, capability, or nonce checks within a specific AJAX ...

The Event Tickets and Registration plugin for WordPress, prior to version 5.28.4, has a vulnerability where event titles are not appropriately sanitized before being logged in the ticket history. This oversight allows users with the Editor role or above to execute Stored Cross-Site Scripting atta...

The Quiz and Survey Master plugin for WordPress, prior to version 11.1.5, lacks proper capability checks, allowing users with contributor-level access or higher to delete output templates indiscriminately. This vulnerability can lead to unauthorized modifications and significant disruptions, part...

The TrueBooker WordPress plugin is susceptible to a vulnerability that allows unauthenticated attackers to reset passwords for any user account. This flaw exists because the plugin fails to properly validate account ownership during the password reset process. As a result, attackers can exploit t...

The ZTE File Manager contains a vulnerability in its FilePreViewActivity which allows third-party applications to invoke this activity and provide arbitrary file paths. This behavior could potentially enable unauthorized access to various sensitive files within system directories such as /data/da...

The vulnerability allows an attacker to send specially crafted payloads to Microsoft Office SharePoint, potentially resulting in unauthorized remote code execution. This security flaw occurs due to the improper handling of untrusted data. If exploited, it could enable malicious actors to execute ...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

Grav version 2.0.4 is susceptible to a remote code execution vulnerability that arises from the improper handling of callable strings in Blueprint::dynamicData(). This vulnerability allows authenticated users with specific permissions (admin.pages or api.pages.write) to inject malicious commands ...

The BookingPress Appointment Booking Pro plugin for WordPress prior to version 5.7.3 contains a vulnerability that fails to properly enforce REST API authentication. As a result, this oversight allows unauthenticated attackers to gain access to sensitive customer booking data and make unauthorize...

A vulnerability exists in Microsoft Active Directory Certificate Services (AD CS) that allows an authorized attacker to exploit improper authorization mechanisms to elevate privileges within a network. This weakness can potentially enable attackers to access sensitive information, configure permi...