shinigami-777

4 exploits Active since Mar 2024
CVE-2025-2568 GITHUB MEDIUM WORKING POC
Vayu Blocks 1.0.4-1.2.1 - Unauthenticated Data Access/Modification via Missing Capability Checks
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the 'vayu_blocks_get_toggle_switch_values_callback' and 'vayu_blocks_save_toggle_switch_callback' function in versions 1.0.4 to 1.2.1. This makes it possible for unauthenticated attackers to read plugin options and update any option with a key name ending in '_value'.
CVSS 5.3
CVE-2025-11579 GITHUB MEDIUM go WORKING POC
nwaples/rardecode <= 2.1.1 - Denial of Service via Large RAR Dictionary Size
github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
CVSS 5.3
CVE-2025-54887 NOMISEC CRITICAL WORKING POC
jwe <1.1.0 - Confidentiality Disclosure
jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk because JWEs can be modified to decrypt to an arbitrary value, decrypted by observing parsing differences and the GCM internal GHASH key can be recovered. Users are affected by this vulnerability even if they do not use an AES-GCM encryption algorithm for their JWEs. As the GHASH key may have been leaked, users must rotate the encryption keys after upgrading. This issue is fixed in version 1.1.1.
CVSS 9.1
CVE-2024-28157 NOMISEC HIGH WORKING POC
Jenkins GitBucket Plugin <= 0.8 - Stored Cross-Site Scripting in Build Views
Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
CVSS 8.0