CVE-2021-41753

creationtimestamp| type| source ---|---|--- 2023-07-10 13:19:09+00:00| published-proof-of-concept| https://t.me/ETHICALHACKERSCOMMUNITY2/2706 2026-09-01 20:00:54+00:00| seen| https://t.me/hackingAttack/109427 2026-09-02 01:01:15+00:00| seen| https://t.me/hackingAttack/109427 2026-09-04...

CVE-2021-37910

creationtimestamp| type| source ---|---|--- 2023-07-10 13:19:09+00:00| published-proof-of-concept| https://t.me/ETHICALHACKERSCOMMUNITY2/2706 2026-09-01 20:00:54+00:00| seen| https://t.me/hackingAttack/109427 2026-09-02 01:01:15+00:00| seen| https://t.me/hackingAttack/109427 2026-09-04...

Funds added to reserves through sync are accidentally transferred out to users

Lines of code Vulnerability details Impact Wells have the ability to shift funds to other Wells as part of gas-efficient multi-pool swaps. This natspec explanation of this can be find here. The sync function is intended to synchronize the underlying token amounts with the token reserves of the...

bad actore can increase gas usage in swapfrom function

Lines of code Vulnerability details Impact bad actor can increase gas in swapfrom function because everytime calling swapfrom function it store new unit and everytime runs the loop for length of it Proof of Concept the swapfrom function includes function setReservesIERC20 memory tokens, uint256...

No fee swap is possible through addLiquidity and removeLiquidityImbalanced

Lines of code Vulnerability details impact Some will not pay swap fees even after the swap fee is added. proof of concept This is equivalent to swap 1000 tokenA to 500 tokenB, but no fee calculation code lies in adding and removing liquidity. Add this test in Well.AddLiquidity.t.sol. function...

First liquidity provider can break minting of shares

Lines of code Vulnerability details Impact The attack vector and impact is that users may not receive shares in exchange for their deposits if the total asset amount has been manipulated through a large “donation”. Proof of Concept The attack vector and impact is that users may not receive shares...

cumulativeReserves can be incorrect

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Well updates the pump each time someone interacts with the well. update calculates the mev resistant values, one of which is the cumulativeReserves. If the update function is called twice or more times ...

Pump is not updated in shift function

Lines of code Vulnerability details Impact According to comments in Well contract, updatePumps function "Fetches the current token reserves of the Well and updates the Pumps. Typically called before an operation that modifies the Well's reserves." In functions like swap, add/remove liquidity...

Absence of Function calcReserve(...) at src/interfaces/IBeanstalkWellFunction.sol

Lines of code Vulnerability details Impact Absence of Function calcReserve... at src/interfaces/IBeanstalkWellFunction.sol will affect the implementation of the function, the implementation is done in src/functions/ConstantProduct2.sol but the implementation cannot be accessed at...

CVE-2023-22906

creationtimestamp| type| source ---|---|--- 2023-07-08 23:30:14+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4708 2023-07-09 13:03:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8637 2023-07-09 14:13:16+00:00| published-proof-of-concept|...

Stored Xss in Question field due to lack of sanitization in Link.php

Description Stored XSS Cross-Site Scripting is a type of web application vulnerability that allows an attacker to inject malicious scripts into a website or web application. Unlike reflected XSS, where the malicious script is embedded in a URL and executed immediately, stored XSS involves the...

Stored XSS in description of theme

Description The attacker can execute JavaScript code through the theme's description. Proof of Concept Step 1 : - Choose any theme to upload i used a copy of vanila theme - Open theme folder and change description tag of config.xml file vanilla Bootstrap Vanilla theme 16/10/2017 LimeSurvey GmbH...

Unsafe cast in getCollateralRatio()

Lines of code Vulnerability details Impact LibGetters.getCollateralRatio might return the incorrect ratio due to the unsafe cast. Proof of Concept getCollateralRatio outputs the collateral ratio using the total collaterals and issued agTokens. // The stablecoinsIssued value need to be rounded up...

Incorrect modification authorization amount

Lines of code Vulnerability details Impact In a specific scenario, the authorized transfer amount from N-M M0, N0 will cause the user to lose M+N money. This solution is to first change the authorized amount to N-0 and then to 0-M. This is not the best solution suggested by the article, and it is...

Mozilla: Possibility of Deface through translation tool - www.mozilla.com

A vulnerability was discovered where credentials for a third-party translation tool used by Mozilla websites were publicly disclosed. This exposed access to translation management functions and internal documents. The issue was reported and it was advised that the disclosed passwords be changed t...

CVE-2022-43684

creationtimestamp| type| source ---|---|--- 2023-07-06 12:19:09+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8619 2023-07-07 10:44:24+00:00| published-proof-of-concept| https://t.me/dilagrafie/3117 2026-07-29 12:00:18+00:00| seen| https://t.me/CVEhub/16401 2026-07-30...

CVE-2023-34839

creationtimestamp| type| source ---|---|--- 2023-07-06 12:19:09+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8619 2023-07-07 10:44:24+00:00| published-proof-of-concept| https://t.me/dilagrafie/3117 2026-07-29 12:00:21+00:00| seen| https://t.me/CVEhub/15691 2026-07-30...

stealth of funds

Lines of code Vulnerability details CRITICAL Impact The LSP0ERC725Account contract executes calls to specified targets provided in the arguments, the contract can receive native coins using the payable functions or directly transfered since the contract implements a receive function. However, the...

CVE-2023-36828

creationtimestamp| type| source ---|---|--- 2023-07-05 16:34:47+00:00| published-proof-of-concept| https://github.com/statamic/cms/security/advisories/GHSA-6r5g-cq4q-327g...

Unable to check state() if proposalId == 0

Lines of code Vulnerability details Impact state function cannot be called to view proposal state if proposalId == 0. Proof of Concept There is no check to prevent queueing a proposalId with a value of 0 via the queue function. However, in the state function there is a check preventing using a...