diff --git a/README.md b/README.md index 035982ed0df..27190a50454 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-09%20Sep%202026%2012%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609091207)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C697-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609091207)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-09%20Sep%202026%2013%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609091307)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C697-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609091307)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,22 +12,23 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 12h ago | [CVE-2026-73312](https://github.com/BomboBombone/CVE-2026-73312) | Sanitized XenForo write-up and proof of concept for CVE-2026-73312. | -| 0⭐ | 15h ago | KEV [CVE-2025-55182](https://github.com/r3vpwnx/CVE-2025-55182) | CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight… | +| 0⭐ | 13h ago | [CVE-2026-73318](https://github.com/BomboBombone/CVE-2026-73318) | Sanitized XenForo write-up and proof of concept for CVE-2026-73318. | +| 0⭐ | 13h ago | [CVE-2026-73312](https://github.com/BomboBombone/CVE-2026-73312) | Sanitized XenForo write-up and proof of concept for CVE-2026-73312. | +| 0⭐ | 16h ago | KEV [CVE-2025-55182](https://github.com/r3vpwnx/CVE-2025-55182) | CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight… | | 0⭐ | 2d ago | KEV [CVE-2025-57819](https://github.com/r3vpwnx/CVE-2025-57819) | CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC) | +| 0⭐ | 3d ago | [CVE-2026-49777](https://github.com/katranSefa/CVE-2026-49777) | Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for… | | 0⭐ | 3d ago | [CVE-2025-24799](https://github.com/galisko/CVE-2025-24799) | GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection… | | 0⭐ | 3d ago | KEV [POC-CVE-2025-68613](https://github.com/rmhowe425/POC-CVE-2025-68613) | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4,… | | 0⭐ | 3d ago | [CVE-2025-4255---Buffer-Overflow](https://github.com/Tenor-Z/CVE-2025-4255---Buffer-Overflow) | Exploit Framework for CVE-2025-4255 | | 2⭐ | 3d ago | [CVE-2026-58138](https://github.com/0xBlackash/CVE-2026-58138) | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that… | | 4⭐ | 3d ago | KEV [cve-2026-85046-poc](https://github.com/adriyansyah-mf/cve-2026-85046-poc) | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary… | -| 0⭐ | 4d ago | [CVE-2025-29927-PoC](https://github.com/Ritinify/CVE-2025-29927-PoC) | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior… | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 6⭐ | 10h ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | -| 4⭐ | 10h ago | [CVE-2026-19089-WooCommerce-Tyche](https://github.com/abraxas/CVE-2026-19089-WooCommerce-Tyche) | CVE-2026-19089 WooCommerce Tych Remote Command Execution | +| 6⭐ | 11h ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | +| 4⭐ | 11h ago | [CVE-2026-19089-WooCommerce-Tyche](https://github.com/abraxas/CVE-2026-19089-WooCommerce-Tyche) | CVE-2026-19089 WooCommerce Tych Remote Command Execution | | 824⭐ | 1d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 532⭐ | 1d ago | KEV [cve-2026-41940-PoC](https://github.com/lanicer/cve-2026-41940-PoC) | A cPanel and WHM authentication bypassing tool | | 26⭐ | 2d ago | [CVE-2026-28576-poc](https://github.com/mobilehackinglab/CVE-2026-28576-poc) | SQL injection vulnerability in Android 17 (AOSP) | diff --git a/cves/2026/CVE-2026-67276.md b/cves/2026/CVE-2026-67276.md index fdcf300c0cd..660f900976b 100644 --- a/cves/2026/CVE-2026-67276.md +++ b/cves/2026/CVE-2026-67276.md @@ -18,3 +18,4 @@ RouterOS does not compare the complete RSA public key when matching an SSH authe #### Github - https://github.com/BlackHatExploitation/exploit-mikrotik-2026 - https://github.com/HORKimhab/CVE-2026-67276 +- https://github.com/4rt-Net/Mikrotrick_POC diff --git a/index/github.txt b/index/github.txt index f14d938afd8..2044c01be37 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26679,3 +26679,4 @@ CVE-2026-30368 - https://github.com/truekas/ls-poc CVE-2026-31431 - https://github.com/starscow/Copy-Fail-CVE-2026-31431-Kubernetes-PoC CVE-2026-44402 - https://github.com/Virgula0/CVE-2026-44402 CVE-2026-78838 - https://github.com/nabeelmkhan/CVE-2026-78838 +CVE-2026-67276 - https://github.com/4rt-Net/Mikrotrick_POC diff --git a/index/trending.json b/index/trending.json index 5800b0312eb..38aef68d7cb 100644 --- a/index/trending.json +++ b/index/trending.json @@ -494,6 +494,18 @@ "cve": "CVE-2022-29799", "kev": false }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-73318", + "url": "https://github.com/BomboBombone/CVE-2026-73318", + "desc": "Sanitized XenForo write-up and proof of concept for CVE-2026-73318.", + "pushed": "2026-09-08T23:53:19Z", + "created": "2026-09-08T16:35:46Z", + "cve": "CVE-2026-73318", + "kev": false, + "landed": true + }, { "year": 2026, "stars": 0, @@ -530,6 +542,18 @@ "kev": true, "landed": true }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-49777", + "url": "https://github.com/katranSefa/CVE-2026-49777", + "desc": "Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.", + "pushed": "2026-09-06T11:31:19Z", + "created": "2026-09-06T11:31:01Z", + "cve": "CVE-2026-49777", + "kev": false, + "landed": true + }, { "year": 2025, "stars": 0, @@ -589,17 +613,5 @@ "cve": "CVE-2026-85046", "kev": true, "landed": true - }, - { - "year": 2025, - "stars": 0, - "name": "CVE-2025-29927-PoC", - "url": "https://github.com/Ritinify/CVE-2025-29927-PoC", - "desc": "Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.", - "pushed": "2026-09-05T11:12:01Z", - "created": "2026-09-05T12:41:19Z", - "cve": "CVE-2025-29927", - "kev": false, - "landed": true } ]