mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-23 16:35:19 +00:00
Update CVE PoCs 2026-10-15
This commit is contained in:
CVE-BOT committed
1 parent
d94e936b95
commit
1770c26347
185 files changed
+2794
-106
No files matched your search
@@ -1,3 +1,3 @@
|
||||
{
|
||||
"cvelist_fetch_time": "2026-10-13T09:04:32.347Z"
|
||||
"cvelist_fetch_time": "2026-10-15T07:11:44.947Z"
|
||||
}
|
||||
@@ -1,8 +1,8 @@
|
||||
<div align="center">
|
||||
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=174222-84780-1231" alt="PoC Index" width="100%"></a>
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=174339-84900-1232" alt="PoC Index" width="100%"></a>
|
||||
|
||||
[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
|
||||
[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
|
||||
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>
|
||||
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
### [CVE-2016-15060](https://www.cve.org/CVERecord?id=CVE-2016-15060)
|
||||
**PCMan FTP Server PORT buffer overflow**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.exploit-db.com/exploits/40714
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -13,5 +13,5 @@ Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2
|
||||
No PoCs from references.
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
- https://github.com/Walnut1337/DIR505-webfile-rce
|
||||
|
||||
@@ -14,4 +14,5 @@ No PoCs from references.
|
||||
|
||||
#### Github
|
||||
- https://github.com/staturnzz/lyncis
|
||||
- https://github.com/jamezx32/CVE-2018-4125-4161-4162-4163
|
||||
|
||||
@@ -37,6 +37,7 @@ A remote code execution vulnerability exists in the way that the Chakra scriptin
|
||||
- https://github.com/kai6u/TriBell_Edge_SandBox_Escape
|
||||
- https://github.com/ommadawn46/Chakra-TypeConfusions
|
||||
- https://github.com/ommadawn46/chakra-type-confusions
|
||||
- https://github.com/jamezx32/CVE-2019-0567
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/46203
|
||||
@@ -1,7 +1,10 @@
|
||||
### [CVE-2020-12811](https://www.cve.org/CVERecord?id=CVE-2020-12811)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
@@ -32,6 +32,7 @@ The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote
|
||||
- https://github.com/aprnx/wp-file-manager-poc-chain
|
||||
- https://github.com/w0rmgh4d/Wordpress---Auto-Exploit
|
||||
- https://github.com/HackfutSecRoot/wordpress-auto-upload-shell
|
||||
- https://github.com/Maalfer/CVE-2020-25213-exploit
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25213.yaml
|
||||
|
||||
@@ -1,7 +1,10 @@
|
||||
### [CVE-2020-9287](https://www.cve.org/CVERecord?id=CVE-2020-9287)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
### [CVE-2020-9290](https://www.cve.org/CVERecord?id=CVE-2020-9290)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
@@ -15,5 +15,5 @@ Possible use after free due to improper handling of memory mapping of multiple p
|
||||
No PoCs from references.
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
- https://github.com/Gonvar/movistar-home-root-
|
||||
|
||||
@@ -14,5 +14,5 @@ Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote at
|
||||
No PoCs from references.
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
- https://github.com/jamezx32/CVE-2021-30517
|
||||
|
||||
@@ -16,4 +16,5 @@ No PoCs from references.
|
||||
|
||||
#### Github
|
||||
- https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003
|
||||
- https://github.com/jamezx32/CVE-2021-38003
|
||||
|
||||
@@ -5,9 +5,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -17,4 +17,5 @@ No PoCs from references.
|
||||
#### Github
|
||||
- https://github.com/mistymntncop/CVE-2023-2033
|
||||
- https://github.com/rycbar77/V8Exploits
|
||||
- https://github.com/jamezx32/CVE-2023-2033
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
### [CVE-2023-32643](https://www.cve.org/CVERecord?id=CVE-2023-32643)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,12 +1,7 @@
|
||||
### [CVE-2023-3338](https://www.cve.org/CVERecord?id=CVE-2023-3338)
|
||||
**Crash due to a null pointer dereference in the dn_nsp_send function**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,9 +2,6 @@
|
||||
**Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -3,8 +3,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -12,8 +12,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -21,4 +21,5 @@ No PoCs from references.
|
||||
- https://github.com/hrtowii/cve-2023-41993-test
|
||||
- https://github.com/po6ix/POC-for-CVE-2023-41993
|
||||
- https://github.com/F33DoT530i/QuantumTroll_Break
|
||||
- https://github.com/jamezx32/CVE-2023-41993
|
||||
|
||||
@@ -2,9 +2,6 @@
|
||||
**Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entry**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -16,7 +16,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -3,8 +3,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -4,7 +4,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -3,8 +3,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -3,8 +3,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -14,8 +14,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,12 +1,7 @@
|
||||
### [CVE-2023-6246](https://www.cve.org/CVERecord?id=CVE-2023-6246)
|
||||
**Glibc: heap-based buffer overflow in __vsyslog_internal()**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,12 +1,7 @@
|
||||
### [CVE-2023-6779](https://www.cve.org/CVERecord?id=CVE-2023-6779)
|
||||
**Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,12 +1,7 @@
|
||||
### [CVE-2023-6780](https://www.cve.org/CVERecord?id=CVE-2023-6780)
|
||||
**Glibc: integer overflow in __vsyslog_internal()**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -3,7 +3,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -22,4 +22,5 @@ No PoCs from references.
|
||||
- https://github.com/FuzzySecurity/Cassowary-CVE-2024-23222-x86_64
|
||||
- https://github.com/Rohitberiwala/CVE-2024-23222-Coruna-Exploit-Kit-Deobfuscated
|
||||
- https://github.com/lbr77/cassowary_seedbell_17_js
|
||||
- https://github.com/jamezx32/CVE-2024-23222
|
||||
|
||||
@@ -18,4 +18,5 @@ Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote a
|
||||
- https://github.com/DarkNavySecurity/PoC
|
||||
- https://github.com/mistymntncop/CVE-2024-5274
|
||||
- https://github.com/sdm313/Cyber-security-Projects
|
||||
- https://github.com/jamezx32/CVE-2024-5274
|
||||
|
||||
@@ -1,15 +1,13 @@
|
||||
### [CVE-2025-13465](https://www.cve.org/CVERecord?id=CVE-2025-13465)
|
||||
**Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
|
||||
@@ -3,7 +3,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -5,6 +5,8 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -13,6 +13,8 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
### [CVE-2026-0257](https://www.cve.org/CVERecord?id=CVE-2026-0257)
|
||||
**PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,9 +1,7 @@
|
||||
### [CVE-2026-0265](https://www.cve.org/CVERecord?id=CVE-2026-0265)
|
||||
**PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,9 +1,7 @@
|
||||
### [CVE-2026-0273](https://www.cve.org/CVERecord?id=CVE-2026-0273)
|
||||
**PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,9 +1,7 @@
|
||||
### [CVE-2026-0300](https://www.cve.org/CVERecord?id=CVE-2026-0300)
|
||||
**PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-0993](https://www.cve.org/CVERecord?id=CVE-2026-0993)
|
||||
**SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hml.io/posts/blog-post-cve-2026-0993/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-101301](https://www.cve.org/CVERecord?id=CVE-2026-101301)
|
||||
**WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e60dade1-a7af-4570-bfd6-669d10991d67/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103304](https://www.cve.org/CVERecord?id=CVE-2026-103304)
|
||||
**eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/99069eac-aa52-41da-9d63-3fb9e2a05f4a/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103307](https://www.cve.org/CVERecord?id=CVE-2026-103307)
|
||||
**Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/4e67fefd-56d9-4bfd-9e19-a2b5fff1e7a2/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103308](https://www.cve.org/CVERecord?id=CVE-2026-103308)
|
||||
**Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/26bae5f0-510b-403e-bd69-c4aa2392406d/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103324](https://www.cve.org/CVERecord?id=CVE-2026-103324)
|
||||
**Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/4e23c520-bb92-47b8-a617-0d334820db50/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104643](https://www.cve.org/CVERecord?id=CVE-2026-104643)
|
||||
**Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/8b75ec7a-2b37-4e77-a83a-18b5e6f71d51/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104644](https://www.cve.org/CVERecord?id=CVE-2026-104644)
|
||||
**Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/874eeea9-59a1-4ec0-b884-76d1bb6dba22/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -29,3 +29,4 @@ No PoCs from references.
|
||||
- https://github.com/pochunter/POC-EXPLOIT-CVE-2026-104711
|
||||
- https://github.com/pochunter/POC-for-CVE-2026-104711---New
|
||||
- https://github.com/uday952/CVE-2026-104711-POC---Brand-New
|
||||
- https://github.com/uday952/CVE-2026-104711-POC-NEW-VARIANT
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104751](https://www.cve.org/CVERecord?id=CVE-2026-104751)
|
||||
**Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/b68d607d-aad8-46ad-a522-5eaeea738d8c/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105261](https://www.cve.org/CVERecord?id=CVE-2026-105261)
|
||||
**PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/b340566c-6c45-4391-aefe-76ae7f5ba77f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105969](https://www.cve.org/CVERecord?id=CVE-2026-105969)
|
||||
**CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable identifier.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/bb9fa8cf-413f-45b4-9930-59213104ce28/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105975](https://www.cve.org/CVERecord?id=CVE-2026-105975)
|
||||
**CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment records, and write CamPay Shortcode Payment Gateway WordPress plugin before 1.7 meta onto arbitrary posts.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a5da90f5-563d-4397-b3bc-38bd1dc9aefb/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-106031](https://www.cve.org/CVERecord?id=CVE-2026-106031)
|
||||
**Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/51b61b2b-6bf7-4dee-be8a-907cf5071920/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-106098](https://www.cve.org/CVERecord?id=CVE-2026-106098)
|
||||
**WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f062a098-c00c-49f8-a32a-58b18ebcebe2/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-106099](https://www.cve.org/CVERecord?id=CVE-2026-106099)
|
||||
**WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/65544ed7-d80b-439e-bf8e-73e94041b6bb/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-106166](https://www.cve.org/CVERecord?id=CVE-2026-106166)
|
||||
**NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/aa33ce05-091d-4fef-b875-4fedb8b8fc9d/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-106469](https://www.cve.org/CVERecord?id=CVE-2026-106469)
|
||||
**Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in the session of any user who views or previews the affected form, such as an administrator reviewing a pending post.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/4cccafbb-622e-4363-ade9-dc755d082a9f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-106646](https://www.cve.org/CVERecord?id=CVE-2026-106646)
|
||||
**Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/84adffd9-6982-4c05-a42d-be208035d9a8/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107126](https://www.cve.org/CVERecord?id=CVE-2026-107126)
|
||||
**WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/8496584c-f6b8-44e9-b27d-26d508be6914/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107158](https://www.cve.org/CVERecord?id=CVE-2026-107158)
|
||||
**LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e4c4700a-25c6-4f8f-b017-ea32a81ffcb6/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107160](https://www.cve.org/CVERecord?id=CVE-2026-107160)
|
||||
**LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/2672da6c-f494-4449-90fd-fb1c2dd78235/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107178](https://www.cve.org/CVERecord?id=CVE-2026-107178)
|
||||
**Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/ecc86d5a-7a2f-479e-b5f9-cf86f14fc404/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107319](https://www.cve.org/CVERecord?id=CVE-2026-107319)
|
||||
**GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a5ab2959-a7ba-4b62-8f5e-d2527ffeb1bd/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107320](https://www.cve.org/CVERecord?id=CVE-2026-107320)
|
||||
**GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/034edcec-6aee-481c-8550-6762ab96725f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107508](https://www.cve.org/CVERecord?id=CVE-2026-107508)
|
||||
**Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/2b2808d3-b3fc-41d4-8be5-82d222911bc6/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107594](https://www.cve.org/CVERecord?id=CVE-2026-107594)
|
||||
**File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/bcd5538b-0ad4-4311-b3b6-3fb89d4caa76/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-108064](https://www.cve.org/CVERecord?id=CVE-2026-108064)
|
||||
**WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/5657137d-f496-43f7-9067-e05b99c36006/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-108066](https://www.cve.org/CVERecord?id=CVE-2026-108066)
|
||||
**WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a41461a7-c9f4-4d80-9f15-1ab934206de8/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-108069](https://www.cve.org/CVERecord?id=CVE-2026-108069)
|
||||
**Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/db8bf2bf-1c15-4d41-b576-7c30a92a0e37/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-109145](https://www.cve.org/CVERecord?id=CVE-2026-109145)
|
||||
**User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/62aa4b8c-b9f5-44f4-ac5a-220c14eb719a/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-109157](https://www.cve.org/CVERecord?id=CVE-2026-109157)
|
||||
**TRENDnet TEW-432BRP formTcpipSetup stack-based overflow**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_21/21.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,27 @@
|
||||
### [CVE-2026-109409](https://www.cve.org/CVERecord?id=CVE-2026-109409)
|
||||
**HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://drive.google.com/drive/folders/19JuQt4385UFpRyLXglv80V0uxZujxUE9?usp=drive_link
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -26,7 +26,7 @@ A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://github.com/0xgh0stri13y/CVE-2026-109519/blob/main/POC/exploit.py
|
||||
|
||||
#### Github
|
||||
- https://github.com/0xgh0stri13y/CVE-2026-109519
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-109521](https://www.cve.org/CVERecord?id=CVE-2026-109521)
|
||||
**girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/11
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-109522](https://www.cve.org/CVERecord?id=CVE-2026-109522)
|
||||
**girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/12
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-109523](https://www.cve.org/CVERecord?id=CVE-2026-109523)
|
||||
**girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/13
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-109524](https://www.cve.org/CVERecord?id=CVE-2026-109524)
|
||||
**girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/14
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-109525](https://www.cve.org/CVERecord?id=CVE-2026-109525)
|
||||
**girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/15
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,27 @@
|
||||
### [CVE-2026-109526](https://www.cve.org/CVERecord?id=CVE-2026-109526)
|
||||
**HBAI-Ltd Toonflow-app exportData Endpoint information disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://drive.google.com/drive/folders/13MjPi0zInT9Caau_fqD68FQ0z5fH0YsX?usp=sharing
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-109605](https://www.cve.org/CVERecord?id=CVE-2026-109605)
|
||||
**SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://tracexlabs.com/releases/billing-preauth-admin.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-109606](https://www.cve.org/CVERecord?id=CVE-2026-109606)
|
||||
**SourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://tracexlabs.com/releases/art-gallery-preauth-admin.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-109607](https://www.cve.org/CVERecord?id=CVE-2026-109607)
|
||||
**SourceCodester Online Exam System Login Endpoint loginExe.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://tracexlabs.com/releases/online-exam-sqli-admin.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-109620](https://www.cve.org/CVERecord?id=CVE-2026-109620)
|
||||
**SourceCodester Online Reviewer System index.php prepare sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://tracexlabs.com/releases/online-reviewer-sqli-admin.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-109827](https://www.cve.org/CVERecord?id=CVE-2026-109827)
|
||||
**GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.mediafire.com/file/zbpfhkgaf18cntf/poc_gpac_g1.zip/file
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-109828](https://www.cve.org/CVERecord?id=CVE-2026-109828)
|
||||
**libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/libsndfile/libsndfile/issues/1169
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-109966](https://www.cve.org/CVERecord?id=CVE-2026-109966)
|
||||
**yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/vazzzy071-crypto/security-advisories/blob/main/advisories/2026-10-marcopiovanello-yt-dlp-web-ui-rpc-arg-injection.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-109967](https://www.cve.org/CVERecord?id=CVE-2026-109967)
|
||||
**yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/vazzzy071-crypto/security-advisories/blob/main/advisories/2026-10-marcopiovanello-yt-dlp-web-ui-rpc-arg-injection.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-110536](https://www.cve.org/CVERecord?id=CVE-2026-110536)
|
||||
**D-Link DIR-868L HNAP CGI cgibin system os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Walnut1337/Command-Injection-DIR-868L/tree/main/poc
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-110632](https://www.cve.org/CVERecord?id=CVE-2026-110632)
|
||||
**Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-110633](https://www.cve.org/CVERecord?id=CVE-2026-110633)
|
||||
**MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-110654](https://www.cve.org/CVERecord?id=CVE-2026-110654)
|
||||
**libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hackmd.io/@haind-pwn/zvbi-teletext-drcs-mode-oob-write
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-110655](https://www.cve.org/CVERecord?id=CVE-2026-110655)
|
||||
**miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-110656](https://www.cve.org/CVERecord?id=CVE-2026-110656)
|
||||
**miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-110657](https://www.cve.org/CVERecord?id=CVE-2026-110657)
|
||||
**Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or overwrite '.dat' files when users convert, save, or generate weights.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SJiYagajfe
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-110658](https://www.cve.org/CVERecord?id=CVE-2026-110658)
|
||||
**Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hackmd.io/@haind-pwn/sofia-sip-multipart-oob-read
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-110659](https://www.cve.org/CVERecord?id=CVE-2026-110659)
|
||||
**ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to crash applications via an unvalidated sh_link index. Attackers can supply a crafted ELF file whose SHT_REL or SHT_RELA section has a dangling sh_link, causing find_hash_section() to dereference null and deny service.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hackmd.io/@haind-pwn/elfio-relocation-get-entry-null-deref
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
Loaded 100 of 185 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user