diff --git a/README.md b/README.md index f562b5a84eb..5cfbfd9e6b0 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-27%20Sep%202026%2022%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609272207)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C567-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C211-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609272207)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-27%20Sep%202026%2023%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609272307)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C568-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C211-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609272307)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,23 +12,23 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 2⭐ | 1h ago | [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… | -| 2⭐ | 11h ago | KEV [CVE-2025-21479-FX5P](https://github.com/diyiqiuye/CVE-2025-21479-FX5P) | Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) | -| 0⭐ | 12h ago | KEV [Reproduce-CVE-2025-32433](https://github.com/X-Bulow/Reproduce-CVE-2025-32433) | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3,… | -| 0⭐ | 15h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | -| 0⭐ | 20h ago | [POC-CVE-2025-11201](https://github.com/rmhowe425/POC-CVE-2025-11201) | PoC for MLFlow unauth RCE | +| 0⭐ | 22m ago | [ply-cve-2025-56005-lab](https://github.com/gdfurr98/ply-cve-2025-56005-lab) | Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the… | +| 2⭐ | 2h ago | [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… | +| 2⭐ | 12h ago | KEV [CVE-2025-21479-FX5P](https://github.com/diyiqiuye/CVE-2025-21479-FX5P) | Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) | +| 0⭐ | 13h ago | KEV [Reproduce-CVE-2025-32433](https://github.com/X-Bulow/Reproduce-CVE-2025-32433) | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3,… | +| 0⭐ | 16h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | +| 0⭐ | 21h ago | [POC-CVE-2025-11201](https://github.com/rmhowe425/POC-CVE-2025-11201) | PoC for MLFlow unauth RCE | | 0⭐ | 1d ago | [CVE-2026-13249](https://github.com/murrez/CVE-2026-13249) | Unauthenticated arbitrary file upload on Honeywell PD45 web admin (firmware F10.19.010040-before… | | 0⭐ | 1d ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | | 1⭐ | 2d ago | [opace6-cve-2026-64560](https://github.com/Wangs-official/opace6-cve-2026-64560) | 针对 OnePlus Ace6 设备的 cve-2026-64560 复现 | | 1⭐ | 2d ago | KEV [CVE-2026-59310-POC](https://github.com/ChinaRan0/CVE-2026-59310-POC) | CVE-2026-59310-POC 仅用于自测，请勿用于攻击 | -| 1⭐ | 2d ago | [CVE-2026-14281](https://github.com/murrez/CVE-2026-14281) | Unauthenticated privilege escalation in WordPress WAWP (Automation Web Platform) ≤ 4.8.6 via public REST… | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 7⭐ | 11h ago | KEV [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | -| 6⭐ | 12h ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… | +| 7⭐ | 12h ago | KEV [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | +| 6⭐ | 13h ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… | | 825⭐ | 1d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 3⭐ | 1d ago | KEV [CVE-2026-mikrotik-poc](https://github.com/gagaltotal/CVE-2026-mikrotik-poc) | CVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH | | 10⭐ | 1d ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI Drone DUML Command Injection over Bluetooth - Proof of Concept for CVE-2026-78306 | diff --git a/cves/2025/CVE-2025-56005.md b/cves/2025/CVE-2025-56005.md index 9201ad7f273..45b2892c426 100644 --- a/cves/2025/CVE-2025-56005.md +++ b/cves/2025/CVE-2025-56005.md @@ -14,3 +14,5 @@ No PoCs from references. #### Github - https://github.com/tom025/ply_exploit_rejection +- https://github.com/gdfurr98/ply-cve-2025-56005-lab +- https://github.com/gdfurr98/ply-safepickle diff --git a/cves/2026/CVE-2026-44011.md b/cves/2026/CVE-2026-44011.md index d8740cfd22f..cb104f32493 100644 --- a/cves/2026/CVE-2026-44011.md +++ b/cves/2026/CVE-2026-44011.md @@ -19,3 +19,4 @@ No PoCs from references. - https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce - https://github.com/DENNISDGR/CVE-2026-44011-poc - https://github.com/Cyberuser-hash/CVE-2026-44011-craft-rce-poc +- https://github.com/khush-613/CVE-2026-44011-poc diff --git a/cves/2026/CVE-2026-71963.md b/cves/2026/CVE-2026-71963.md index 55573d775af..72e5dfd9755 100644 --- a/cves/2026/CVE-2026-71963.md +++ b/cves/2026/CVE-2026-71963.md @@ -15,4 +15,4 @@ Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote c - https://www.manifold.security/blog/ai-coding-agents-git-hijack #### Github -No PoCs found on GitHub currently. +- https://github.com/Boreas37/CVE-2026-71963-PoC diff --git a/cves/2026/CVE-2026-88008.md b/cves/2026/CVE-2026-88008.md new file mode 100644 index 00000000000..172ca615cbd --- /dev/null +++ b/cves/2026/CVE-2026-88008.md @@ -0,0 +1,20 @@ +### [CVE-2026-88008](https://www.cve.org/CVERecord?id=CVE-2026-88008) +**Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization** +![](https://img.shields.io/static/v1?label=Vendor&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.11.26%2C%20%3C%202.11.57&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.4.2%2C%20%3C%203.7.13&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-444%3A%20Inconsistent%20Interpretation%20of%20HTTP%20Requests%20%28%27HTTP%20Request%2FResponse%20Smuggling%27%29&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/Boreas37/CVE-2026-88008-PoC diff --git a/docs/hero.svg b/docs/hero.svg index 60c3af35d32..452e4dcb8c4 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 83,568 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 172,878 + fill="#e6edf3" letter-spacing="-0.5">172,879 CVES INDEXED83,567 + fill="#2f81f7" letter-spacing="-0.5">83,568 WITH POCS1,211 diff --git a/docs/social-card.svg b/docs/social-card.svg index 0fb043f4410..4298b46e149 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 172,878 + fill="#e6edf3" letter-spacing="-0.5">172,879 CVES INDEXED83,567 + fill="#2f81f7" letter-spacing="-0.5">83,568 WITH POCS1,211 diff --git a/docs/stats.json b/docs/stats.json index 02b9b202e78..6257d102815 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1211, - "total_cves": 172878, - "with_pocs": 83567 + "total_cves": 172879, + "with_pocs": 83568 } diff --git a/index/github.txt b/index/github.txt index f47c869f9c0..92789c23a9a 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26959,3 +26959,8 @@ CVE-2026-44011 - https://github.com/Cyberuser-hash/CVE-2026-44011-craft-rce-poc CVE-2026-87902 - https://github.com/Maalfer/CVE-2026-87902-exploit CVE-2026-88772 - https://github.com/murrez/CVE-2026-88772 CVE-2026-34990 - https://github.com/khush-613/CVE-2026-34990-poc +CVE-2025-56005 - https://github.com/gdfurr98/ply-cve-2025-56005-lab +CVE-2025-56005 - https://github.com/gdfurr98/ply-safepickle +CVE-2026-44011 - https://github.com/khush-613/CVE-2026-44011-poc +CVE-2026-71963 - https://github.com/Boreas37/CVE-2026-71963-PoC +CVE-2026-88008 - https://github.com/Boreas37/CVE-2026-88008-PoC diff --git a/index/trending.json b/index/trending.json index 642e342632d..338a3f24688 100644 --- a/index/trending.json +++ b/index/trending.json @@ -461,6 +461,18 @@ "cve": "CVE-2023-32315", "kev": true }, + { + "year": 2025, + "stars": 0, + "name": "ply-cve-2025-56005-lab", + "url": "https://github.com/gdfurr98/ply-cve-2025-56005-lab", + "desc": "Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the debate about RCE notwithstanding here), and shows that ply-safepickle does block the exploit path.", + "pushed": "2026-09-27T22:47:26Z", + "created": "2026-09-27T22:49:37Z", + "cve": "CVE-2025-56005", + "kev": false, + "landed": true + }, { "year": 2026, "stars": 2, @@ -568,17 +580,5 @@ "cve": "CVE-2026-59310", "kev": true, "landed": true - }, - { - "year": 2026, - "stars": 1, - "name": "CVE-2026-14281", - "url": "https://github.com/murrez/CVE-2026-14281", - "desc": "Unauthenticated privilege escalation in WordPress WAWP (Automation Web Platform) ≤ 4.8.6 via public REST signup and unsanitized wawp_custom_fields → admin. Python check/exploit PoC (PoCbit).", - "pushed": "2026-09-25T07:44:05Z", - "created": "2026-09-25T07:43:43Z", - "cve": "CVE-2026-14281", - "kev": false, - "landed": true } ]