diff --git a/README.md b/README.md index ba493e7489a..3a354de5cc2 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-09%20Sep%202026%2020%3A08%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609092008)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C700-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609092008)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-09%20Sep%202026%2021%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609092107)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C701-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609092107)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,9 +12,10 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 20h ago | [CVE-2026-73312](https://github.com/BomboBombone/CVE-2026-73312) | Sanitized XenForo write-up and proof of concept for CVE-2026-73312. | -| 0⭐ | 23h ago | KEV [CVE-2025-55182](https://github.com/r3vpwnx/CVE-2025-55182) | CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight… | -| 0⭐ | 2d ago | KEV [CVE-2025-57819](https://github.com/r3vpwnx/CVE-2025-57819) | CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC) | +| 0⭐ | 21h ago | [CVE-2026-73312](https://github.com/BomboBombone/CVE-2026-73312) | Sanitized XenForo write-up and proof of concept for CVE-2026-73312. | +| 0⭐ | 1d ago | KEV [CVE-2025-55182](https://github.com/r3vpwnx/CVE-2025-55182) | CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight… | +| 2⭐ | 1d ago | [CVE-2026-69451-PoC](https://github.com/fj016/CVE-2026-69451-PoC) | PoC for the CVE-2026-69451 - Fastprox EoP | +| 0⭐ | 3d ago | KEV [CVE-2025-57819](https://github.com/r3vpwnx/CVE-2025-57819) | CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC) | | 0⭐ | 3d ago | [CVE-2025-24799](https://github.com/galisko/CVE-2025-24799) | GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection… | | 0⭐ | 4d ago | KEV [POC-CVE-2025-68613](https://github.com/rmhowe425/POC-CVE-2025-68613) | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4,… | | 0⭐ | 4d ago | [CVE-2025-4255---Buffer-Overflow](https://github.com/Tenor-Z/CVE-2025-4255---Buffer-Overflow) | Exploit Framework for CVE-2025-4255 | @@ -26,8 +27,8 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 10⭐ | 18h ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | -| 5⭐ | 18h ago | [CVE-2026-19089-WooCommerce-Tyche](https://github.com/abraxas/CVE-2026-19089-WooCommerce-Tyche) | CVE-2026-19089 WooCommerce Tych Remote Command Execution | +| 11⭐ | 19h ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | +| 5⭐ | 19h ago | [CVE-2026-19089-WooCommerce-Tyche](https://github.com/abraxas/CVE-2026-19089-WooCommerce-Tyche) | CVE-2026-19089 WooCommerce Tych Remote Command Execution | | 824⭐ | 2d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 532⭐ | 2d ago | KEV [cve-2026-41940-PoC](https://github.com/lanicer/cve-2026-41940-PoC) | A cPanel and WHM authentication bypassing tool | | 26⭐ | 2d ago | [CVE-2026-28576-poc](https://github.com/mobilehackinglab/CVE-2026-28576-poc) | SQL injection vulnerability in Android 17 (AOSP) | @@ -60,7 +61,7 @@ | 4⭐ | 52d ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads | | 5⭐ | 54d ago | KEV [CVE-2025-8110-gogs-poc](https://github.com/Shirouuu/CVE-2025-8110-gogs-poc) | PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink | | 7⭐ | 63d ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… | -| 4⭐ | 68d ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… | +| 4⭐ | 69d ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… | | 3⭐ | 69d ago | KEV [CVE-2025-57819](https://github.com/K3ysTr0K3R/CVE-2025-57819) | CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) | | 4⭐ | 73d ago | [CVE-2025-69212-PoC](https://github.com/tohib09/CVE-2025-69212-PoC) | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and… | | 5⭐ | 76d ago | KEV [CVE-2025-8110](https://github.com/joaquinrrr/CVE-2025-8110) | PoC exploit for CVE-2025-8110 | @@ -85,7 +86,7 @@ | --- | --- | --- | --- | | 3⭐ | 44d ago | [CVE-2023-52076-PoC](https://github.com/Groppoxx/CVE-2023-52076-PoC) | PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary… | | 5⭐ | 49d ago | [CVE-2023-36003](https://github.com/johnnygreeme/CVE-2023-36003) | PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender. | -| 3⭐ | 63d ago | KEV [cve-2023-4911-exploit-optimized](https://github.com/jarpex/cve-2023-4911-exploit-optimized) | Pure C exploit for CVE-2023-4911 (Looney Tunables) - x86_64 & aarch64 implementations. Multi-processing… | +| 3⭐ | 64d ago | KEV [cve-2023-4911-exploit-optimized](https://github.com/jarpex/cve-2023-4911-exploit-optimized) | Pure C exploit for CVE-2023-4911 (Looney Tunables) - x86_64 & aarch64 implementations. Multi-processing… | | 15⭐ | 66d ago | KEV [CVE-2023-32315-EXPLOIT](https://github.com/K3ysTr0K3R/CVE-2023-32315-EXPLOIT) | A PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass | | 6⭐ | 82d ago | [CVE-2023-6019](https://github.com/joaquinrrr/CVE-2023-6019) | PoC exploit for CVE-2023-6019 - Remote Code Execution via unauthenticated Ray Dashboard Jobs API. | diff --git a/cves/2026/CVE-2026-76578.md b/cves/2026/CVE-2026-76578.md new file mode 100644 index 00000000000..d049f2674e2 --- /dev/null +++ b/cves/2026/CVE-2026-76578.md @@ -0,0 +1,22 @@ +### [CVE-2026-76578](https://www.cve.org/CVERecord?id=CVE-2026-76578) +**Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci** +![](https://img.shields.io/static/v1?label=Vendor&message=Red%20Hat&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%206&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%207&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) + +### Description + +A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/BrainBob/CVE-2026-76578 diff --git a/docs/hero.svg b/docs/hero.svg index 2471037f7b6..91f379c673f 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 82,701 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 171,536 + fill="#e6edf3" letter-spacing="-0.5">171,537 CVES INDEXED82,700 + fill="#2f81f7" letter-spacing="-0.5">82,701 WITH POCS1,186 diff --git a/docs/social-card.svg b/docs/social-card.svg index e61a350f04a..c6e89f2b67f 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 171,536 + fill="#e6edf3" letter-spacing="-0.5">171,537 CVES INDEXED82,700 + fill="#2f81f7" letter-spacing="-0.5">82,701 WITH POCS1,186 diff --git a/docs/stats.json b/docs/stats.json index e6570741233..22be3644d88 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1186, - "total_cves": 171536, - "with_pocs": 82700 + "total_cves": 171537, + "with_pocs": 82701 } diff --git a/index/github.txt b/index/github.txt index b2bd267a46e..087b3ecaba2 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26686,3 +26686,4 @@ CVE-2026-67401 - https://github.com/jithinkrishnanrs/CVE-2026-67401-cPanel-Email CVE-2026-1337 - https://github.com/Bangkah/apache-auth-bypass-poc CVE-2026-11387 - https://github.com/abraxas/CVE-2026-11387-WooCommerce-SMS-OTP CVE-2026-41940 - https://github.com/Xrzmodz444/cve-2026-41940-PoC-Linux +CVE-2026-76578 - https://github.com/BrainBob/CVE-2026-76578 diff --git a/index/trending.json b/index/trending.json index 6fc0fb4abc7..2a25402a8ae 100644 --- a/index/trending.json +++ b/index/trending.json @@ -1,7 +1,7 @@ [ { "year": 2026, - "stars": 10, + "stars": 11, "name": "CVE-2026-83991-writeup-and-poc", "url": "https://github.com/karollooool/CVE-2026-83991-writeup-and-poc", "desc": "CVE-2026-83991: Windows Cloud Files access-check bypass", @@ -518,6 +518,18 @@ "kev": true, "landed": true }, + { + "year": 2026, + "stars": 2, + "name": "CVE-2026-69451-PoC", + "url": "https://github.com/fj016/CVE-2026-69451-PoC", + "desc": "PoC for the CVE-2026-69451 - Fastprox EoP", + "pushed": "2026-09-08T11:25:06Z", + "created": "2026-09-07T20:18:07Z", + "cve": "CVE-2026-69451", + "kev": false, + "landed": true + }, { "year": 2025, "stars": 0,