diff --git a/README.md b/README.md index f9950b922a9..87906eb7a0a 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-06%20Sep%202026%2000%3A06%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609060006)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C651-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609060006)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-06%20Sep%202026%2001%3A06%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609060106)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C651-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609060106)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,23 +12,23 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 3h ago | [CVE-2026-64747](https://github.com/eddinos2/CVE-2026-64747) | Root cause + macOS reachability PoC for CVE-2026-64747 (AppleAVE2 kext buffer overflow, fixed 26.6 /… | -| 0⭐ | 4h ago | KEV [POC-CVE-2025-68613](https://github.com/rmhowe425/POC-CVE-2025-68613) | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4,… | -| 0⭐ | 4h ago | [CVE-2025-4255---Buffer-Overflow](https://github.com/Tenor-Z/CVE-2025-4255---Buffer-Overflow) | Exploit Framework for CVE-2025-4255 | -| 0⭐ | 8h ago | [CVE-2026-84645](https://github.com/mhtsec/CVE-2026-84645) | Jenkins PersistenceRoot Deserialization RCE (SECURITY-3972) - PoC & analysis. Requires Item/Configure;… | -| 0⭐ | 12h ago | [CVE-2025-29927-PoC](https://github.com/Ritinify/CVE-2025-29927-PoC) | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior… | -| 0⭐ | 20h ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | +| 0⭐ | 3m ago | [CVE-2025-24799](https://github.com/galisko/CVE-2025-24799) | GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection… | +| 0⭐ | 4h ago | [CVE-2026-64747](https://github.com/eddinos2/CVE-2026-64747) | Root cause + macOS reachability PoC for CVE-2026-64747 (AppleAVE2 kext buffer overflow, fixed 26.6 /… | +| 0⭐ | 5h ago | KEV [POC-CVE-2025-68613](https://github.com/rmhowe425/POC-CVE-2025-68613) | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4,… | +| 0⭐ | 5h ago | [CVE-2025-4255---Buffer-Overflow](https://github.com/Tenor-Z/CVE-2025-4255---Buffer-Overflow) | Exploit Framework for CVE-2025-4255 | +| 0⭐ | 9h ago | [CVE-2026-84645](https://github.com/mhtsec/CVE-2026-84645) | Jenkins PersistenceRoot Deserialization RCE (SECURITY-3972) - PoC & analysis. Requires Item/Configure;… | +| 0⭐ | 13h ago | [CVE-2025-29927-PoC](https://github.com/Ritinify/CVE-2025-29927-PoC) | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior… | +| 0⭐ | 21h ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | | 1⭐ | 1d ago | [CVE-2025-9974](https://github.com/Rajdave69/CVE-2025-9974) | Proof of Concept code for the CVE-2025-9974 affecting Nokia Beacon routers. | | 0⭐ | 1d ago | [CVE-2026-19516](https://github.com/HORKimhab/CVE-2026-19516) | A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests,… | | 2⭐ | 1d ago | [CVE-2026-65643-PoC-Toolkit](https://github.com/tc4dy/CVE-2026-65643-PoC-Toolkit) | 🧰 CVE-2026-65643 - cPanel Domain Parking RCE Toolkit (CVSS 8.7) / Red/Blue Team suite for unpatched cPanel &… | -| 2⭐ | 1d ago | [CVE-2026-65349](https://github.com/ByteV0rtex/CVE-2026-65349) | CVE-2026-65349 PoC - getattrlist OOB write in vfs_attr_pack_internal (iOS 26.6 / 23G71) | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 3⭐ | 12h ago | [xiaomi15-dada-cve-2026-64560](https://github.com/quyicheng03-boop/xiaomi15-dada-cve-2026-64560) | Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8 | -| 5⭐ | 17h ago | [cve-2026-32475-elementor-pro-lab](https://github.com/dinosn/cve-2026-32475-elementor-pro-lab) | A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via… | +| 3⭐ | 13h ago | [xiaomi15-dada-cve-2026-64560](https://github.com/quyicheng03-boop/xiaomi15-dada-cve-2026-64560) | Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8 | +| 5⭐ | 18h ago | [cve-2026-32475-elementor-pro-lab](https://github.com/dinosn/cve-2026-32475-elementor-pro-lab) | A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via… | | 5⭐ | 1d ago | KEV [CVE-2026-15409-15410-Framework](https://github.com/tc4dy/CVE-2026-15409-15410-Framework) | CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework 🔥 SSRF→Erlang RPC→RCE→root privesc. Features:… | | 3⭐ | 2d ago | [CVE-2026-62735](https://github.com/HackSpeak/CVE-2026-62735) | Windows HTTP.sys integer overflow -> nonpaged pool overflow LPE PoC (CVE-2026-62735): crash + full SYSTEM… | | 8⭐ | 3d ago | [CVE-2026-19490](https://github.com/TarPeg007/CVE-2026-19490) | NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause… | diff --git a/cves/2025/CVE-2025-24799.md b/cves/2025/CVE-2025-24799.md index da6d4a8178f..3ac5ba3f1e7 100644 --- a/cves/2025/CVE-2025-24799.md +++ b/cves/2025/CVE-2025-24799.md @@ -18,6 +18,7 @@ No PoCs from references. - https://github.com/MatheuZSecurity/Exploit-CVE-2025-24799 - https://github.com/MuhammadWaseem29/CVE-2025-24799 - https://github.com/Rosemary1337/CVE-2025-24799 +- https://github.com/galisko/CVE-2025-24799 #### Nuclei - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24799.yaml diff --git a/index/github.txt b/index/github.txt index 5027aab3c6e..bea4dc2f1cf 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26795,3 +26795,4 @@ CVE-2026-1529 - https://github.com/0xlyvio/CVE-2026-1529-Keycloak-Exploit-Tool CVE-2026-64705 - https://github.com/eddinos2/CVE-2026-64705 CVE-2026-64747 - https://github.com/eddinos2/CVE-2026-64747 CVE-2026-27876 - https://github.com/atiilla/CVE-2026-27876 +CVE-2025-24799 - https://github.com/galisko/CVE-2025-24799 diff --git a/index/trending.json b/index/trending.json index 4fa93a35e4e..0be10241f85 100644 --- a/index/trending.json +++ b/index/trending.json @@ -494,6 +494,18 @@ "cve": "CVE-2022-29799", "kev": false }, + { + "year": 2025, + "stars": 0, + "name": "CVE-2025-24799", + "url": "https://github.com/galisko/CVE-2025-24799", + "desc": "GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.", + "pushed": "2026-09-06T01:04:23Z", + "created": "2026-09-06T00:38:05Z", + "cve": "CVE-2025-24799", + "kev": false, + "landed": true + }, { "year": 2026, "stars": 0, @@ -601,17 +613,5 @@ "cve": "CVE-2026-65643", "kev": false, "landed": true - }, - { - "year": 2026, - "stars": 2, - "name": "CVE-2026-65349", - "url": "https://github.com/ByteV0rtex/CVE-2026-65349", - "desc": "CVE-2026-65349 PoC - getattrlist OOB write in vfs_attr_pack_internal (iOS 26.6 / 23G71)", - "pushed": "2026-09-04T05:58:46Z", - "created": "2026-09-02T20:12:31Z", - "cve": "CVE-2026-65349", - "kev": false, - "landed": true } ]