diff --git a/README.md b/README.md index a45fe3cab40..0188abb5e9f 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-17%20Sep%202026%2014%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609171407)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C957-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C199-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609171407)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-17%20Sep%202026%2015%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609171507)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C960-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C199-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609171507)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,14 +12,14 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 7h ago | [CVE-2026-67401](https://github.com/imbas007/CVE-2026-67401) | PoC for CVE-2026-67401 - cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE.… | -| 2⭐ | 11h ago | KEV [CVE-2025-32432-exploit-by-P34NUT](https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT) | Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail | -| 2⭐ | 23h ago | [CVE-2026-12793](https://github.com/murrez/CVE-2026-12793) | CVE-2026-12793 PoC - JetFormBuilder ≤3.6.2 unauth Register User / admin account creation | +| 0⭐ | 8h ago | [CVE-2026-67401](https://github.com/imbas007/CVE-2026-67401) | PoC for CVE-2026-67401 - cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE.… | +| 2⭐ | 12h ago | KEV [CVE-2025-32432-exploit-by-P34NUT](https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT) | Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail | +| 2⭐ | 1d ago | [CVE-2026-12793](https://github.com/murrez/CVE-2026-12793) | CVE-2026-12793 PoC - JetFormBuilder ≤3.6.2 unauth Register User / admin account creation | | 0⭐ | 1d ago | KEV [lenovo_y700_tb320fc_on_CVE-2025-21479](https://github.com/xjoker/lenovo_y700_tb320fc_on_CVE-2025-21479) | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… | | 1⭐ | 1d ago | [CVE-2025-57231](https://github.com/anirbala98/CVE-2025-57231) | Docmost < 0.22.0 - Arbitrary File Read | | 0⭐ | 1d ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | | 1⭐ | 1d ago | [langflow-CVE-2026-17633-PoC](https://github.com/Oscar-Collado/langflow-CVE-2026-17633-PoC) | PoC for CVE-2026-17633 - Authenticated RCE in IBM Langflow OSS 1.0.0-1.10.3 via custom_component endpoint.… | -| 0⭐ | 1d ago | KEV [CVE-2025-24813](https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-24813) | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure… | +| 0⭐ | 2d ago | KEV [CVE-2025-24813](https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-24813) | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure… | | 0⭐ | 2d ago | [CVE-2025-64512_PoC](https://github.com/Jinook-Kim/CVE-2025-64512_PoC) | Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from… | | 0⭐ | 2d ago | KEV [CVE-2026-33017](https://github.com/Oieua/CVE-2026-33017) | My implementation of the | @@ -27,8 +27,8 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 15⭐ | 18h ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | -| 287⭐ | 1d ago | KEV [cve-2026-41940-PoC](https://github.com/ctdal/cve-2026-41940-PoC) | A cPanel and WHM authentication bypassing tool | +| 15⭐ | 19h ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | +| 303⭐ | 1d ago | KEV [cve-2026-41940-PoC](https://github.com/ctdal/cve-2026-41940-PoC) | A cPanel and WHM authentication bypassing tool | | 3⭐ | 1d ago | [POC-AIOWPM-CVE-2026-19949](https://github.com/686f6c61/POC-AIOWPM-CVE-2026-19949) | PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <=… | | 3⭐ | 1d ago | [CVE-2026-12944](https://github.com/cflowsec/CVE-2026-12944) | Langflow 1.10.0 urllib SSRF POC | | 16⭐ | 3d ago | [CVE-2026-31694-POC](https://github.com/0xCyberstan/CVE-2026-31694-POC) | Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a… | @@ -36,7 +36,7 @@ | 4⭐ | 3d ago | KEV [CVE-2026-73570](https://github.com/gabrielunknown/CVE-2026-73570) | Zimbra SNMP Notification OS Command Injection - Unauthenticated RCE via SMTP exploit (Poc) | | 7⭐ | 3d ago | [CVE-2026-42536-PoC](https://github.com/erberkan/CVE-2026-42536-PoC) | Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and… | | 3⭐ | 4d ago | KEV [cve-2026-85706-poc-exploit-gitlab](https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab) | cve-2026-85706-poc-exploit-gitlab | -| 3⭐ | 4d ago | [CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.](https://github.com/SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.) | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… | +| 4⭐ | 4d ago | [CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.](https://github.com/SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.) | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… | | 4⭐ | 5d ago | [CVE-2026-78006-POC](https://github.com/DeadExpl0it/CVE-2026-78006-POC) | POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code… | | 4⭐ | 5d ago | [CVE-2026-89013](https://github.com/Faceless0x7/CVE-2026-89013) | CVE-2026-89013 Exploit - Authorization bypass in Dolibarr via the hashp parameter, enabling unauthenticated… | | 5⭐ | 5d ago | [CVE-2026-89012](https://github.com/Faceless0x7/CVE-2026-89012) | CVE-2026-89012 Exploit - SQL filter denylist bypass in Dolibarr via case-insensitive SQL column resolution… | @@ -57,7 +57,7 @@ | 4⭐ | 28d ago | KEV [cve-2025-21479_iqooneo8](https://github.com/Qingizi7/cve-2025-21479_iqooneo8) | Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables… | | 3⭐ | 30d ago | KEV [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案 | | 20⭐ | 37d ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W | -| 6⭐ | 41d ago | [CVE-2025-8045](https://github.com/kuzeyardabulut/CVE-2025-8045) | Dirty Pagetable Exploit for CVE-2025-8045 | +| 6⭐ | 42d ago | [CVE-2025-8045](https://github.com/kuzeyardabulut/CVE-2025-8045) | Dirty Pagetable Exploit for CVE-2025-8045 | | 7⭐ | 46d ago | KEV [SELinux-Permissive-Only-CVE-2025-21479](https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479) | This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… | | 4⭐ | 57d ago | KEV [CVE-2025-32432](https://github.com/c0gnit00/CVE-2025-32432) | Exploit, POC for CVE-2025-32432, CraftCMS2Shell | | 4⭐ | 60d ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads | diff --git a/cves/2026/CVE-2026-72708.md b/cves/2026/CVE-2026-72708.md new file mode 100644 index 00000000000..86f944b7bbe --- /dev/null +++ b/cves/2026/CVE-2026-72708.md @@ -0,0 +1,18 @@ +### [CVE-2026-72708](https://www.cve.org/CVERecord?id=CVE-2026-72708) +**SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html** +![](https://img.shields.io/static/v1?label=Vendor&message=SPIP&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=SPIP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20%28%27SQL%20Injection%27%29&color=brightgreen) + +### Description + +SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present sitemap.xml.html template's annee criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the alea_ephemere secret used to sign SPIP action nonces. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/ambionics/spip-exploits diff --git a/cves/2026/CVE-2026-72709.md b/cves/2026/CVE-2026-72709.md new file mode 100644 index 00000000000..eaa93f634a4 --- /dev/null +++ b/cves/2026/CVE-2026-72709.md @@ -0,0 +1,18 @@ +### [CVE-2026-72709](https://www.cve.org/CVERecord?id=CVE-2026-72709) +**SPIP < 4.4.18 Missing Authorization via ecrire/action/** +![](https://img.shields.io/static/v1?label=Vendor&message=SPIP&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=SPIP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level authorization guards through direct HTTP requests to invoke actions such as editer_auteur, enabling arbitrary account password rewrites including administrator accounts and resulting in full account takeover. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/ambionics/spip-exploits diff --git a/cves/2026/CVE-2026-72710.md b/cves/2026/CVE-2026-72710.md new file mode 100644 index 00000000000..69cbfcb1c64 --- /dev/null +++ b/cves/2026/CVE-2026-72710.md @@ -0,0 +1,18 @@ +### [CVE-2026-72710](https://www.cve.org/CVERecord?id=CVE-2026-72710) +**SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection** +![](https://img.shields.io/static/v1?label=Vendor&message=SPIP&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=SPIP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improperly%20Controlled%20Modification%20of%20Dynamically-Determined%20Object%20Attributes&color=brightgreen) + +### Description + +SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champs_editables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables. Attackers can insert a malicious row into the spip_jobs queue with a controlled PHP function and arguments, which is then dynamically executed when the cron processes the queue, resulting in remote code execution. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/ambionics/spip-exploits diff --git a/docs/hero.svg b/docs/hero.svg index 5c0a6824f27..276c8cea6b8 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 82,960 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 172,177 + fill="#e6edf3" letter-spacing="-0.5">172,180 CVES INDEXED82,957 + fill="#2f81f7" letter-spacing="-0.5">82,960 WITH POCS1,199 diff --git a/docs/social-card.svg b/docs/social-card.svg index 0299d5620eb..e6392c1ebaf 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 172,177 + fill="#e6edf3" letter-spacing="-0.5">172,180 CVES INDEXED82,957 + fill="#2f81f7" letter-spacing="-0.5">82,960 WITH POCS1,199 diff --git a/docs/stats.json b/docs/stats.json index 2fee18f74a0..3da22c0e48a 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1199, - "total_cves": 172177, - "with_pocs": 82957 + "total_cves": 172180, + "with_pocs": 82960 } diff --git a/index/github.txt b/index/github.txt index 4583faf6309..1b0878d1a76 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26665,3 +26665,6 @@ CVE-2026-27739 - https://github.com/mr-redoo7/CVE-2026-27739-POC CVE-2026-76460 - https://github.com/S3v3n-JG/CVE-2026-76460 CVE-2026-49179 - https://github.com/overgrowncarrot1/CVE-2026-49179-Active-Directory-WriteSPNScript-Command-Injection CVE-2026-76461 - https://github.com/S3v3n-JG/CVE-2026-76461 +CVE-2026-72708 - https://github.com/ambionics/spip-exploits +CVE-2026-72709 - https://github.com/ambionics/spip-exploits +CVE-2026-72710 - https://github.com/ambionics/spip-exploits diff --git a/index/trending.json b/index/trending.json index a9e5bf8f672..e6be1c2aeb6 100644 --- a/index/trending.json +++ b/index/trending.json @@ -12,7 +12,7 @@ }, { "year": 2026, - "stars": 287, + "stars": 303, "name": "cve-2026-41940-PoC", "url": "https://github.com/ctdal/cve-2026-41940-PoC", "desc": "A cPanel and WHM authentication bypassing tool", @@ -100,7 +100,7 @@ }, { "year": 2026, - "stars": 3, + "stars": 4, "name": "CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.", "url": "https://github.com/SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.", "desc": "Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)",