mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
Update CVE PoCs 2026-10-21
This commit is contained in:
CVE-BOT committed
1 parent
1f0d9488aa
commit
2f8797e3f4
149 files changed
+2282
-18
No files matched your search
@@ -1,3 +1,3 @@
|
||||
{
|
||||
"cvelist_fetch_time": "2026-10-20T07:13:06.852Z"
|
||||
"cvelist_fetch_time": "2026-10-21T06:59:28.261Z"
|
||||
}
|
||||
@@ -1,8 +1,8 @@
|
||||
<div align="center">
|
||||
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=174698-85256-1235" alt="PoC Index" width="100%"></a>
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=174792-85350-1235" alt="PoC Index" width="100%"></a>
|
||||
|
||||
[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
|
||||
[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
|
||||
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>
|
||||
|
||||
|
||||
@@ -66,6 +66,7 @@ The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote
|
||||
- https://github.com/vig9610/Exploiting-Samba-on-Metasploitable-2
|
||||
- https://github.com/rushikesh-a-bhujbal/CVE-2007-2447
|
||||
- https://github.com/sagarjain0456/Metasploit-Project-using-KaliLinux-plus-Metasploitable2-VMs
|
||||
- https://github.com/Jacked-cpu/samba
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/16320
|
||||
|
||||
@@ -22,6 +22,7 @@ Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft
|
||||
- https://github.com/sec13b/ms09-050_CVE-2009-3103
|
||||
- https://github.com/afifudinmtop/CVE-2009-3103
|
||||
- https://github.com/nicolasdamians/ms09-050-CVE-2009-3103-exploit
|
||||
- https://github.com/Jacked-cpu/samba
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/16363
|
||||
|
||||
@@ -26,6 +26,7 @@ UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 th
|
||||
- https://github.com/rhimavanth32-max/Metasploitable2-Reconnaissance-and-UnrealIRCd-Backdoor-Exploitation
|
||||
- https://github.com/zales2004/sunset-noontide-pentesting
|
||||
- https://github.com/rushikesh-a-bhujbal/CVE-2010-2075
|
||||
- https://github.com/Jacked-cpu/samba
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/16922
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2012-20002](https://www.cve.org/CVERecord?id=CVE-2012-20002)
|
||||
**TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://packetstorm.news/files/id/113417/
|
||||
- https://www.exploit-db.com/exploits/19022
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2012-20003](https://www.cve.org/CVERecord?id=CVE-2012-20003)
|
||||
**Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.exploit-db.com/exploits/37482
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2012-20004](https://www.cve.org/CVERecord?id=CVE-2012-20004)
|
||||
**K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.exploit-db.com/exploits/37484
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2012-20005](https://www.cve.org/CVERecord?id=CVE-2012-20005)
|
||||
**SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.exploit-db.com/exploits/37481
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2014-125132](https://www.cve.org/CVERecord?id=CVE-2014-125132)
|
||||
**Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious 'k' values that are echoed unsanitized, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://codevigilant.com/disclosure/wp-plugin-blogroll-fun-a3-cross-site-scripting-xss/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2014-125133](https://www.cve.org/CVERecord?id=CVE-2014-125133)
|
||||
**NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://packetstorm.news/files/id/128101/
|
||||
- https://packetstorm.news/files/id/132297/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2014-125134](https://www.cve.org/CVERecord?id=CVE-2014-125134)
|
||||
**ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://packetstorm.news/files/id/129706/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -119,6 +119,7 @@ GNU Bash through 4.3 processes trailing strings after function definitions in th
|
||||
- https://github.com/kaleth4/CVE-2014-6271
|
||||
- https://github.com/mariomolinara/unicas_docker_exploit
|
||||
- https://github.com/muazzez-gurbuz/linux-penetration-test-shellshock
|
||||
- https://github.com/CodeStartUp/New-cve
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6271.yaml
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2015-20123](https://www.cve.org/CVERecord?id=CVE-2015-20123)
|
||||
**Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.exploit-db.com/exploits/36559
|
||||
- https://packetstorm.news/files/id/131167/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2015-20124](https://www.cve.org/CVERecord?id=CVE-2015-20124)
|
||||
**Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://packetstorm.news/files/id/131162/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2015-20125](https://www.cve.org/CVERecord?id=CVE-2015-20125)
|
||||
**Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://packetstorm.news/files/id/131161/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2015-20128](https://www.cve.org/CVERecord?id=CVE-2015-20128)
|
||||
**FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.cnblogs.com/rebeyond/p/4951418.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2016-20100](https://www.cve.org/CVERecord?id=CVE-2016-20100)
|
||||
**Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.exploit-db.com/exploits/39593
|
||||
- https://packetstorm.news/files/id/136374/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2016-20101](https://www.cve.org/CVERecord?id=CVE-2016-20101)
|
||||
**Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://packetstorm.news/files/id/136398/
|
||||
- https://cxsecurity.com/issue/WLB-2016030131
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,22 @@
|
||||
### [CVE-2016-20104](https://www.cve.org/CVERecord?id=CVE-2016-20104)
|
||||
**EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.exploit-db.com/exploits/40227
|
||||
- https://packetstorm.news/files/id/138274/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -23,6 +23,7 @@ Apache Shiro before 1.2.5, when a cipher key has not been configured for the "re
|
||||
- https://github.com/xunjinghan/bounty-forge
|
||||
- https://github.com/xunwmw/vuln-xiuxian
|
||||
- https://github.com/KBlackMeow/Matrix
|
||||
- https://github.com/nizexu04/work1-api
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-4437.yaml
|
||||
|
||||
@@ -40,6 +40,7 @@ The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2
|
||||
- https://github.com/yeshwanthp999/Windows7-ms17-010-
|
||||
- https://github.com/hackingyseguridad/smb
|
||||
- https://github.com/XX4R/EternalRomance-Exploit-Against-Windows-Machine
|
||||
- https://github.com/Jacked-cpu/samba
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/47456
|
||||
|
||||
@@ -16,6 +16,7 @@ An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. A remote, unaut
|
||||
#### Github
|
||||
- https://github.com/Scorpion-Security-Labs/CVE-2018-5767-AC9
|
||||
- https://github.com/db44k/CVE-2018-5767-AC9
|
||||
- https://github.com/e76f01z/tenda-ac15-httpd-rce
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/44253
|
||||
@@ -52,6 +52,7 @@ A use-after-free in binder.c allows an elevation of privilege from an applicatio
|
||||
- https://github.com/wired0ut/CVE-2019-2215
|
||||
- https://github.com/Beltzac/le1-root
|
||||
- https://github.com/fast1ine/Cube-TempRoot
|
||||
- https://github.com/kilokite/old-phone-temp-root
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/48129
|
||||
|
||||
@@ -105,6 +105,7 @@ A remote code execution vulnerability exists in the way that the Microsoft Serve
|
||||
- https://github.com/zathizh/cve-796-mit
|
||||
- https://github.com/zerodayblitz/NetSuite-network-exploitation-tool
|
||||
- https://github.com/thai1012/cve-2020-0796
|
||||
- https://github.com/Jacked-cpu/samba
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-0796.yaml
|
||||
|
||||
@@ -17,5 +17,5 @@ In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, wh
|
||||
- https://bugs.php.net/bug.php?id=79221
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
- https://github.com/bastet-ai/php-firing-range
|
||||
|
||||
@@ -239,6 +239,7 @@ A local privilege escalation vulnerability was found on polkit's pkexec utility.
|
||||
- https://github.com/r00t-byte/Pwnkit-CVE-2021-4034-LPE
|
||||
- https://github.com/devianntsec/CVE-2021-4034/blob/7a129bf13f50ba0e99b719b7f90b0538d6b4c7d0/exploit/pwnkit.py
|
||||
- https://github.com/SerhiiMaruniak/CVE-2021-4034
|
||||
- https://github.com/Jacked-cpu/samba
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/50689
|
||||
|
||||
@@ -197,6 +197,7 @@ A flaw was found in a change made to path normalization in Apache HTTP Server 2.
|
||||
- https://github.com/excanear/Escanearcpl-Exploit-Tools
|
||||
- https://github.com/floatingdreamhy/Vulnerability-POC-Dev
|
||||
- https://github.com/wservices/skill-exploit-research
|
||||
- https://github.com/Dyp2005/hdu-is-work1
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41773.yaml
|
||||
|
||||
@@ -52,6 +52,7 @@ In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, w
|
||||
- https://github.com/xmqaq/CVE-2022-22963
|
||||
- https://github.com/Fhwang0926/seo-labs
|
||||
- https://github.com/onewinner/VulToolsKit
|
||||
- https://github.com/Ameyuh0716/IS-lab1-CVE
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22963.yaml
|
||||
|
||||
@@ -16,4 +16,5 @@ An issue in the urllib.parse component of Python before 3.11.4 allows attackers
|
||||
- https://github.com/H4R335HR/CVE-2023-24329-PoC
|
||||
- https://github.com/Pandante-Central/CVE-2023-24329-codeql-test
|
||||
- https://github.com/PenTestMano/CVE-2023-24329-Exploit
|
||||
- https://github.com/UpWguyy/CVE-2023-24329-PoC
|
||||
|
||||
@@ -97,6 +97,7 @@ In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, w
|
||||
- https://github.com/11whoami99/CVE-2024-4577
|
||||
- https://github.com/watchtowrlabs/CVE-2024-4577
|
||||
- https://github.com/lockbitblack-ai/CVE-2024-4577-new
|
||||
- https://github.com/ghostinthecable/php-hunting
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4577.yaml
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-100145](https://www.cve.org/CVERecord?id=CVE-2026-100145)
|
||||
**Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/87d37c99-1229-4747-b562-5151aa9e92f2/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -14,6 +14,7 @@ A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an un
|
||||
|
||||
#### Reference
|
||||
- https://drive.google.com/file/d/1gPjhTSB7uWmsnBlfq5h9h6qzJj9j_Lxo/view?usp=sharing
|
||||
- https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-101141
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -13,6 +13,7 @@ A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by t
|
||||
|
||||
#### Reference
|
||||
- https://drive.google.com/file/d/1n6_L39uJ9mMteDwx4Z2XVnwsAZTbnf9s/view?usp=sharing
|
||||
- https://github.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-101142
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -14,6 +14,7 @@ A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this i
|
||||
|
||||
#### Reference
|
||||
- https://drive.google.com/file/d/1qKulZLn6xxT3ePlV__Q-0MKLhlWmRI_U/view?usp=sharing
|
||||
- https://github.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-101143
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -14,6 +14,7 @@ A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This aff
|
||||
|
||||
#### Reference
|
||||
- https://drive.google.com/file/d/16y5IDrRDrARBtGETXUHhkSgFN38b-c6C/view?usp=sharing
|
||||
- https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-101144
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -14,6 +14,7 @@ A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vul
|
||||
|
||||
#### Reference
|
||||
- https://drive.google.com/file/d/1DZ44Uq3fy7pQYcKwWB4A2gYGFYn1dZSo/view?usp=sharing
|
||||
- https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-101145
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -14,6 +14,7 @@ A security flaw has been discovered in Eleveo Quality Management 9.7.0. This iss
|
||||
|
||||
#### Reference
|
||||
- https://drive.google.com/file/d/18fGYUBefbMreujzivIfFpPE8kWDLQCCU/view?usp=sharing
|
||||
- https://github.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-101146
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-102499](https://www.cve.org/CVERecord?id=CVE-2026-102499)
|
||||
**Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/adf388fb-21c9-4310-95b3-b9065ca51480/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103302](https://www.cve.org/CVERecord?id=CVE-2026-103302)
|
||||
**Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/0d15b11e-fcb2-44b4-b9c9-0210004d1694/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105257](https://www.cve.org/CVERecord?id=CVE-2026-105257)
|
||||
**LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/10a8f09f-8282-456d-ad07-7e594e70a371/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105262](https://www.cve.org/CVERecord?id=CVE-2026-105262)
|
||||
**Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a7576e78-1fec-42fb-9c50-89b80e44fbc2/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105992](https://www.cve.org/CVERecord?id=CVE-2026-105992)
|
||||
**Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/228de134-7ecd-4f5a-ae3f-85348452a7dc/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105996](https://www.cve.org/CVERecord?id=CVE-2026-105996)
|
||||
**Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/ff7e2703-3949-43bc-a0b5-12ed49e5e396/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105998](https://www.cve.org/CVERecord?id=CVE-2026-105998)
|
||||
**Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/feb9d9bd-7192-4c75-9dc4-43d925518dc1/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105999](https://www.cve.org/CVERecord?id=CVE-2026-105999)
|
||||
**Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/0fb34ecd-4b07-4279-a086-09d828a61788/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-106932](https://www.cve.org/CVERecord?id=CVE-2026-106932)
|
||||
**Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d76e3e03-431b-4aec-ae11-b33ee58d28f1/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107127](https://www.cve.org/CVERecord?id=CVE-2026-107127)
|
||||
**Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6f2c1aee-d526-49a5-861c-3e7e72794bcb/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107128](https://www.cve.org/CVERecord?id=CVE-2026-107128)
|
||||
**Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/970ca143-4685-484f-96f4-7d5ba5955a2b/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107237](https://www.cve.org/CVERecord?id=CVE-2026-107237)
|
||||
**Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e9960aef-88c8-4a74-b479-55be75c25360/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107506](https://www.cve.org/CVERecord?id=CVE-2026-107506)
|
||||
**Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/8123f94c-0f46-4123-ae13-c2d5474476b2/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107788](https://www.cve.org/CVERecord?id=CVE-2026-107788)
|
||||
**SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/64fd7acb-2376-45a5-9fe7-9eea12ec7920/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107789](https://www.cve.org/CVERecord?id=CVE-2026-107789)
|
||||
**SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/bce3568a-2fbd-40b7-927d-9f52d30d95c9/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107790](https://www.cve.org/CVERecord?id=CVE-2026-107790)
|
||||
**WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/4bec1d97-9ab1-4ce7-b108-dcc2a0d9a934/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-108073](https://www.cve.org/CVERecord?id=CVE-2026-108073)
|
||||
**SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/5c463bb2-0cab-499f-92af-67df02c60b5f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-109147](https://www.cve.org/CVERecord?id=CVE-2026-109147)
|
||||
**WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/2a2e58bd-dc3f-4b6f-9b2d-b6d15cd2e898/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-109926](https://www.cve.org/CVERecord?id=CVE-2026-109926)
|
||||
**Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a85ad939-3eb3-470b-a938-d0bfff1ee24f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-110514](https://www.cve.org/CVERecord?id=CVE-2026-110514)
|
||||
**WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a6d3be6f-2203-4bc3-9f65-4eba2e9d2bc4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-110523](https://www.cve.org/CVERecord?id=CVE-2026-110523)
|
||||
**WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/0f26a111-043f-4f03-899a-256673672fd3/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-110651](https://www.cve.org/CVERecord?id=CVE-2026-110651)
|
||||
**Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/5b24891e-1cd5-4ce8-9fc8-3c1392037e53/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-110936](https://www.cve.org/CVERecord?id=CVE-2026-110936)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-110982](https://www.cve.org/CVERecord?id=CVE-2026-110982)
|
||||
**AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/59f18552-e60e-466f-949d-cc09aa657bbe/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-111574](https://www.cve.org/CVERecord?id=CVE-2026-111574)
|
||||
**Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f40440de-3947-48f9-8fa4-200f83e87d8e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-111596](https://www.cve.org/CVERecord?id=CVE-2026-111596)
|
||||
**Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/8bba9959-9c7a-4564-bcba-fc34a922ecc7/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-111943](https://www.cve.org/CVERecord?id=CVE-2026-111943)
|
||||
**Distrust compromised intermediate certificates in crypto/x509**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
|
||||
#### Github
|
||||
- https://github.com/thiefadjacent/emudhra-poc
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-111947](https://www.cve.org/CVERecord?id=CVE-2026-111947)
|
||||
**Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/7e78c101-05aa-4043-9c9d-2c896e9ae092/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-111948](https://www.cve.org/CVERecord?id=CVE-2026-111948)
|
||||
**Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/c47a205d-3413-4835-a852-05ea8609802a/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-111949](https://www.cve.org/CVERecord?id=CVE-2026-111949)
|
||||
**miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/0bd43d99-6b83-4d77-85d6-2c512b8da022/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-111955](https://www.cve.org/CVERecord?id=CVE-2026-111955)
|
||||
**WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/5fe1a629-8b05-4820-8cbe-4352c20930a3/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-111956](https://www.cve.org/CVERecord?id=CVE-2026-111956)
|
||||
**WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/cc30caa4-4d55-4c22-a81c-ae4acf1b99bd/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-111957](https://www.cve.org/CVERecord?id=CVE-2026-111957)
|
||||
**SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/751aa9b8-761e-4982-8708-6a746fddef09/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113356](https://www.cve.org/CVERecord?id=CVE-2026-113356)
|
||||
**DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113358](https://www.cve.org/CVERecord?id=CVE-2026-113358)
|
||||
**LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/kazisabu/073510cb5675d9803cbee4f7c29810e0
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,22 @@
|
||||
### [CVE-2026-113378](https://www.cve.org/CVERecord?id=CVE-2026-113378)
|
||||
**mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The real existence of this vulnerability is still doubted at the moment. The code's own escapeShellArg on sibling arguments (skipped only for fileType) indicates that this is a CWE-78 oversight, not a documented design. The project maintainer cites the documentation: "This MCP server executes shell commands using the ripgrep tool. While efforts have been made to safely escape arguments, use caution when providing input, as it runs commands on your machine."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/sandh0t/45fdee24a7907e0cd836aed26f2d5a7a/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113385](https://www.cve.org/CVERecord?id=CVE-2026-113385)
|
||||
**LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://docs.google.com/document/d/1_CRu5x_2OFJc-iZCP_GI0L88rEUOlgs3TCv9jM5L-b4/edit?usp=sharing
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,31 @@
|
||||
### [CVE-2026-113388](https://www.cve.org/CVERecord?id=CVE-2026-113388)
|
||||
**opensource-socialnetwork Cache Settings dynamic.php input code injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/qianqiusujiu/c0452f09e91de23f002a384038325104
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-113389](https://www.cve.org/CVERecord?id=CVE-2026-113389)
|
||||
**DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0006-authenticated-set-table-command-injection
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-113390](https://www.cve.org/CVERecord?id=CVE-2026-113390)
|
||||
**DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0007-authenticated-jsonstatus-usefile-file-clobber
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-113391](https://www.cve.org/CVERecord?id=CVE-2026-113391)
|
||||
**DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0008-authenticated-upload-filename-command-injection
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113392](https://www.cve.org/CVERecord?id=CVE-2026-113392)
|
||||
**DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0009-authenticated-apmupload-path-traversal-clobber
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-113393](https://www.cve.org/CVERecord?id=CVE-2026-113393)
|
||||
**DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_path/upload_name can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.5.1.7 is capable of addressing this issue. It is advisable to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0010-authenticated-commonupload-arbitrary-file-clobber
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113394](https://www.cve.org/CVERecord?id=CVE-2026-113394)
|
||||
**DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0011-authenticated-swmprofile-path-traversal-clobber
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113395](https://www.cve.org/CVERecord?id=CVE-2026-113395)
|
||||
**DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0012-authenticated-swmconfigupload-fieldname-path-traversal-clobber
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-113396](https://www.cve.org/CVERecord?id=CVE-2026-113396)
|
||||
**DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0013-authenticated-rename-table-command-injection
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-113397](https://www.cve.org/CVERecord?id=CVE-2026-113397)
|
||||
**DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0014-authenticated-request-certificate-command-injection
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-113411](https://www.cve.org/CVERecord?id=CVE-2026-113411)
|
||||
**Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/LeoWSY-hashblue/cve-electron-2/blob/master/nerimity-desktop/cve.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-113466](https://www.cve.org/CVERecord?id=CVE-2026-113466)
|
||||
**MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key
|
||||
. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/zast-ai/vulnerability-reports/blob/main/minio/unauth_admin_takeover.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,42 @@
|
||||
### [CVE-2026-113505](https://www.cve.org/CVERecord?id=CVE-2026-113505)
|
||||
**aaPanel Download Endpoint v2.py send_file path traversal**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-lfi
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,43 @@
|
||||
### [CVE-2026-113506](https://www.cve.org/CVERecord?id=CVE-2026-113506)
|
||||
**aaPanel File Manager common.py ExecShell os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-rce
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,43 @@
|
||||
### [CVE-2026-113507](https://www.cve.org/CVERecord?id=CVE-2026-113507)
|
||||
**aaPanel common.py GetClientIp access control**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-xrealip
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113605](https://www.cve.org/CVERecord?id=CVE-2026-113605)
|
||||
**Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/abraxas/stirling-h2-import-leftover
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113606](https://www.cve.org/CVERecord?id=CVE-2026-113606)
|
||||
**Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/abraxas/stirling-storage-folder-idor
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,40 @@
|
||||
### [CVE-2026-113643](https://www.cve.org/CVERecord?id=CVE-2026-113643)
|
||||
**EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/espocrm/espocrm/security/advisories/GHSA-r277-qh74-r86f
|
||||
- https://github.com/espocrm/espocrm/commit/91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113735](https://www.cve.org/CVERecord?id=CVE-2026-113735)
|
||||
**D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlink_set_root_pwd of the file /mnt/mtd/aoni_ipc. Executing a manipulation can lead to use of weak credentials. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/XueDugu/dlink-dcs6501lh-predictable-telnet-root-evidence/tree/main/poc
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-113736](https://www.cve.org/CVERecord?id=CVE-2026-113736)
|
||||
**D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence/blob/main/poc/poc_dhp610av_login.py
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113737](https://www.cve.org/CVERecord?id=CVE-2026-113737)
|
||||
**R6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This affects the function validate_indexed_tensors of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py. Executing a manipulation of the argument weight_map can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/user-attachments/files/33114736/poc.zip
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-113738](https://www.cve.org/CVERecord?id=CVE-2026-113738)
|
||||
**R6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py of the component MTP weight_map Handler. The manipulation of the argument shard_name leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/user-attachments/files/33115067/poc.zip
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-113740](https://www.cve.org/CVERecord?id=CVE-2026-113740)
|
||||
**itsourcecode Online Cake Ordering System deletecustomer.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/milo417/submit/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-113741](https://www.cve.org/CVERecord?id=CVE-2026-113741)
|
||||
**itsourcecode Online Cake Ordering System 404.php cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /404.php. Such manipulation of the argument useruid leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/milo417/submit/issues/2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,97 @@
|
||||
### [CVE-2026-113743](https://www.cve.org/CVERecord?id=CVE-2026-113743)
|
||||
**Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_tt-metal_tt_transformers_load_checkpoints.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
Loaded 100 of 149 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user