diff --git a/README.md b/README.md index d08de0a1791..d76ce4dcb31 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-28%20Sep%202026%2010%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609281007)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C628-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C214-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609281007)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-28%20Sep%202026%2011%3A08%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609281108)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C629-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C214-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609281108)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,26 +12,26 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 1⭐ | 5h ago | [HTB-Pterodactyl-RCE-CVE-2025-49132](https://github.com/symphony2colour/HTB-Pterodactyl-RCE-CVE-2025-49132) | This repo contains RCE exploit for Pterodactyl htb machine | -| 1⭐ | 7h ago | [CVE-2026-78006-CVE-2026-78159](https://github.com/antid00t/CVE-2026-78006-CVE-2026-78159) | The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159 | -| 0⭐ | 11h ago | [ply-cve-2025-56005-lab](https://github.com/gdfurr98/ply-cve-2025-56005-lab) | Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the… | -| 2⭐ | 23h ago | KEV [CVE-2025-21479-FX5P](https://github.com/diyiqiuye/CVE-2025-21479-FX5P) | Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) | +| 0⭐ | 24m ago | [CVE-2026-22777](https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2026-22777) | CVE-2026-22777 ComfyUI-Manager CRLF Injection leading to RCE chained with CVE-2025-67303 | +| 1⭐ | 6h ago | [HTB-Pterodactyl-RCE-CVE-2025-49132](https://github.com/symphony2colour/HTB-Pterodactyl-RCE-CVE-2025-49132) | This repo contains RCE exploit for Pterodactyl htb machine | +| 1⭐ | 8h ago | [CVE-2026-78006-CVE-2026-78159](https://github.com/antid00t/CVE-2026-78006-CVE-2026-78159) | The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159 | +| 0⭐ | 12h ago | [ply-cve-2025-56005-lab](https://github.com/gdfurr98/ply-cve-2025-56005-lab) | Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the… | +| 2⭐ | 1d ago | KEV [CVE-2025-21479-FX5P](https://github.com/diyiqiuye/CVE-2025-21479-FX5P) | Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) | | 2⭐ | 1d ago | [CVE-2026-44011-craftcms-auth-rce](https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce) | The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user. | | 0⭐ | 1d ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | Tracking CVE-2025-39964, the Linux kernel AF_ALG concurrent-write race | | 0⭐ | 1d ago | [POC-CVE-2025-11201](https://github.com/rmhowe425/POC-CVE-2025-11201) | PoC for MLFlow unauth RCE | | 2⭐ | 1d ago | [CVE-2026-94130](https://github.com/murrez/CVE-2026-94130) | Unauthenticated SQL injection in Joomla YouTube Gallery (joomlaboat.com, com_youtubegallery) ≤ 5.7.2 - video… | | 0⭐ | 2d ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | -| 1⭐ | 2d ago | [opace6-cve-2026-64560](https://github.com/Wangs-official/opace6-cve-2026-64560) | 针对 OnePlus Ace6 设备的 cve-2026-64560 复现 | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 5⭐ | 8h ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | -| 8⭐ | 13h ago | KEV [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… | -| 28⭐ | 14h ago | [CVE-2026-34990](https://github.com/predyy/CVE-2026-34990) | CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. | -| 13⭐ | 15h ago | [CVE-2026-28695](https://github.com/predyy/CVE-2026-28695) | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. | -| 7⭐ | 23h ago | KEV [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | +| 5⭐ | 9h ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | +| 8⭐ | 14h ago | KEV [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… | +| 28⭐ | 15h ago | [CVE-2026-34990](https://github.com/predyy/CVE-2026-34990) | CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. | +| 13⭐ | 16h ago | [CVE-2026-28695](https://github.com/predyy/CVE-2026-28695) | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. | +| 7⭐ | 1d ago | KEV [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | | 6⭐ | 1d ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… | | 825⭐ | 1d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 3⭐ | 1d ago | KEV [CVE-2026-mikrotik-poc](https://github.com/gagaltotal/CVE-2026-mikrotik-poc) | CVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH | @@ -62,7 +62,7 @@ | 7⭐ | 57d ago | KEV [SELinux-Permissive-Only-CVE-2025-21479](https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479) | This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… | | 4⭐ | 68d ago | KEV [CVE-2025-32432](https://github.com/c0gnit00/CVE-2025-32432) | Exploit, POC for CVE-2025-32432, CraftCMS2Shell | | 3⭐ | 69d ago | [CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation](https://github.com/JM00NJ/CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation) | CVE-2025-6019: udisks2 XFS Resize TOCTOU Privilege Escalation | -| 4⭐ | 70d ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads | +| 4⭐ | 71d ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads | | 4⭐ | 72d ago | KEV [CVE-2025-8110-gogs-poc](https://github.com/Shirouuu/CVE-2025-8110-gogs-poc) | PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink | | 7⭐ | 82d ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… | | 4⭐ | 87d ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… | diff --git a/cves/2026/CVE-2026-22777.md b/cves/2026/CVE-2026-22777.md index 3c99e818e5e..20186f31a68 100644 --- a/cves/2026/CVE-2026-22777.md +++ b/cves/2026/CVE-2026-22777.md @@ -17,6 +17,7 @@ No PoCs from references. #### Github - https://github.com/wcnmwcis/CVE-2026-22777 +- https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2026-22777 #### Vulhub - https://github.com/vulhub/vulhub/tree/master/comfyui/CVE-2026-22777 diff --git a/cves/2026/CVE-2026-56096.md b/cves/2026/CVE-2026-56096.md new file mode 100644 index 00000000000..a95cd17c37a --- /dev/null +++ b/cves/2026/CVE-2026-56096.md @@ -0,0 +1,21 @@ +### [CVE-2026-56096](https://www.cve.org/CVERecord?id=CVE-2026-56096) +**Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)** +![](https://img.shields.io/static/v1?label=Vendor&message=TYPO3&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Extension%20%22Apache%20Solr%20for%20TYPO3%20-%20Enterprise%20Search%22&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=13.0.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=12.0.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=11.5.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-943%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Data%20Query%20Logic&color=brightgreen) + +### Description + +The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values through boolean- and range-based blind extraction techniques, independent of any site-specific configuration. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/yairHinkis/CVE-2026-56096 diff --git a/docs/hero.svg b/docs/hero.svg index a8c483ca486..8c35b2fd56f 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 83,629 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 172,936 + fill="#e6edf3" letter-spacing="-0.5">172,937 CVES INDEXED83,628 + fill="#2f81f7" letter-spacing="-0.5">83,629 WITH POCS1,214 diff --git a/docs/social-card.svg b/docs/social-card.svg index d0084f5fc16..36586a3824b 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 172,936 + fill="#e6edf3" letter-spacing="-0.5">172,937 CVES INDEXED83,628 + fill="#2f81f7" letter-spacing="-0.5">83,629 WITH POCS1,214 diff --git a/docs/stats.json b/docs/stats.json index da87710af5d..58f4bc4409d 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1214, - "total_cves": 172936, - "with_pocs": 83628 + "total_cves": 172937, + "with_pocs": 83629 } diff --git a/index/github.txt b/index/github.txt index af172b8d882..cb20a8f21f8 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26989,3 +26989,5 @@ CVE-2026-93958 - https://github.com/murrez/CVE-2026-93958 CVE-2026-6951 - https://github.com/EQSTLab/CVE-2026-6951 CVE-2026-100721 - https://github.com/murrez/CVE-2026-100721 CVE-2026-88772 - https://github.com/FollowerSeize/CVE-2026-88772-POC +CVE-2026-22777 - https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2026-22777 +CVE-2026-56096 - https://github.com/yairHinkis/CVE-2026-56096 diff --git a/index/trending.json b/index/trending.json index 5c051b72ba6..1a23dd8345f 100644 --- a/index/trending.json +++ b/index/trending.json @@ -461,6 +461,18 @@ "cve": "CVE-2023-32315", "kev": true }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-22777", + "url": "https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2026-22777", + "desc": "CVE-2026-22777 ComfyUI-Manager CRLF Injection leading to RCE chained with CVE-2025-67303", + "pushed": "2026-09-28T10:46:16Z", + "created": "2026-09-28T10:09:06Z", + "cve": "CVE-2026-22777", + "kev": false, + "landed": true + }, { "year": 2025, "stars": 1, @@ -568,17 +580,5 @@ "cve": "CVE-2025-3248", "kev": true, "landed": true - }, - { - "year": 2026, - "stars": 1, - "name": "opace6-cve-2026-64560", - "url": "https://github.com/Wangs-official/opace6-cve-2026-64560", - "desc": "针对 OnePlus Ace6 设备的 cve-2026-64560 复现", - "pushed": "2026-09-25T16:30:48Z", - "created": "2026-09-25T13:42:42Z", - "cve": "CVE-2026-64560", - "kev": false, - "landed": true } ]