diff --git a/README.md b/README.md index 7185b5e566c..287927ca54a 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-11%20Sep%202026%2000%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609110007)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C702-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C189-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609110007)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-11%20Sep%202026%2001%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609110107)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C702-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C189-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609110107)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,16 +12,15 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 16h ago | KEV [CVE-2026-60137-and-CVE-2026-63030](https://github.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030) | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the… | +| 0⭐ | 17h ago | [CVE-2026-28496](https://github.com/ivanesk315/CVE-2026-28496) | FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a… | +| 0⭐ | 17h ago | KEV [CVE-2026-60137-and-CVE-2026-63030](https://github.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030) | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the… | | 0⭐ | 1d ago | [CVE-2025-27636-RCE-in-Apache-Camel](https://github.com/AC8999/CVE-2025-27636-RCE-in-Apache-Camel) | CVE-2025-27636 PoC written in Python | | 2⭐ | 1d ago | [CVE-2026-11387-WooCommerce-SMS-OTP](https://github.com/abraxas/CVE-2026-11387-WooCommerce-SMS-OTP) | SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress; SMS Alert… | | 0⭐ | 2d ago | [CVE-2026-73312](https://github.com/BomboBombone/CVE-2026-73312) | Sanitized XenForo write-up and proof of concept for CVE-2026-73312. | | 0⭐ | 2d ago | KEV [CVE-2025-55182](https://github.com/r3vpwnx/CVE-2025-55182) | CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight… | -| 2⭐ | 2d ago | KEV [CVE-2026-39987](https://github.com/Th3Purge/CVE-2026-39987) | Marimo Pre Authentication RCE | | 4⭐ | 2d ago | KEV [CVE-2026-85046](https://github.com/atiilla/CVE-2026-85046) | CVE-2026-85046 / Chrome V8 Type Confusion in Inline Array.prototype.sort (Maglev/Turbofan) / CVSS 8.8 /… | | 2⭐ | 2d ago | [CVE-2026-69451-PoC](https://github.com/fj016/CVE-2026-69451-PoC) | PoC for the CVE-2026-69451 - Fastprox EoP | | 2⭐ | 3d ago | KEV [CVE-2026-82329-JFrog-Artifactory-](https://github.com/0xTerror/CVE-2026-82329-JFrog-Artifactory-) | CVE-2026-82329 - JFrog Artifactory Auth Bypass | -| 0⭐ | 4d ago | KEV [CVE-2025-57819](https://github.com/r3vpwnx/CVE-2025-57819) | CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC) | ## Trending in 2026 @@ -29,6 +28,7 @@ | --- | --- | --- | --- | | 14⭐ | 1d ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | | 5⭐ | 1d ago | [CVE-2026-19089-WooCommerce-Tyche](https://github.com/abraxas/CVE-2026-19089-WooCommerce-Tyche) | CVE-2026-19089 WooCommerce Tych Remote Command Execution | +| 9⭐ | 2d ago | KEV [CVE-2026-39987](https://github.com/Th3Purge/CVE-2026-39987) | Marimo Pre Authentication RCE | | 824⭐ | 3d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 532⭐ | 3d ago | KEV [cve-2026-41940-PoC](https://github.com/lanicer/cve-2026-41940-PoC) | A cPanel and WHM authentication bypassing tool | | 27⭐ | 3d ago | [CVE-2026-28576-poc](https://github.com/mobilehackinglab/CVE-2026-28576-poc) | SQL injection vulnerability in Android 17 (AOSP) | @@ -46,7 +46,6 @@ | 16⭐ | 11d ago | [givewp-cve-2026-82222-rce-lab](https://github.com/dinosn/givewp-cve-2026-82222-rce-lab) | Authorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix. | | 4⭐ | 12d ago | KEV [PaperCut-CVE-2026-81578-82078](https://github.com/yora1928/PaperCut-CVE-2026-81578-82078) | Security research tool for PaperCut CVE-2026-81578 & CVE-2026-82078 | | 35⭐ | 14d ago | [CVE-2026-62735](https://github.com/nhh9905/CVE-2026-62735) | CVE 1-day in http.sys | -| 22⭐ | 14d ago | KEV [CVE-2026-72898](https://github.com/EQSTLab/CVE-2026-72898) | Metabase SQLi | ## Trending in 2025 diff --git a/index/trending.json b/index/trending.json index fd336c55e5c..6b9fcb4c295 100644 --- a/index/trending.json +++ b/index/trending.json @@ -21,6 +21,17 @@ "cve": "CVE-2026-19089", "kev": false }, + { + "year": 2026, + "stars": 9, + "name": "CVE-2026-39987", + "url": "https://github.com/Th3Purge/CVE-2026-39987", + "desc": "Marimo Pre Authentication RCE", + "pushed": "2026-09-08T19:42:20Z", + "created": "2026-09-08T19:44:20Z", + "cve": "CVE-2026-39987", + "kev": true + }, { "year": 2026, "stars": 824, @@ -208,17 +219,6 @@ "cve": "CVE-2026-62735", "kev": false }, - { - "year": 2026, - "stars": 22, - "name": "CVE-2026-72898", - "url": "https://github.com/EQSTLab/CVE-2026-72898", - "desc": "Metabase SQLi", - "pushed": "2026-08-27T07:03:38Z", - "created": "2026-08-27T06:51:58Z", - "cve": "CVE-2026-72898", - "kev": true - }, { "year": 2025, "stars": 6, @@ -472,6 +472,18 @@ "cve": "CVE-2022-29799", "kev": false }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-28496", + "url": "https://github.com/ivanesk315/CVE-2026-28496", + "desc": "FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulnerability in the template rendering system. Administrators with access to features that render Twig templates (email templates, mass mail campaigns, custom payment adapters, and the `string_render` API endpoint) can inject arbitrary Twig expressions, leading to information disclosure and remote code execution. The vulnerability exists because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container. Version 0.8.0 patches the issue. Some workarounds are available. Audit existing email templates for suspicious Twig expressions, rotate all admin and client API tokens, and/or block external access to /api/system/* at reverse proxy/WAF to mitigate chaining with GHSA-78x5-c8gw-8279.", + "pushed": "2026-09-10T07:18:20Z", + "created": "2026-09-10T07:18:20Z", + "cve": "CVE-2026-28496", + "kev": false, + "landed": true + }, { "year": 2026, "stars": 0, @@ -532,18 +544,6 @@ "kev": true, "landed": true }, - { - "year": 2026, - "stars": 2, - "name": "CVE-2026-39987", - "url": "https://github.com/Th3Purge/CVE-2026-39987", - "desc": "Marimo Pre Authentication RCE", - "pushed": "2026-09-08T19:42:20Z", - "created": "2026-09-08T19:44:20Z", - "cve": "CVE-2026-39987", - "kev": true, - "landed": true - }, { "year": 2026, "stars": 4, @@ -579,17 +579,5 @@ "cve": "CVE-2026-82329", "kev": true, "landed": true - }, - { - "year": 2025, - "stars": 0, - "name": "CVE-2025-57819", - "url": "https://github.com/r3vpwnx/CVE-2025-57819", - "desc": "CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC)", - "pushed": "2026-09-06T20:45:36Z", - "created": "2026-09-06T20:51:39Z", - "cve": "CVE-2025-57819", - "kev": true, - "landed": true } ]