diff --git a/README.md b/README.md index bb2f01cf365..d9345145fe3 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-28%20Sep%202026%2004%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609280407)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C570-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C212-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609280407)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-28%20Sep%202026%2005%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609280507)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C571-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C212-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609280507)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,13 +12,13 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 1⭐ | 1h ago | [CVE-2026-78006-CVE-2026-78159](https://github.com/antid00t/CVE-2026-78006-CVE-2026-78159) | The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159 | -| 0⭐ | 5h ago | [ply-cve-2025-56005-lab](https://github.com/gdfurr98/ply-cve-2025-56005-lab) | Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the… | -| 0⭐ | 8h ago | [CVE-2026-34990](https://github.com/predyy/CVE-2026-34990) | CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. | -| 2⭐ | 17h ago | KEV [CVE-2025-21479-FX5P](https://github.com/diyiqiuye/CVE-2025-21479-FX5P) | Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) | -| 0⭐ | 18h ago | KEV [Reproduce-CVE-2025-32433](https://github.com/X-Bulow/Reproduce-CVE-2025-32433) | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3,… | -| 2⭐ | 19h ago | [CVE-2026-44011-craftcms-auth-rce](https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce) | The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user. | -| 0⭐ | 21h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | +| 1⭐ | 31m ago | [HTB-Pterodactyl-RCE-CVE-2025-49132](https://github.com/symphony2colour/HTB-Pterodactyl-RCE-CVE-2025-49132) | This repo contains RCE exploit for Pterodactyl htb machine | +| 1⭐ | 2h ago | [CVE-2026-78006-CVE-2026-78159](https://github.com/antid00t/CVE-2026-78006-CVE-2026-78159) | The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159 | +| 0⭐ | 6h ago | [ply-cve-2025-56005-lab](https://github.com/gdfurr98/ply-cve-2025-56005-lab) | Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the… | +| 2⭐ | 18h ago | KEV [CVE-2025-21479-FX5P](https://github.com/diyiqiuye/CVE-2025-21479-FX5P) | Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) | +| 0⭐ | 19h ago | KEV [Reproduce-CVE-2025-32433](https://github.com/X-Bulow/Reproduce-CVE-2025-32433) | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3,… | +| 2⭐ | 20h ago | [CVE-2026-44011-craftcms-auth-rce](https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce) | The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user. | +| 0⭐ | 22h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | | 0⭐ | 1d ago | [POC-CVE-2025-11201](https://github.com/rmhowe425/POC-CVE-2025-11201) | PoC for MLFlow unauth RCE | | 0⭐ | 2d ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | | 1⭐ | 2d ago | [opace6-cve-2026-64560](https://github.com/Wangs-official/opace6-cve-2026-64560) | 针对 OnePlus Ace6 设备的 cve-2026-64560 复现 | @@ -27,10 +27,12 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 5⭐ | 2h ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | -| 3⭐ | 7h ago | [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… | -| 7⭐ | 17h ago | KEV [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | -| 6⭐ | 18h ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… | +| 5⭐ | 3h ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | +| 3⭐ | 8h ago | [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… | +| 10⭐ | 9h ago | [CVE-2026-34990](https://github.com/predyy/CVE-2026-34990) | CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. | +| 10⭐ | 10h ago | [CVE-2026-28695](https://github.com/predyy/CVE-2026-28695) | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. | +| 7⭐ | 18h ago | KEV [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | +| 6⭐ | 19h ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… | | 825⭐ | 1d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 3⭐ | 1d ago | KEV [CVE-2026-mikrotik-poc](https://github.com/gagaltotal/CVE-2026-mikrotik-poc) | CVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH | | 10⭐ | 1d ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI Drone DUML Command Injection over Bluetooth - Proof of Concept for CVE-2026-78306 | @@ -45,8 +47,6 @@ | 4⭐ | 4d ago | [CVE-2026-94129](https://github.com/lzty/CVE-2026-94129) | A POC for CVE-2026-94129 | | 4⭐ | 4d ago | [CVE-2026-94128](https://github.com/lzty/CVE-2026-94128) | POC for CVE-2026-94128 | | 32⭐ | 5d ago | KEV [CVE-2026-87902](https://github.com/abraxas/CVE-2026-87902) | CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion… | -| 4⭐ | 5d ago | [CVE-2026-23921](https://github.com/qucklecrabik/CVE-2026-23921) | This repository contains a proof-of-concept (PoC) exploit for CVE-2026-23921 | -| 34⭐ | 5d ago | KEV [cve-2026-87902-poc](https://github.com/ressl/cve-2026-87902-poc) | PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP… | ## Trending in 2025 diff --git a/cves/2026/CVE-2026-85984.md b/cves/2026/CVE-2026-85984.md new file mode 100644 index 00000000000..838407de846 --- /dev/null +++ b/cves/2026/CVE-2026-85984.md @@ -0,0 +1,18 @@ +### [CVE-2026-85984](https://www.cve.org/CVERecord?id=CVE-2026-85984) +**miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter** +![](https://img.shields.io/static/v1?label=Vendor&message=cyberlord92&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=miniOrange%20OTP%20Login%2C%20Verification%20and%20SMS%20Notifications&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/murrez/CVE-2026-85984 diff --git a/docs/hero.svg b/docs/hero.svg index f0e90ea2c89..7c37fcdcf01 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 83,571 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 172,880 + fill="#e6edf3" letter-spacing="-0.5">172,881 CVES INDEXED83,570 + fill="#2f81f7" letter-spacing="-0.5">83,571 WITH POCS1,212 diff --git a/docs/social-card.svg b/docs/social-card.svg index 483cbc45d4f..112407dc0bd 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 172,880 + fill="#e6edf3" letter-spacing="-0.5">172,881 CVES INDEXED83,570 + fill="#2f81f7" letter-spacing="-0.5">83,571 WITH POCS1,212 diff --git a/docs/stats.json b/docs/stats.json index 182cc0f5312..96ec4c5e7ec 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1212, - "total_cves": 172880, - "with_pocs": 83570 + "total_cves": 172881, + "with_pocs": 83571 } diff --git a/index/github.txt b/index/github.txt index 3d4ef3f1dfb..e0190702d21 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26973,3 +26973,4 @@ CVE-2026-34990 - https://github.com/bara-almustafa/CVE-2026-34990-poc CVE-2025-48595 - https://github.com/CTIresource/Vendor-Verbiage CVE-2025-61882 - https://github.com/CTIresource/Vendor-Verbiage CVE-2026-34990 - https://github.com/Noorkhalel/CVE-2026-34990-CUPS-LPE-PoC +CVE-2026-85984 - https://github.com/murrez/CVE-2026-85984 diff --git a/index/trending.json b/index/trending.json index 54dddb95baa..9d911d0ea24 100644 --- a/index/trending.json +++ b/index/trending.json @@ -21,6 +21,28 @@ "cve": "CVE-2026-88772", "kev": false }, + { + "year": 2026, + "stars": 10, + "name": "CVE-2026-34990", + "url": "https://github.com/predyy/CVE-2026-34990", + "desc": "CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc.", + "pushed": "2026-09-27T19:48:09Z", + "created": "2026-09-27T19:41:06Z", + "cve": "CVE-2026-34990", + "kev": false + }, + { + "year": 2026, + "stars": 10, + "name": "CVE-2026-28695", + "url": "https://github.com/predyy/CVE-2026-28695", + "desc": "CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS.", + "pushed": "2026-09-27T18:22:03Z", + "created": "2026-09-27T18:15:52Z", + "cve": "CVE-2026-28695", + "kev": false + }, { "year": 2026, "stars": 7, @@ -197,28 +219,6 @@ "cve": "CVE-2026-87902", "kev": true }, - { - "year": 2026, - "stars": 4, - "name": "CVE-2026-23921", - "url": "https://github.com/qucklecrabik/CVE-2026-23921", - "desc": "This repository contains a proof-of-concept (PoC) exploit for CVE-2026-23921", - "pushed": "2026-09-22T20:10:52Z", - "created": "2026-09-22T20:10:03Z", - "cve": "CVE-2026-23921", - "kev": false - }, - { - "year": 2026, - "stars": 34, - "name": "cve-2026-87902-poc", - "url": "https://github.com/ressl/cve-2026-87902-poc", - "desc": "PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab", - "pushed": "2026-09-22T19:36:47Z", - "created": "2026-09-22T18:40:26Z", - "cve": "CVE-2026-87902", - "kev": true - }, { "year": 2025, "stars": 7, @@ -461,6 +461,18 @@ "cve": "CVE-2023-32315", "kev": true }, + { + "year": 2025, + "stars": 1, + "name": "HTB-Pterodactyl-RCE-CVE-2025-49132", + "url": "https://github.com/symphony2colour/HTB-Pterodactyl-RCE-CVE-2025-49132", + "desc": "This repo contains RCE exploit for Pterodactyl htb machine", + "pushed": "2026-09-28T04:37:47Z", + "created": "2026-02-09T14:43:12Z", + "cve": "CVE-2025-49132", + "kev": false, + "landed": true + }, { "year": 2026, "stars": 1, @@ -485,18 +497,6 @@ "kev": false, "landed": true }, - { - "year": 2026, - "stars": 0, - "name": "CVE-2026-34990", - "url": "https://github.com/predyy/CVE-2026-34990", - "desc": "CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc.", - "pushed": "2026-09-27T19:48:09Z", - "created": "2026-09-27T19:41:06Z", - "cve": "CVE-2026-34990", - "kev": false, - "landed": true - }, { "year": 2025, "stars": 2,