From 4e39c42af5975d1cbbed244d874929c0f6cf285b Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Mon, 31 Aug 2026 08:41:18 +0000 Subject: [PATCH] Update CVE PoCs 2026-08-31 --- .github/cve_sync_state.json | 2 +- 2025/CVE-2025-0324.md | 17 ++++++++++++++ 2025/CVE-2025-1162.md | 17 ++++++++++++++ 2025/CVE-2025-1163.md | 17 ++++++++++++++ 2025/CVE-2025-1164.md | 2 +- 2025/CVE-2025-1171.md | 17 ++++++++++++++ 2025/CVE-2025-43510.md | 22 ++++++++++++++++++ 2025/CVE-2025-43520.md | 22 ++++++++++++++++++ 2025/CVE-2025-55182.md | 1 + 2026/CVE-2026-0961.md | 17 ++++++++++++++ 2026/CVE-2026-18963.md | 1 + 2026/CVE-2026-34621.md | 1 + 2026/CVE-2026-39816.md | 1 + 2026/CVE-2026-42945.md | 1 + 2026/CVE-2026-45833.md | 16 +++++++++++++ 2026/CVE-2026-48611.md | 1 + 2026/CVE-2026-5006.md | 21 +++++++++++++++++ 2026/CVE-2026-56121.md | 2 +- 2026/CVE-2026-60004.md | 1 + 2026/CVE-2026-67363.md | 17 ++++++++++++++ 2026/CVE-2026-67364.md | 17 ++++++++++++++ 2026/CVE-2026-7474.md | 17 ++++++++++++++ 2026/CVE-2026-7482.md | 1 + 2026/CVE-2026-77013.md | 16 +++++++++++++ 2026/CVE-2026-78903.md | 16 +++++++++++++ 2026/CVE-2026-78904.md | 16 +++++++++++++ 2026/CVE-2026-78905.md | 16 +++++++++++++ 2026/CVE-2026-82548.md | 17 ++++++++++++++ 2026/CVE-2026-82549.md | 17 ++++++++++++++ 2026/CVE-2026-82550.md | 16 +++++++++++++ 2026/CVE-2026-82551.md | 16 +++++++++++++ 2026/CVE-2026-82552.md | 16 +++++++++++++ 2026/CVE-2026-82553.md | 17 ++++++++++++++ 2026/CVE-2026-82555.md | 17 ++++++++++++++ 2026/CVE-2026-82556.md | 20 +++++++++++++++++ 2026/CVE-2026-82587.md | 23 +++++++++++++++++++ 2026/CVE-2026-82589.md | 23 +++++++++++++++++++ 2026/CVE-2026-82592.md | 17 ++++++++++++++ 2026/CVE-2026-82593.md | 17 ++++++++++++++ 2026/CVE-2026-82594.md | 19 ++++++++++++++++ 2026/CVE-2026-82595.md | 17 ++++++++++++++ 2026/CVE-2026-82596.md | 19 ++++++++++++++++ 2026/CVE-2026-82597.md | 17 ++++++++++++++ 2026/CVE-2026-82598.md | 23 +++++++++++++++++++ 2026/CVE-2026-82599.md | 22 ++++++++++++++++++ 2026/CVE-2026-82600.md | 23 +++++++++++++++++++ 2026/CVE-2026-82601.md | 23 +++++++++++++++++++ 2026/CVE-2026-82602.md | 23 +++++++++++++++++++ 2026/CVE-2026-82603.md | 22 ++++++++++++++++++ 2026/CVE-2026-82607.md | 18 +++++++++++++++ 2026/CVE-2026-82608.md | 30 +++++++++++++++++++++++++ 2026/CVE-2026-82609.md | 17 ++++++++++++++ 2026/CVE-2026-82610.md | 17 ++++++++++++++ 2026/CVE-2026-82611.md | 17 ++++++++++++++ 2026/CVE-2026-82612.md | 17 ++++++++++++++ 2026/CVE-2026-82613.md | 17 ++++++++++++++ 2026/CVE-2026-82614.md | 17 ++++++++++++++ 2026/CVE-2026-82615.md | 17 ++++++++++++++ 2026/CVE-2026-82616.md | 17 ++++++++++++++ 2026/CVE-2026-82619.md | 20 +++++++++++++++++ 2026/CVE-2026-82620.md | 18 +++++++++++++++ 2026/CVE-2026-82621.md | 18 +++++++++++++++ 2026/CVE-2026-82622.md | 17 ++++++++++++++ 2026/CVE-2026-82623.md | 22 ++++++++++++++++++ 2026/CVE-2026-82624.md | 17 ++++++++++++++ 2026/CVE-2026-82625.md | 17 ++++++++++++++ 2026/CVE-2026-82629.md | 17 ++++++++++++++ 2026/CVE-2026-82630.md | 18 +++++++++++++++ 2026/CVE-2026-82631.md | 17 ++++++++++++++ 2026/CVE-2026-82664.md | 18 +++++++++++++++ 2026/CVE-2026-82665.md | 17 ++++++++++++++ github.txt | 27 ++++++++++++++++++++++ references.txt | 45 +++++++++++++++++++++++++++++++++++++ 73 files changed, 1188 insertions(+), 3 deletions(-) create mode 100644 2025/CVE-2025-0324.md create mode 100644 2025/CVE-2025-1162.md create mode 100644 2025/CVE-2025-1163.md create mode 100644 2025/CVE-2025-1171.md create mode 100644 2025/CVE-2025-43510.md create mode 100644 2025/CVE-2025-43520.md create mode 100644 2026/CVE-2026-0961.md create mode 100644 2026/CVE-2026-45833.md create mode 100644 2026/CVE-2026-5006.md create mode 100644 2026/CVE-2026-67363.md create mode 100644 2026/CVE-2026-67364.md create mode 100644 2026/CVE-2026-7474.md create mode 100644 2026/CVE-2026-77013.md create mode 100644 2026/CVE-2026-78903.md create mode 100644 2026/CVE-2026-78904.md create mode 100644 2026/CVE-2026-78905.md create mode 100644 2026/CVE-2026-82548.md create mode 100644 2026/CVE-2026-82549.md create mode 100644 2026/CVE-2026-82550.md create mode 100644 2026/CVE-2026-82551.md create mode 100644 2026/CVE-2026-82552.md create mode 100644 2026/CVE-2026-82553.md create mode 100644 2026/CVE-2026-82555.md create mode 100644 2026/CVE-2026-82556.md create mode 100644 2026/CVE-2026-82587.md create mode 100644 2026/CVE-2026-82589.md create mode 100644 2026/CVE-2026-82592.md create mode 100644 2026/CVE-2026-82593.md create mode 100644 2026/CVE-2026-82594.md create mode 100644 2026/CVE-2026-82595.md create mode 100644 2026/CVE-2026-82596.md create mode 100644 2026/CVE-2026-82597.md create mode 100644 2026/CVE-2026-82598.md create mode 100644 2026/CVE-2026-82599.md create mode 100644 2026/CVE-2026-82600.md create mode 100644 2026/CVE-2026-82601.md create mode 100644 2026/CVE-2026-82602.md create mode 100644 2026/CVE-2026-82603.md create mode 100644 2026/CVE-2026-82607.md create mode 100644 2026/CVE-2026-82608.md create mode 100644 2026/CVE-2026-82609.md create mode 100644 2026/CVE-2026-82610.md create mode 100644 2026/CVE-2026-82611.md create mode 100644 2026/CVE-2026-82612.md create mode 100644 2026/CVE-2026-82613.md create mode 100644 2026/CVE-2026-82614.md create mode 100644 2026/CVE-2026-82615.md create mode 100644 2026/CVE-2026-82616.md create mode 100644 2026/CVE-2026-82619.md create mode 100644 2026/CVE-2026-82620.md create mode 100644 2026/CVE-2026-82621.md create mode 100644 2026/CVE-2026-82622.md create mode 100644 2026/CVE-2026-82623.md create mode 100644 2026/CVE-2026-82624.md create mode 100644 2026/CVE-2026-82625.md create mode 100644 2026/CVE-2026-82629.md create mode 100644 2026/CVE-2026-82630.md create mode 100644 2026/CVE-2026-82631.md create mode 100644 2026/CVE-2026-82664.md create mode 100644 2026/CVE-2026-82665.md diff --git a/.github/cve_sync_state.json b/.github/cve_sync_state.json index 9dfb4377223..157eaab958f 100644 --- a/.github/cve_sync_state.json +++ b/.github/cve_sync_state.json @@ -1,3 +1,3 @@ { - "cvelist_fetch_time": "2026-08-30T14:46:42.048Z" + "cvelist_fetch_time": "2026-08-31T08:19:11.865Z" } diff --git a/2025/CVE-2025-0324.md b/2025/CVE-2025-0324.md new file mode 100644 index 00000000000..6e7a3dcc5dc --- /dev/null +++ b/2025/CVE-2025-0324.md @@ -0,0 +1,17 @@ +### [CVE-2025-0324](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0324) +![](https://img.shields.io/static/v1?label=Product&message=AXIS%20OS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=11.8.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=12.0.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-791%3A%20Incomplete%20Filtering%20of%20Special%20Elements&color=brightgreen) + +### Description + +The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/kemrec/CVE-2025-0324-axis-vapix-privesc diff --git a/2025/CVE-2025-1162.md b/2025/CVE-2025-1162.md new file mode 100644 index 00000000000..e1167be3a00 --- /dev/null +++ b/2025/CVE-2025-1162.md @@ -0,0 +1,17 @@ +### [CVE-2025-1162](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1162) +![](https://img.shields.io/static/v1?label=Product&message=Job%20Recruitment&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\_parse/load\_user-profile.php. The manipulation of the argument userhash leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/LielingAi/ZhiShi diff --git a/2025/CVE-2025-1163.md b/2025/CVE-2025-1163.md new file mode 100644 index 00000000000..43968f8e6cb --- /dev/null +++ b/2025/CVE-2025-1163.md @@ -0,0 +1,17 @@ +### [CVE-2025-1163](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1163) +![](https://img.shields.io/static/v1?label=Product&message=Vehicle%20Parking%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability classified as critical was found in code-projects Vehicle Parking Management System 1.0. This vulnerability affects the function login of the component Authentication. The manipulation of the argument username leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/LielingAi/ZhiShi diff --git a/2025/CVE-2025-1164.md b/2025/CVE-2025-1164.md index 8cd66d8bbd8..622e89eabcd 100644 --- a/2025/CVE-2025-1164.md +++ b/2025/CVE-2025-1164.md @@ -15,5 +15,5 @@ Eine Schwachstelle wurde in code-projects Police FIR Record Management System 1. No PoCs from references. #### Github -No PoCs found on GitHub currently. +- https://github.com/LielingAi/ZhiShi diff --git a/2025/CVE-2025-1171.md b/2025/CVE-2025-1171.md new file mode 100644 index 00000000000..aa4c0e3ff07 --- /dev/null +++ b/2025/CVE-2025-1171.md @@ -0,0 +1,17 @@ +### [CVE-2025-1171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1171) +![](https://img.shields.io/static/v1?label=Product&message=Real%20Estate%20Property%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) + +### Description + +A vulnerability classified as problematic was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin/CustomerReport.php. The manipulation of the argument Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/LielingAi/ZhiShi diff --git a/2025/CVE-2025-43510.md b/2025/CVE-2025-43510.md new file mode 100644 index 00000000000..e4c71a2fb85 --- /dev/null +++ b/2025/CVE-2025-43510.md @@ -0,0 +1,22 @@ +### [CVE-2025-43510](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43510) +![](https://img.shields.io/static/v1?label=Product&message=iOS%20and%20iPadOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=macOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=tvOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=visionOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=watchOS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=A%20malicious%20application%20may%20cause%20unexpected%20changes%20in%20memory%20shared%20between%20processes&color=brightgreen) +![](https://img.shields.io/static/v1?label=CISA%20KEV&message=Known%20Exploited&color=red) + +### Description + +A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/kolbicz/Cyanide +- https://github.com/AmorCool/cyanide-o diff --git a/2025/CVE-2025-43520.md b/2025/CVE-2025-43520.md new file mode 100644 index 00000000000..20e5d960fb4 --- /dev/null +++ b/2025/CVE-2025-43520.md @@ -0,0 +1,22 @@ +### [CVE-2025-43520](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43520) +![](https://img.shields.io/static/v1?label=Product&message=iOS%20and%20iPadOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=macOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=tvOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=visionOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=watchOS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=A%20malicious%20application%20may%20be%20able%20to%20cause%20unexpected%20system%20termination%20or%20write%20kernel%20memory&color=brightgreen) +![](https://img.shields.io/static/v1?label=CISA%20KEV&message=Known%20Exploited&color=red) + +### Description + +A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/kolbicz/Cyanide +- https://github.com/AmorCool/cyanide-o diff --git a/2025/CVE-2025-55182.md b/2025/CVE-2025-55182.md index ac3e2850ec9..4685ec67ab0 100644 --- a/2025/CVE-2025-55182.md +++ b/2025/CVE-2025-55182.md @@ -23,3 +23,4 @@ No PoCs from references. - https://github.com/UwUGreed/CVE-2025-55182-poc - https://github.com/Tc3s/REACT2SHELL-WEB-VULN - https://github.com/Farhan9488/CVE-2025-55182-research +- https://github.com/JotaEspig/CVE-2025-66478-PoC-Reverse-Shell diff --git a/2026/CVE-2026-0961.md b/2026/CVE-2026-0961.md new file mode 100644 index 00000000000..d94f322a65b --- /dev/null +++ b/2026/CVE-2026-0961.md @@ -0,0 +1,17 @@ +### [CVE-2026-0961](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0961) +![](https://img.shields.io/static/v1?label=Product&message=Wireshark&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.6.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%3A%20Out-of-bounds%20Write&color=brightgreen) + +### Description + +BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/LielingAi/ZhiShi diff --git a/2026/CVE-2026-18963.md b/2026/CVE-2026-18963.md index 33efcd5ccb8..e3bfff4409c 100644 --- a/2026/CVE-2026-18963.md +++ b/2026/CVE-2026-18963.md @@ -25,3 +25,4 @@ No PoCs from references. - https://github.com/debugactiveprocess/CVE-2026-18963 - https://github.com/BlackHatExploitation/Exploit-For-CVE-2026-18963 - https://github.com/c0dejump/UnKeycloak +- https://github.com/M4xSec/My-Exploits diff --git a/2026/CVE-2026-34621.md b/2026/CVE-2026-34621.md index 52e75758887..777d813d4a3 100644 --- a/2026/CVE-2026-34621.md +++ b/2026/CVE-2026-34621.md @@ -20,3 +20,4 @@ No PoCs from references. - https://github.com/ercihan/CVE-2026-34621 - https://github.com/azefzafyoussef/CVE-2026-34621 - https://github.com/sanchit-saini/acrobat-reader-escape +- https://github.com/LielingAi/ZhiShi diff --git a/2026/CVE-2026-39816.md b/2026/CVE-2026-39816.md index 2518448055e..71bd090bcf3 100644 --- a/2026/CVE-2026-39816.md +++ b/2026/CVE-2026-39816.md @@ -14,3 +14,4 @@ No PoCs from references. #### Github - https://github.com/ZeroPathAI/nifi-CVE-2026-39816-poc +- https://github.com/M4xSec/My-Exploits diff --git a/2026/CVE-2026-42945.md b/2026/CVE-2026-42945.md index 095ee47fb8e..d96823d937c 100644 --- a/2026/CVE-2026-42945.md +++ b/2026/CVE-2026-42945.md @@ -38,3 +38,4 @@ No PoCs from references. - https://github.com/F2u0a0d3/CVE-2026-42945-nginx-rift-poc - https://github.com/sec-sys/CVE-2026-42945-Reverse-Shell-POC - https://github.com/laohuang101/NginxRift-Poc +- https://github.com/FranklinF25/cve-2026-42945 diff --git a/2026/CVE-2026-45833.md b/2026/CVE-2026-45833.md new file mode 100644 index 00000000000..e4047ad9da0 --- /dev/null +++ b/2026/CVE-2026-45833.md @@ -0,0 +1,16 @@ +### [CVE-2026-45833](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45833) +![](https://img.shields.io/static/v1?label=Product&message=ChromaDB&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.4.17&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20%28%27Code%20Injection%27%29&color=brightgreen) + +### Description + +A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/e4zyy/Project-CVE-2026-45833 diff --git a/2026/CVE-2026-48611.md b/2026/CVE-2026-48611.md index 15c96d82ff0..a098e6c062a 100644 --- a/2026/CVE-2026-48611.md +++ b/2026/CVE-2026-48611.md @@ -14,3 +14,4 @@ No PoCs from references. #### Github - https://github.com/wanmywan/CVE-2026-48611-phpBB +- https://github.com/Ethicalgrey/phpBB-CVE-2026-48611 diff --git a/2026/CVE-2026-5006.md b/2026/CVE-2026-5006.md new file mode 100644 index 00000000000..22cee8b6b6b --- /dev/null +++ b/2026/CVE-2026-5006.md @@ -0,0 +1,21 @@ +### [CVE-2026-5006](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5006) +![](https://img.shields.io/static/v1?label=Product&message=Vault&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Vault%20Enterprise&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.11.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. + +An attacker who can control the referenced identity value may include slash ({{/}}) characters that Vault interprets as additional path segments when rendering the policy. + +This vulnerability, CVE-2026-5006, was fixed in Vault Community Edition 2.0.4 and Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/M4xSec/My-Exploits diff --git a/2026/CVE-2026-56121.md b/2026/CVE-2026-56121.md index 7d6d5385076..a580843733d 100644 --- a/2026/CVE-2026-56121.md +++ b/2026/CVE-2026-56121.md @@ -13,4 +13,4 @@ Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows - https://huntr.com/bounties/d64b8111-180b-46ba-afa3-c877fda2ede6 #### Github -No PoCs found on GitHub currently. +- https://github.com/joaovicdev/EXPLOIT-CVE-2026-56121 diff --git a/2026/CVE-2026-60004.md b/2026/CVE-2026-60004.md index 95d4625f123..59fa18ee970 100644 --- a/2026/CVE-2026-60004.md +++ b/2026/CVE-2026-60004.md @@ -23,3 +23,4 @@ No PoCs from references. - https://github.com/HackSpeak/CVE-2026-60004 - https://github.com/shinthink/CVE-2026-60004 - https://github.com/Sachinart/CVE-2026-60004-gitea-0day +- https://github.com/InfoSec-DB/CVE-2026-60004-Gitea-RCE-PoC diff --git a/2026/CVE-2026-67363.md b/2026/CVE-2026-67363.md new file mode 100644 index 00000000000..01747d653f5 --- /dev/null +++ b/2026/CVE-2026-67363.md @@ -0,0 +1,17 @@ +### [CVE-2026-67363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-67363) +![](https://img.shields.io/static/v1?label=Product&message=Balbooa%20Forms%20extension%20for%20Joomla&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0.0-2.4.3.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-472%3A%20External%20Control%20of%20Assumed-Immutable%20Web%20Parameter&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-602%3A%20Client-Side%20Enforcement%20of%20Server-Side%20Security&color=brightgreen) + +### Description + +Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/Lulztigre/cve-2026-67363-67364 diff --git a/2026/CVE-2026-67364.md b/2026/CVE-2026-67364.md new file mode 100644 index 00000000000..8b55d24e95a --- /dev/null +++ b/2026/CVE-2026-67364.md @@ -0,0 +1,17 @@ +### [CVE-2026-67364](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-67364) +![](https://img.shields.io/static/v1?label=Product&message=Balbooa%20Forms%20extension%20for%20Joomla&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0.0-2.4.3.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%20Improper%20Control%20of%20Generation%20of%20Code%20%28%27Code%20Injection%27%29&color=brightgreen) + +### Description + +Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) +The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/Lulztigre/cve-2026-67363-67364 diff --git a/2026/CVE-2026-7474.md b/2026/CVE-2026-7474.md new file mode 100644 index 00000000000..fb647e2b784 --- /dev/null +++ b/2026/CVE-2026-7474.md @@ -0,0 +1,17 @@ +### [CVE-2026-7474](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7474) +![](https://img.shields.io/static/v1?label=Product&message=Nomad&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Nomad%20Enterprise&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.10.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20%28Path%20Traversal%29&color=brightgreen) + +### Description + +HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/M4xSec/My-Exploits diff --git a/2026/CVE-2026-7482.md b/2026/CVE-2026-7482.md index 1147f951762..9066b1a38af 100644 --- a/2026/CVE-2026-7482.md +++ b/2026/CVE-2026-7482.md @@ -15,3 +15,4 @@ No PoCs from references. #### Github - https://github.com/0x0OZ/CVE-2026-7482-PoC - https://github.com/kaleth4/CVE-2026-7482 +- https://github.com/cylockholmes/assay diff --git a/2026/CVE-2026-77013.md b/2026/CVE-2026-77013.md new file mode 100644 index 00000000000..ee0440afe23 --- /dev/null +++ b/2026/CVE-2026-77013.md @@ -0,0 +1,16 @@ +### [CVE-2026-77013](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77013) +![](https://img.shields.io/static/v1?label=Product&message=%E7%88%B1%E9%87%87%E9%9B%86%E6%95%B0%E6%8D%AE%E9%87%87%E9%9B%86%E5%92%8C%E5%8F%91%E5%B8%83%E6%8F%92%E4%BB%B6&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/83d578d5-bd47-421b-9b17-00c41fd53aaa/ + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-78903.md b/2026/CVE-2026-78903.md new file mode 100644 index 00000000000..f2a505ccfb6 --- /dev/null +++ b/2026/CVE-2026-78903.md @@ -0,0 +1,16 @@ +### [CVE-2026-78903](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78903) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=152.0.7977.65&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incomplete%20cleanup&color=brightgreen) + +### Description + +Incomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/vxssroott/CVE-2026-78903-SWIFT-Kick-to-the-Creds diff --git a/2026/CVE-2026-78904.md b/2026/CVE-2026-78904.md new file mode 100644 index 00000000000..62a75ec8eaf --- /dev/null +++ b/2026/CVE-2026-78904.md @@ -0,0 +1,16 @@ +### [CVE-2026-78904](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78904) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=152.0.7977.65&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Type%20confusion&color=brightgreen) + +### Description + +Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/vxssroott/CVE-2026-78904-Digital-Dinar-Drain diff --git a/2026/CVE-2026-78905.md b/2026/CVE-2026-78905.md new file mode 100644 index 00000000000..54ec8619f81 --- /dev/null +++ b/2026/CVE-2026-78905.md @@ -0,0 +1,16 @@ +### [CVE-2026-78905](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78905) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=152.0.7977.65&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Type%20confusion&color=brightgreen) + +### Description + +Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/vxssroott/CVE-2026-78905-Facebook-Account-Takeover diff --git a/2026/CVE-2026-82548.md b/2026/CVE-2026-82548.md new file mode 100644 index 00000000000..a11ff0b34ed --- /dev/null +++ b/2026/CVE-2026-82548.md @@ -0,0 +1,17 @@ +### [CVE-2026-82548](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82548) +![](https://img.shields.io/static/v1?label=Product&message=Magma&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.9.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen) + +### Description + +A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. + +### POC + +#### Reference +- https://github.com/magma/magma/issues/16022 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82549.md b/2026/CVE-2026-82549.md new file mode 100644 index 00000000000..a4a00fcd14b --- /dev/null +++ b/2026/CVE-2026-82549.md @@ -0,0 +1,17 @@ +### [CVE-2026-82549](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82549) +![](https://img.shields.io/static/v1?label=Product&message=Magma&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.9.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Validation%20of%20Integrity%20Check%20Value&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficient%20Verification%20of%20Data%20Authenticity&color=brightgreen) + +### Description + +A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to improper validation of integrity check value. The attack may be launched remotely. The exploit is publicly available and might be used. + +### POC + +#### Reference +- https://github.com/magma/magma/issues/16024 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82550.md b/2026/CVE-2026-82550.md new file mode 100644 index 00000000000..d90d78c9457 --- /dev/null +++ b/2026/CVE-2026-82550.md @@ -0,0 +1,16 @@ +### [CVE-2026-82550](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82550) +![](https://img.shields.io/static/v1?label=Product&message=Magma&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.9.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Input%20Validation&color=brightgreen) + +### Description + +A security flaw has been discovered in Linux Foundation Magma 1.9.0. This impacts an unknown function of the component NGSetupRequest Handler. Performing a manipulation of the argument NG-IoT-DefaultPagingDRX results in improper input validation. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/magma/magma/issues/16023 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82551.md b/2026/CVE-2026-82551.md new file mode 100644 index 00000000000..bd8b1ea66f8 --- /dev/null +++ b/2026/CVE-2026-82551.md @@ -0,0 +1,16 @@ +### [CVE-2026-82551](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82551) +![](https://img.shields.io/static/v1?label=Product&message=Magma&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.9.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=State%20Issue&color=brightgreen) + +### Description + +A weakness has been identified in Linux Foundation Magma 1.9.0. Affected is an unknown function of the file ngap_amf_handlers.c of the component NGSetup Handler. Executing a manipulation can lead to state issue. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. + +### POC + +#### Reference +- https://github.com/magma/magma/issues/16021 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82552.md b/2026/CVE-2026-82552.md new file mode 100644 index 00000000000..b3fc6ae4b9b --- /dev/null +++ b/2026/CVE-2026-82552.md @@ -0,0 +1,16 @@ +### [CVE-2026-82552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82552) +![](https://img.shields.io/static/v1?label=Product&message=Magma&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.9.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) + +### Description + +A security vulnerability has been detected in Linux Foundation Magma 1.9.0. Affected by this vulnerability is an unknown functionality of the file tasks/ngap/ngap_amf.c of the component gNB Termination Handler. The manipulation leads to denial of service. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. + +### POC + +#### Reference +- https://github.com/magma/magma/issues/16019 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82553.md b/2026/CVE-2026-82553.md new file mode 100644 index 00000000000..c71f583f572 --- /dev/null +++ b/2026/CVE-2026-82553.md @@ -0,0 +1,17 @@ +### [CVE-2026-82553](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82553) +![](https://img.shields.io/static/v1?label=Product&message=Student%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=56ba287f2e9031523ccb4244cb6e3fe530e4e5d5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Privilege%20Assignment&color=brightgreen) + +### Description + +A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysqli_query of the file student_dashboard.php of the component Student Dashboard. The manipulation of the argument roll_no results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/6 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82555.md b/2026/CVE-2026-82555.md new file mode 100644 index 00000000000..104978c04c6 --- /dev/null +++ b/2026/CVE-2026-82555.md @@ -0,0 +1,17 @@ +### [CVE-2026-82555](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82555) +![](https://img.shields.io/static/v1?label=Product&message=N600R&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.3.0cu.7866_B20220506&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficiently%20Random%20Values&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cryptographic%20Issues&color=brightgreen) + +### Description + +A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/b1uerry/cves/blob/main/TOTOLINK/N600R/TOTOLINK_N600R_predictable-token/poc.py + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82556.md b/2026/CVE-2026-82556.md new file mode 100644 index 00000000000..2bd9f4833df --- /dev/null +++ b/2026/CVE-2026-82556.md @@ -0,0 +1,20 @@ +### [CVE-2026-82556](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82556) +![](https://img.shields.io/static/v1?label=Product&message=Forgejo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=15.0.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15.0.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15.0.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15.0.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15.0.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery&color=brightgreen) + +### Description + +A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is_migrate_allowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named b313bb83f5ff22bcc0378e0e0ca7bbd58303f168. It is recommended to apply a patch to fix this issue. The project maintainer explains: "I don't intend to backport this to v15 or v16 as it is a breaking change." + +### POC + +#### Reference +- https://codeberg.org/forgejo/forgejo/issues/13433 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82587.md b/2026/CVE-2026-82587.md new file mode 100644 index 00000000000..c2419c8b0cf --- /dev/null +++ b/2026/CVE-2026-82587.md @@ -0,0 +1,23 @@ +### [CVE-2026-82587](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82587) +![](https://img.shields.io/static/v1?label=Product&message=Open5GS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.7.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.6&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.7&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_namf_comm_decode_ue_mm_context_list of the file src/amf/namf-handler.c of the component AMF. This manipulation of the argument ueContext.mmContextList[*].allowedNssai causes memory corruption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.8.0 is able to resolve this issue. Patch name: abf8a836564b966b5141110fc25ed413c4f17522. It is recommended to upgrade the affected component. + +### POC + +#### Reference +- https://github.com/open5gs/open5gs/issues/4398 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82589.md b/2026/CVE-2026-82589.md new file mode 100644 index 00000000000..e45e4855e75 --- /dev/null +++ b/2026/CVE-2026-82589.md @@ -0,0 +1,23 @@ +### [CVE-2026-82589](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82589) +![](https://img.shields.io/static/v1?label=Product&message=Open5GS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.7.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.6&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.7&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) + +### Description + +A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amf_namf_comm_handle_n1_n2_message_transfer of the file src/amf/namf-handler.c of the component N1-N2 Message Handler. Performing a manipulation of the argument N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType results in denial of service. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.8.0 is recommended to address this issue. The patch is named abf8a836564b966b5141110fc25ed413c4f17522. It is advisable to upgrade the affected component. + +### POC + +#### Reference +- https://github.com/open5gs/open5gs/issues/4396 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82592.md b/2026/CVE-2026-82592.md new file mode 100644 index 00000000000..94278270c9d --- /dev/null +++ b/2026/CVE-2026-82592.md @@ -0,0 +1,17 @@ +### [CVE-2026-82592](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82592) +![](https://img.shields.io/static/v1?label=Product&message=DIR-825M&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.1.8&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/formDiskFormat/formDiskFormat.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82593.md b/2026/CVE-2026-82593.md new file mode 100644 index 00000000000..7601e5c60c4 --- /dev/null +++ b/2026/CVE-2026-82593.md @@ -0,0 +1,17 @@ +### [CVE-2026-82593](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82593) +![](https://img.shields.io/static/v1?label=Product&message=DIR-825M&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.1.8&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fota_url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. + +### POC + +#### Reference +- https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/formLtefotaUpgradeFibocom/formLtefotaUpgradeFibocom.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82594.md b/2026/CVE-2026-82594.md new file mode 100644 index 00000000000..87e8f0a5c74 --- /dev/null +++ b/2026/CVE-2026-82594.md @@ -0,0 +1,19 @@ +### [CVE-2026-82594](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82594) +![](https://img.shields.io/static/v1?label=Product&message=grpc-spring-boot-starter&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=5.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.2.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Privilege%20Assignment&color=brightgreen) + +### Description + +A vulnerability has been found in LogNet grpc-spring-boot-starter up to 5.2.0. Affected is an unknown function of the component Annotation Processing. Such manipulation leads to improper authorization. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/LogNet/grpc-spring-boot-starter/issues/423 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82595.md b/2026/CVE-2026-82595.md new file mode 100644 index 00000000000..7898c4c3228 --- /dev/null +++ b/2026/CVE-2026-82595.md @@ -0,0 +1,17 @@ +### [CVE-2026-82595](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82595) +![](https://img.shields.io/static/v1?label=Product&message=DIR-825M&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.1.8&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. + +### POC + +#### Reference +- https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/formSysCmd/formSysCmd.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82596.md b/2026/CVE-2026-82596.md new file mode 100644 index 00000000000..645504133f5 --- /dev/null +++ b/2026/CVE-2026-82596.md @@ -0,0 +1,19 @@ +### [CVE-2026-82596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82596) +![](https://img.shields.io/static/v1?label=Product&message=LatencyUtils&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability was determined in LatencyUtils up to 2.0.3. Affected by this issue is the function LatencyStats.recordDetectedPause of the file src/main/java/org/LatencyUtils/LatencyStats.java of the component PauseDetector. Executing a manipulation can lead to memory corruption. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/LatencyUtils/LatencyUtils/issues/22 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82597.md b/2026/CVE-2026-82597.md new file mode 100644 index 00000000000..6d2b959a1fd --- /dev/null +++ b/2026/CVE-2026-82597.md @@ -0,0 +1,17 @@ +### [CVE-2026-82597](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82597) +![](https://img.shields.io/static/v1?label=Product&message=NR1800X&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.1.0u.6681_B20230703&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. + +### POC + +#### Reference +- https://github.com/lxiansheng488-bit/-/blob/main/TOTOlink/totolink%20setuuid%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5.pdf + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82598.md b/2026/CVE-2026-82598.md new file mode 100644 index 00000000000..d907f70abbb --- /dev/null +++ b/2026/CVE-2026-82598.md @@ -0,0 +1,23 @@ +### [CVE-2026-82598](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82598) +![](https://img.shields.io/static/v1?label=Product&message=SeaCMS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=13.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.6&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. + +### POC + +#### Reference +- https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-009-search-cascade-template-rce.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82599.md b/2026/CVE-2026-82599.md new file mode 100644 index 00000000000..67f11c64d57 --- /dev/null +++ b/2026/CVE-2026-82599.md @@ -0,0 +1,22 @@ +### [CVE-2026-82599](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82599) +![](https://img.shields.io/static/v1?label=Product&message=SeaCMS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=13.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.6&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. + +### POC + +#### Reference +- https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-002b-member-oldpic-file-deletion.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82600.md b/2026/CVE-2026-82600.md new file mode 100644 index 00000000000..2a8086f65de --- /dev/null +++ b/2026/CVE-2026-82600.md @@ -0,0 +1,23 @@ +### [CVE-2026-82600](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82600) +![](https://img.shields.io/static/v1?label=Product&message=SeaCMS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=13.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.6&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. + +### POC + +#### Reference +- https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-004-zyapi-ids-sql-injection.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82601.md b/2026/CVE-2026-82601.md new file mode 100644 index 00000000000..e0d4bd5589b --- /dev/null +++ b/2026/CVE-2026-82601.md @@ -0,0 +1,23 @@ +### [CVE-2026-82601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82601) +![](https://img.shields.io/static/v1?label=Product&message=SeaCMS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=13.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.6&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) + +### Description + +A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. + +### POC + +#### Reference +- https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-007-errtxt-reflected-xss.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82602.md b/2026/CVE-2026-82602.md new file mode 100644 index 00000000000..4515eb384d9 --- /dev/null +++ b/2026/CVE-2026-82602.md @@ -0,0 +1,23 @@ +### [CVE-2026-82602](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82602) +![](https://img.shields.io/static/v1?label=Product&message=SeaCMS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=13.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.6&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) + +### Description + +A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. + +### POC + +#### Reference +- https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-011-ass-paywall-url-disclosure.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82603.md b/2026/CVE-2026-82603.md new file mode 100644 index 00000000000..497dc23505c --- /dev/null +++ b/2026/CVE-2026-82603.md @@ -0,0 +1,22 @@ +### [CVE-2026-82603](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82603) +![](https://img.shields.io/static/v1?label=Product&message=SeaCMS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=13.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13.6&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-008-member-del-pl-js-file-deletion.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82607.md b/2026/CVE-2026-82607.md new file mode 100644 index 00000000000..8bfff7d711f --- /dev/null +++ b/2026/CVE-2026-82607.md @@ -0,0 +1,18 @@ +### [CVE-2026-82607](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82607) +![](https://img.shields.io/static/v1?label=Product&message=Profile%20Builder%20Plugin&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.16.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.16.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Unrestricted%20Upload&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen) + +### Description + +A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 3.16.2 is sufficient to resolve this issue. It is suggested to upgrade the affected component. + +### POC + +#### Reference +- https://ciphersecuritylabs.com/research/articles/when-the-browser-is-the-only-bouncer-unauthenticated-media-upload-in-profile-builder + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82608.md b/2026/CVE-2026-82608.md new file mode 100644 index 00000000000..27ff08cfdfa --- /dev/null +++ b/2026/CVE-2026-82608.md @@ -0,0 +1,30 @@ +### [CVE-2026-82608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82608) +![](https://img.shields.io/static/v1?label=Product&message=Kamailio&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=5.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.5.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0.5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0.6&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0.7&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-Bounds%20Read&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore." + +### POC + +#### Reference +- https://github.com/kamailio/kamailio/issues/4816 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82609.md b/2026/CVE-2026-82609.md new file mode 100644 index 00000000000..66851b0d3bc --- /dev/null +++ b/2026/CVE-2026-82609.md @@ -0,0 +1,17 @@ +### [CVE-2026-82609](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82609) +![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. + +### POC + +#### Reference +- https://github.com/ltranquility/submit_repository/issues/1 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82610.md b/2026/CVE-2026-82610.md new file mode 100644 index 00000000000..d740f181c04 --- /dev/null +++ b/2026/CVE-2026-82610.md @@ -0,0 +1,17 @@ +### [CVE-2026-82610](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82610) +![](https://img.shields.io/static/v1?label=Product&message=Online%20Medicine%20Delivery%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument emp_email results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. + +### POC + +#### Reference +- https://github.com/boyslikesports/202607_vul_dir/blob/main/C-01-SQLi-Employee-Auth-Bypass_en.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82611.md b/2026/CVE-2026-82611.md new file mode 100644 index 00000000000..486e28ce793 --- /dev/null +++ b/2026/CVE-2026-82611.md @@ -0,0 +1,17 @@ +### [CVE-2026-82611](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82611) +![](https://img.shields.io/static/v1?label=Product&message=Online%20Medicine%20Delivery%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument U_USERNAME causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. + +### POC + +#### Reference +- https://github.com/boyslikesports/202607_vul_dir/blob/main/C-02-SQLi-Customer-Auth-Bypass_en.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82612.md b/2026/CVE-2026-82612.md new file mode 100644 index 00000000000..1e17f1085e6 --- /dev/null +++ b/2026/CVE-2026-82612.md @@ -0,0 +1,17 @@ +### [CVE-2026-82612](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82612) +![](https://img.shields.io/static/v1?label=Product&message=Online%20Medicine%20Delivery%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function loadResultList of the file /index.php?q=single-item of the component Product Detail Page. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. + +### POC + +#### Reference +- https://github.com/boyslikesports/202607_vul_dir/blob/main/C-03-SQLi-Single-Item-ID_en.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82613.md b/2026/CVE-2026-82613.md new file mode 100644 index 00000000000..b37f53adba3 --- /dev/null +++ b/2026/CVE-2026-82613.md @@ -0,0 +1,17 @@ +### [CVE-2026-82613](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82613) +![](https://img.shields.io/static/v1?label=Product&message=Online%20Medicine%20Delivery%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of the component Product Search Interface. Performing a manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/boyslikesports/202607_vul_dir/blob/main/C-04-SQLi-Product-Search-LIKE_en.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82614.md b/2026/CVE-2026-82614.md new file mode 100644 index 00000000000..947a74c758b --- /dev/null +++ b/2026/CVE-2026-82614.md @@ -0,0 +1,17 @@ +### [CVE-2026-82614](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82614) +![](https://img.shields.io/static/v1?label=Product&message=Online%20Medicine%20Delivery%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=product of the component Product Category Filter Interface. Executing a manipulation of the argument Category can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. + +### POC + +#### Reference +- https://github.com/boyslikesports/202607_vul_dir/blob/main/C-05-SQLi-Product-Category_en.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82615.md b/2026/CVE-2026-82615.md new file mode 100644 index 00000000000..422f1a06470 --- /dev/null +++ b/2026/CVE-2026-82615.md @@ -0,0 +1,17 @@ +### [CVE-2026-82615](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82615) +![](https://img.shields.io/static/v1?label=Product&message=Online%20Medicine%20Delivery%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::find_phone of the file /passwordrecover.php of the component Password Recovery Interface. The manipulation of the argument phonenumber leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/boyslikesports/202607_vul_dir/blob/main/C-06-SQLi-Password-Recover_en.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82616.md b/2026/CVE-2026-82616.md new file mode 100644 index 00000000000..96133b31169 --- /dev/null +++ b/2026/CVE-2026-82616.md @@ -0,0 +1,17 @@ +### [CVE-2026-82616](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82616) +![](https://img.shields.io/static/v1?label=Product&message=NR1800X&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.1.0u.6681_B20230703&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. + +### POC + +#### Reference +- https://github.com/lxiansheng488-bit/-/blob/main/TOTOlink/totolink%20setUploadSetting%E6%A0%88%E6%BA%A2%E5%87%BA.pdf + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82619.md b/2026/CVE-2026-82619.md new file mode 100644 index 00000000000..afe648a94ff --- /dev/null +++ b/2026/CVE-2026-82619.md @@ -0,0 +1,20 @@ +### [CVE-2026-82619](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82619) +![](https://img.shields.io/static/v1?label=Product&message=S2OPC&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.7.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.7.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.7.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.7.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20After%20Free&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result of the file src/ClientServer/services/bgenc/subscription_mgr.c. Such manipulation of the argument EventFilter leads to use after free. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is a4cee16a851b971be447a6ed531173702c722b99. It is best practice to apply a patch to resolve this issue. + +### POC + +#### Reference +- https://gitlab.com/systerel/S2OPC/-/work_items/1797 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82620.md b/2026/CVE-2026-82620.md new file mode 100644 index 00000000000..c984b7532f9 --- /dev/null +++ b/2026/CVE-2026-82620.md @@ -0,0 +1,18 @@ +### [CVE-2026-82620](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82620) +![](https://img.shields.io/static/v1?label=Product&message=StudentManagement&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=%E5%AD%A6%E7%94%9F%E4%BF%A1%E6%81%AF%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=e08f7f1d5015af407aa4cca0ada3dea189b4937e&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.course_ranking of the file code/src/dao/CourseDao.java. Performing a manipulation of the argument cno results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/Soarkey/StudentManagement/issues/33 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82621.md b/2026/CVE-2026-82621.md new file mode 100644 index 00000000000..306c96908c8 --- /dev/null +++ b/2026/CVE-2026-82621.md @@ -0,0 +1,18 @@ +### [CVE-2026-82621](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82621) +![](https://img.shields.io/static/v1?label=Product&message=StudentManagement&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=%E5%AD%A6%E7%94%9F%E4%BF%A1%E6%81%AF%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=e08f7f1d5015af407aa4cca0ada3dea189b4937e&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) + +### Description + +A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/Soarkey/StudentManagement/issues/32 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82622.md b/2026/CVE-2026-82622.md new file mode 100644 index 00000000000..422052f51f7 --- /dev/null +++ b/2026/CVE-2026-82622.md @@ -0,0 +1,17 @@ +### [CVE-2026-82622](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82622) +![](https://img.shields.io/static/v1?label=Product&message=Employee%20Leave%20Managing%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) + +### Description + +A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/editaction.php of the component Employee Profile Update. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. + +### POC + +#### Reference +- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Employee%20Leave%20Managing%20System%20PHP%20name%20Parameter.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82623.md b/2026/CVE-2026-82623.md new file mode 100644 index 00000000000..78d98b814a3 --- /dev/null +++ b/2026/CVE-2026-82623.md @@ -0,0 +1,22 @@ +### [CVE-2026-82623](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82623) +![](https://img.shields.io/static/v1?label=Product&message=open62541&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.5.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.5.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.5.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.5.3&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.5.4&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.5.5&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20After%20Free&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backend_copyRange of the file plugins/historydata/ua_history_data_backend_memory.c of the component History Backend. The manipulation results in use after free. The attack can be launched remotely. The exploit is now public and may be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability. + +### POC + +#### Reference +- https://github.com/open62541/open62541/issues/8199 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82624.md b/2026/CVE-2026-82624.md new file mode 100644 index 00000000000..3f032a0c3a0 --- /dev/null +++ b/2026/CVE-2026-82624.md @@ -0,0 +1,17 @@ +### [CVE-2026-82624](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82624) +![](https://img.shields.io/static/v1?label=Product&message=Simple%20Inventory%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen) + +### Description + +A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been published and may be used. + +### POC + +#### Reference +- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Sensitive%20Information%20Disclosure%20in%20Simple%20Inventory%20System%20PHP%20Exposed%20Database%20Backup.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82625.md b/2026/CVE-2026-82625.md new file mode 100644 index 00000000000..4384a58213f --- /dev/null +++ b/2026/CVE-2026-82625.md @@ -0,0 +1,17 @@ +### [CVE-2026-82625](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82625) +![](https://img.shields.io/static/v1?label=Product&message=Simple%20Inventory%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) + +### Description + +A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument last_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Simple%20Inventory%20System%20PHP%20last_name%20Parameter.md + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82629.md b/2026/CVE-2026-82629.md new file mode 100644 index 00000000000..7e14577f7a8 --- /dev/null +++ b/2026/CVE-2026-82629.md @@ -0,0 +1,17 @@ +### [CVE-2026-82629](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82629) +![](https://img.shields.io/static/v1?label=Product&message=jeewx-boot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=641ab52c3e1845fec39996d7794c33fb40dad1dd&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Unrestricted%20Upload&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen) + +### Description + +A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the component doUpload Endpoint. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/jeecgboot/jeewx-boot/issues/48 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82630.md b/2026/CVE-2026-82630.md new file mode 100644 index 00000000000..d9a00f5d0de --- /dev/null +++ b/2026/CVE-2026-82630.md @@ -0,0 +1,18 @@ +### [CVE-2026-82630](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82630) +![](https://img.shields.io/static/v1?label=Product&message=PowerJob&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=5.1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.1.1&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.1.2&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery&color=brightgreen) + +### Description + +A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/PowerJob/PowerJob/issues/1181 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82631.md b/2026/CVE-2026-82631.md new file mode 100644 index 00000000000..da0b64e7103 --- /dev/null +++ b/2026/CVE-2026-82631.md @@ -0,0 +1,17 @@ +### [CVE-2026-82631](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82631) +![](https://img.shields.io/static/v1?label=Product&message=valkey&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20After%20Free&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue. + +### POC + +#### Reference +- https://github.com/user-attachments/files/30111628/PoC.zip + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82664.md b/2026/CVE-2026-82664.md new file mode 100644 index 00000000000..2ee42af0e1c --- /dev/null +++ b/2026/CVE-2026-82664.md @@ -0,0 +1,18 @@ +### [CVE-2026-82664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82664) +![](https://img.shields.io/static/v1?label=Product&message=GEOFlow&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) + +### Description + +A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.1.1 is able to mitigate this issue. The identifier of the patch is 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is recommended. + +### POC + +#### Reference +- https://github.com/yaojingang/GEOFlow/issues/60 + +#### Github +No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-82665.md b/2026/CVE-2026-82665.md new file mode 100644 index 00000000000..db9598bf805 --- /dev/null +++ b/2026/CVE-2026-82665.md @@ -0,0 +1,17 @@ +### [CVE-2026-82665](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82665) +![](https://img.shields.io/static/v1?label=Product&message=GEOFlow&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument file_path results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 2.1.1 is able to resolve this issue. The patch is identified as 67abfd864a15d169a78429f3290c91cb3b93e849. It is recommended to upgrade the affected component. + +### POC + +#### Reference +- https://github.com/yaojingang/GEOFlow/issues/60 + +#### Github +No PoCs found on GitHub currently. diff --git a/github.txt b/github.txt index 9c5eab7fa9c..82d6d21b73c 100644 --- a/github.txt +++ b/github.txt @@ -28370,3 +28370,30 @@ CVE-2026-76581 - https://github.com/HORKimhab/CVE-2026-76581 CVE-2026-82222 - https://github.com/dinosn/givewp-cve-2026-82222-rce-lab CVE-2026-82286 - https://github.com/BiiTts/CVE-2026-82286-gpt-crawler-Arbitrary-File-Write CVE-2026-8452 - https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777 +CVE-2025-0324 - https://github.com/kemrec/CVE-2025-0324-axis-vapix-privesc +CVE-2025-1162 - https://github.com/LielingAi/ZhiShi +CVE-2025-1163 - https://github.com/LielingAi/ZhiShi +CVE-2025-1164 - https://github.com/LielingAi/ZhiShi +CVE-2025-1171 - https://github.com/LielingAi/ZhiShi +CVE-2025-43510 - https://github.com/AmorCool/cyanide-o +CVE-2025-43510 - https://github.com/kolbicz/Cyanide +CVE-2025-43520 - https://github.com/AmorCool/cyanide-o +CVE-2025-43520 - https://github.com/kolbicz/Cyanide +CVE-2025-55182 - https://github.com/JotaEspig/CVE-2025-66478-PoC-Reverse-Shell +CVE-2026-0961 - https://github.com/LielingAi/ZhiShi +CVE-2026-18963 - https://github.com/M4xSec/My-Exploits +CVE-2026-34621 - https://github.com/LielingAi/ZhiShi +CVE-2026-39816 - https://github.com/M4xSec/My-Exploits +CVE-2026-42945 - https://github.com/FranklinF25/cve-2026-42945 +CVE-2026-45833 - https://github.com/e4zyy/Project-CVE-2026-45833 +CVE-2026-48611 - https://github.com/Ethicalgrey/phpBB-CVE-2026-48611 +CVE-2026-5006 - https://github.com/M4xSec/My-Exploits +CVE-2026-56121 - https://github.com/joaovicdev/EXPLOIT-CVE-2026-56121 +CVE-2026-60004 - https://github.com/InfoSec-DB/CVE-2026-60004-Gitea-RCE-PoC +CVE-2026-67363 - https://github.com/Lulztigre/cve-2026-67363-67364 +CVE-2026-67364 - https://github.com/Lulztigre/cve-2026-67363-67364 +CVE-2026-7474 - https://github.com/M4xSec/My-Exploits +CVE-2026-7482 - https://github.com/cylockholmes/assay +CVE-2026-78903 - https://github.com/vxssroott/CVE-2026-78903-SWIFT-Kick-to-the-Creds +CVE-2026-78904 - https://github.com/vxssroott/CVE-2026-78904-Digital-Dinar-Drain +CVE-2026-78905 - https://github.com/vxssroott/CVE-2026-78905-Facebook-Account-Takeover diff --git a/references.txt b/references.txt index 1491a1c3995..2554ec0e02a 100644 --- a/references.txt +++ b/references.txt @@ -144488,3 +144488,48 @@ CVE-2026-82542 - https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob CVE-2026-82543 - https://github.com/vastsa/FileCodeBox/issues/482 CVE-2026-82545 - https://github.com/ltranquility/submit_vuln/issues/22 CVE-2026-82547 - https://github.com/magma/magma/issues/16020 +CVE-2026-77013 - https://wpscan.com/vulnerability/83d578d5-bd47-421b-9b17-00c41fd53aaa/ +CVE-2026-82548 - https://github.com/magma/magma/issues/16022 +CVE-2026-82549 - https://github.com/magma/magma/issues/16024 +CVE-2026-82550 - https://github.com/magma/magma/issues/16023 +CVE-2026-82551 - https://github.com/magma/magma/issues/16021 +CVE-2026-82552 - https://github.com/magma/magma/issues/16019 +CVE-2026-82553 - https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/6 +CVE-2026-82555 - https://github.com/b1uerry/cves/blob/main/TOTOLINK/N600R/TOTOLINK_N600R_predictable-token/poc.py +CVE-2026-82556 - https://codeberg.org/forgejo/forgejo/issues/13433 +CVE-2026-82587 - https://github.com/open5gs/open5gs/issues/4398 +CVE-2026-82589 - https://github.com/open5gs/open5gs/issues/4396 +CVE-2026-82592 - https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/formDiskFormat/formDiskFormat.md +CVE-2026-82593 - https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/formLtefotaUpgradeFibocom/formLtefotaUpgradeFibocom.md +CVE-2026-82594 - https://github.com/LogNet/grpc-spring-boot-starter/issues/423 +CVE-2026-82595 - https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/formSysCmd/formSysCmd.md +CVE-2026-82596 - https://github.com/LatencyUtils/LatencyUtils/issues/22 +CVE-2026-82597 - https://github.com/lxiansheng488-bit/-/blob/main/TOTOlink/totolink%20setuuid%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5.pdf +CVE-2026-82598 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-009-search-cascade-template-rce.md +CVE-2026-82599 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-002b-member-oldpic-file-deletion.md +CVE-2026-82600 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-004-zyapi-ids-sql-injection.md +CVE-2026-82601 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-007-errtxt-reflected-xss.md +CVE-2026-82602 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-011-ass-paywall-url-disclosure.md +CVE-2026-82603 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-008-member-del-pl-js-file-deletion.md +CVE-2026-82607 - https://ciphersecuritylabs.com/research/articles/when-the-browser-is-the-only-bouncer-unauthenticated-media-upload-in-profile-builder +CVE-2026-82608 - https://github.com/kamailio/kamailio/issues/4816 +CVE-2026-82609 - https://github.com/ltranquility/submit_repository/issues/1 +CVE-2026-82610 - https://github.com/boyslikesports/202607_vul_dir/blob/main/C-01-SQLi-Employee-Auth-Bypass_en.md +CVE-2026-82611 - https://github.com/boyslikesports/202607_vul_dir/blob/main/C-02-SQLi-Customer-Auth-Bypass_en.md +CVE-2026-82612 - https://github.com/boyslikesports/202607_vul_dir/blob/main/C-03-SQLi-Single-Item-ID_en.md +CVE-2026-82613 - https://github.com/boyslikesports/202607_vul_dir/blob/main/C-04-SQLi-Product-Search-LIKE_en.md +CVE-2026-82614 - https://github.com/boyslikesports/202607_vul_dir/blob/main/C-05-SQLi-Product-Category_en.md +CVE-2026-82615 - https://github.com/boyslikesports/202607_vul_dir/blob/main/C-06-SQLi-Password-Recover_en.md +CVE-2026-82616 - https://github.com/lxiansheng488-bit/-/blob/main/TOTOlink/totolink%20setUploadSetting%E6%A0%88%E6%BA%A2%E5%87%BA.pdf +CVE-2026-82619 - https://gitlab.com/systerel/S2OPC/-/work_items/1797 +CVE-2026-82620 - https://github.com/Soarkey/StudentManagement/issues/33 +CVE-2026-82621 - https://github.com/Soarkey/StudentManagement/issues/32 +CVE-2026-82622 - https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Employee%20Leave%20Managing%20System%20PHP%20name%20Parameter.md +CVE-2026-82623 - https://github.com/open62541/open62541/issues/8199 +CVE-2026-82624 - https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Sensitive%20Information%20Disclosure%20in%20Simple%20Inventory%20System%20PHP%20Exposed%20Database%20Backup.md +CVE-2026-82625 - https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Simple%20Inventory%20System%20PHP%20last_name%20Parameter.md +CVE-2026-82629 - https://github.com/jeecgboot/jeewx-boot/issues/48 +CVE-2026-82630 - https://github.com/PowerJob/PowerJob/issues/1181 +CVE-2026-82631 - https://github.com/user-attachments/files/30111628/PoC.zip +CVE-2026-82664 - https://github.com/yaojingang/GEOFlow/issues/60 +CVE-2026-82665 - https://github.com/yaojingang/GEOFlow/issues/60