diff --git a/README.md b/README.md index c795c35a824..781b5be2891 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-17%20Sep%202026%2002%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609170207)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C908-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C197-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609170207)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-17%20Sep%202026%2003%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609170307)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C908-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C197-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609170307)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,26 +12,26 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 13h ago | KEV [lenovo_y700_tb320fc_on_CVE-2025-21479](https://github.com/xjoker/lenovo_y700_tb320fc_on_CVE-2025-21479) | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… | -| 1⭐ | 14h ago | [CVE-2025-57231](https://github.com/anirbala98/CVE-2025-57231) | Docmost < 0.22.0 - Arbitrary File Read | +| 2⭐ | 45m ago | KEV [CVE-2025-32432-exploit-by-P34NUT](https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT) | Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail | +| 0⭐ | 14h ago | KEV [lenovo_y700_tb320fc_on_CVE-2025-21479](https://github.com/xjoker/lenovo_y700_tb320fc_on_CVE-2025-21479) | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… | +| 1⭐ | 15h ago | [CVE-2025-57231](https://github.com/anirbala98/CVE-2025-57231) | Docmost < 0.22.0 - Arbitrary File Read | | 0⭐ | 1d ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | -| 2⭐ | 1d ago | [langflow-CVE-2026-17633-PoC](https://github.com/Oscar-Collado/langflow-CVE-2026-17633-PoC) | PoC for CVE-2026-17633 - Authenticated RCE in IBM Langflow OSS 1.0.0-1.10.3 via custom_component endpoint.… | +| 1⭐ | 1d ago | [langflow-CVE-2026-17633-PoC](https://github.com/Oscar-Collado/langflow-CVE-2026-17633-PoC) | PoC for CVE-2026-17633 - Authenticated RCE in IBM Langflow OSS 1.0.0-1.10.3 via custom_component endpoint.… | | 0⭐ | 1d ago | KEV [CVE-2025-24813](https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-24813) | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure… | | 0⭐ | 1d ago | [CVE-2025-64512_PoC](https://github.com/Jinook-Kim/CVE-2025-64512_PoC) | Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from… | | 0⭐ | 2d ago | KEV [CVE-2025-32432](https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-32432) | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.… | | 0⭐ | 3d ago | [CVE-2025-24071](https://github.com/BardLaudian/CVE-2025-24071) | Dependency-free PoC generator for CVE-2025-24071 - Windows File Explorer .library-ms NTLM hash disclosure via… | | 0⭐ | 3d ago | KEV [CVE-2025-38352-PoC](https://github.com/longwasu/CVE-2025-38352-PoC) | PoC and GDB script assists in triggering CVE-2025-38352 | -| 7⭐ | 5d ago | [CVE-2026-21858-n8n-FullChain](https://github.com/ZeroDayEvil/CVE-2026-21858-n8n-FullChain) | 🛡️ Official AI Security Tool module for CVE-2026-21858 + CVE-2025-68613 (n8n "Ni8mare" Unauthenticated… | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 15⭐ | 6h ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | -| 91⭐ | 12h ago | KEV [cve-2026-41940-PoC](https://github.com/ctdal/cve-2026-41940-PoC) | A cPanel and WHM authentication bypassing tool | +| 15⭐ | 7h ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | +| 106⭐ | 13h ago | KEV [cve-2026-41940-PoC](https://github.com/ctdal/cve-2026-41940-PoC) | A cPanel and WHM authentication bypassing tool | | 3⭐ | 1d ago | [POC-AIOWPM-CVE-2026-19949](https://github.com/686f6c61/POC-AIOWPM-CVE-2026-19949) | PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <=… | | 3⭐ | 1d ago | [CVE-2026-12944](https://github.com/cflowsec/CVE-2026-12944) | Langflow 1.10.0 urllib SSRF POC | -| 17⭐ | 2d ago | [CVE-2026-31694-POC](https://github.com/0xCyberstan/CVE-2026-31694-POC) | Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a… | +| 16⭐ | 2d ago | [CVE-2026-31694-POC](https://github.com/0xCyberstan/CVE-2026-31694-POC) | Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a… | | 4⭐ | 2d ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | | 4⭐ | 2d ago | KEV [CVE-2026-73570](https://github.com/gabrielunknown/CVE-2026-73570) | Zimbra SNMP Notification OS Command Injection - Unauthenticated RCE via SMTP exploit (Poc) | | 7⭐ | 3d ago | [CVE-2026-42536-PoC](https://github.com/erberkan/CVE-2026-42536-PoC) | Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and… | diff --git a/cves/2025/CVE-2025-32432.md b/cves/2025/CVE-2025-32432.md index 43634372ec1..9e58d54666a 100644 --- a/cves/2025/CVE-2025-32432.md +++ b/cves/2025/CVE-2025-32432.md @@ -33,6 +33,7 @@ Craft is a flexible, user-friendly CMS for creating custom digital experiences o - https://github.com/Acczdy/CVE-Vault - https://github.com/Collinformatics/HTB-Orion - https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-32432 +- https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT #### Nuclei - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32432.yaml diff --git a/cves/2025/CVE-2025-8061.md b/cves/2025/CVE-2025-8061.md index aed854d549c..06fd06d3be8 100644 --- a/cves/2025/CVE-2025-8061.md +++ b/cves/2025/CVE-2025-8061.md @@ -18,4 +18,5 @@ No PoCs from references. - https://github.com/spawn451/CVE-2025-8061-Exploit - https://github.com/symeonp/Lenovo-CVE-2025-8061 - https://github.com/vxqs/Lenovo-CVE-2025-8061 +- https://github.com/uLl0a/MSRMapper diff --git a/index/github.txt b/index/github.txt index 54cdbcdc50f..965ab3336f9 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26638,3 +26638,5 @@ CVE-2026-83991 - https://github.com/karollooool/CVE-2026-83991-writeup-and-poc CVE-2026-12944 - https://github.com/ShadowForge-Cyber/CVE-2026-12944 CVE-2026-43499 - https://github.com/rushiranpise/samsu CVE-2026-55781 - https://github.com/g17hubH4ck/CVE-2026-55781-poc +CVE-2025-32432 - https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT +CVE-2025-8061 - https://github.com/uLl0a/MSRMapper diff --git a/index/trending.json b/index/trending.json index 5878ca194e5..ccedbe083db 100644 --- a/index/trending.json +++ b/index/trending.json @@ -12,7 +12,7 @@ }, { "year": 2026, - "stars": 91, + "stars": 106, "name": "cve-2026-41940-PoC", "url": "https://github.com/ctdal/cve-2026-41940-PoC", "desc": "A cPanel and WHM authentication bypassing tool", @@ -45,7 +45,7 @@ }, { "year": 2026, - "stars": 17, + "stars": 16, "name": "CVE-2026-31694-POC", "url": "https://github.com/0xCyberstan/CVE-2026-31694-POC", "desc": "Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a page-cache page by 24 bytes. PoC plus an unprivileged local-root exploit via /etc/passwd page-cache corruption. Run only inside a VM.", @@ -472,6 +472,18 @@ "cve": "CVE-2023-32315", "kev": true }, + { + "year": 2025, + "stars": 2, + "name": "CVE-2025-32432-exploit-by-P34NUT", + "url": "https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT", + "desc": "Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail", + "pushed": "2026-09-17T02:22:58Z", + "created": "2026-09-16T23:32:09Z", + "cve": "CVE-2025-32432", + "kev": true, + "landed": true + }, { "year": 2025, "stars": 0, @@ -510,7 +522,7 @@ }, { "year": 2026, - "stars": 2, + "stars": 1, "name": "langflow-CVE-2026-17633-PoC", "url": "https://github.com/Oscar-Collado/langflow-CVE-2026-17633-PoC", "desc": "PoC for CVE-2026-17633 - Authenticated RCE in IBM Langflow OSS 1.0.0-1.10.3 via custom_component endpoint. Includes CVE-2026-17632 AST scanner bypass research.", @@ -579,17 +591,5 @@ "cve": "CVE-2025-38352", "kev": true, "landed": true - }, - { - "year": 2026, - "stars": 7, - "name": "CVE-2026-21858-n8n-FullChain", - "url": "https://github.com/ZeroDayEvil/CVE-2026-21858-n8n-FullChain", - "desc": "🛡️ Official AI Security Tool module for CVE-2026-21858 + CVE-2025-68613 (n8n \"Ni8mare\" Unauthenticated Arbitrary File Read & Expression Injection RCE Full Chain).", - "pushed": "2026-09-12T00:08:09Z", - "created": "2026-09-12T00:03:07Z", - "cve": "CVE-2026-21858", - "kev": false, - "landed": true } ]