diff --git a/README.md b/README.md index 8f741af715e..385a164a1e0 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-02%20Oct%202026%2008%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610020807)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C929-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C219-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610020807)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-02%20Oct%202026%2009%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610020907)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C932-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C219-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610020907)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,8 +12,8 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 13h ago | [CVE-2025-47947](https://github.com/yel1337/CVE-2025-47947) | POC for libapache2-mod-security2 | -| 0⭐ | 22h ago | KEV [CVE-2025-8110](https://github.com/Makis6/CVE-2025-8110) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | +| 0⭐ | 14h ago | [CVE-2025-47947](https://github.com/yel1337/CVE-2025-47947) | POC for libapache2-mod-security2 | +| 0⭐ | 23h ago | KEV [CVE-2025-8110](https://github.com/Makis6/CVE-2025-8110) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | | 1⭐ | 1d ago | [CVE-2025-29927](https://github.com/vulnace/CVE-2025-29927) | POC for react2shell | | 0⭐ | 1d ago | [CVE-2025-59528-Poc](https://github.com/Amoru-Bek/CVE-2025-59528-Poc) | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,… | | 1⭐ | 1d ago | KEV [CVE-2025-31161](https://github.com/0xBlackash/CVE-2025-31161) | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin… | @@ -46,7 +46,7 @@ | 3⭐ | 4d ago | [CVE-2026-48842](https://github.com/4minx/CVE-2026-48842) | CVE-2026-48842 PoC - Roundcube virtuser_query pre-auth SQLi | | 10⭐ | 4d ago | KEV [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | | 10⭐ | 4d ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… | -| 4⭐ | 4d ago | [CVE-2026-44011-craftcms-auth-rce](https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce) | The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user. | +| 4⭐ | 5d ago | [CVE-2026-44011-craftcms-auth-rce](https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce) | The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user. | ## Trending in 2025 diff --git a/cves/2026/CVE-2026-100520.md b/cves/2026/CVE-2026-100520.md new file mode 100644 index 00000000000..ee03489e6f8 --- /dev/null +++ b/cves/2026/CVE-2026-100520.md @@ -0,0 +1,18 @@ +### [CVE-2026-100520](https://www.cve.org/CVERecord?id=CVE-2026-100520) +**Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint** +![](https://img.shields.io/static/v1?label=Vendor&message=crivion&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Laranode&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20%28%27Path%20Traversal%27%29&color=brightgreen) + +### Description + +Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/wvllxe/CVE-2026-100520-laranode-path-traversal diff --git a/cves/2026/CVE-2026-104051.md b/cves/2026/CVE-2026-104051.md new file mode 100644 index 00000000000..87c01b89fd7 --- /dev/null +++ b/cves/2026/CVE-2026-104051.md @@ -0,0 +1,18 @@ +### [CVE-2026-104051](https://www.cve.org/CVERecord?id=CVE-2026-104051) +**PictShare < 3.7.1 Sensitive Information Disclosure via info API** +![](https://img.shields.io/static/v1?label=Vendor&message=HaschekSolutions&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=pictshare&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficiently%20Protected%20Credentials&color=brightgreen) + +### Description + +PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the publicly visible file hash to retrieve the delete_code via the info API and then invoke the delete API to permanently delete arbitrary files, while also exposing uploader IP, User Agent, remote port, and SHA-1 hash, resulting in loss of content integrity, availability, and uploader privacy. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/wvllxe/CVE-2026-104051-pictshare-info-disclosure diff --git a/cves/2026/CVE-2026-104356.md b/cves/2026/CVE-2026-104356.md new file mode 100644 index 00000000000..ebfa04a724f --- /dev/null +++ b/cves/2026/CVE-2026-104356.md @@ -0,0 +1,18 @@ +### [CVE-2026-104356](https://www.cve.org/CVERecord?id=CVE-2026-104356) +**PictShare < 3.7.1 Predictable Delete Code via rand()** +![](https://img.shields.io/static/v1?label=Vendor&message=HaschekSolutions&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=pictshare&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Cryptographically%20Weak%20Pseudo-Random%20Number%20Generator%20%28PRNG%29&color=brightgreen) + +### Description + +PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/wvllxe/CVE-2026-104356-pictshare-weak-delete-code diff --git a/docs/hero.svg b/docs/hero.svg index 7ce2f07df29..edbacecb57a 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 83,932 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 173,234 + fill="#e6edf3" letter-spacing="-0.5">173,237 CVES INDEXED83,929 + fill="#2f81f7" letter-spacing="-0.5">83,932 WITH POCS1,219 diff --git a/docs/social-card.svg b/docs/social-card.svg index c0de5cf1077..dffc3e90057 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 173,234 + fill="#e6edf3" letter-spacing="-0.5">173,237 CVES INDEXED83,929 + fill="#2f81f7" letter-spacing="-0.5">83,932 WITH POCS1,219 diff --git a/docs/stats.json b/docs/stats.json index 14bbf01d2cd..23a61057709 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1219, - "total_cves": 173234, - "with_pocs": 83929 + "total_cves": 173237, + "with_pocs": 83932 } diff --git a/index/github.txt b/index/github.txt index e44a192fa51..a18368082d4 100644 --- a/index/github.txt +++ b/index/github.txt @@ -27104,3 +27104,6 @@ CVE-2026-14378 - https://github.com/murrez/CVE-2026-14378 CVE-2026-19660 - https://github.com/murrez/CVE-2026-19660 CVE-2017-9841 - https://github.com/CheLover86/CVE-2017-9841 CVE-2026-64560 - https://github.com/Meniben/redmi14c-pond-cve-2026-64560 +CVE-2026-100520 - https://github.com/wvllxe/CVE-2026-100520-laranode-path-traversal +CVE-2026-104051 - https://github.com/wvllxe/CVE-2026-104051-pictshare-info-disclosure +CVE-2026-104356 - https://github.com/wvllxe/CVE-2026-104356-pictshare-weak-delete-code