diff --git a/README.md b/README.md index 0587b834bf4..c7f8aa1fba5 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-10%20Sep%202026%2000%3A06%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609100006)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C701-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609100006)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-10%20Sep%202026%2001%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609100107)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C701-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609100107)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,23 +12,22 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 6m ago | [CVE-2025-27636-RCE-in-Apache-Camel](https://github.com/AC8999/CVE-2025-27636-RCE-in-Apache-Camel) | CVE-2025-27636 PoC written in Python | +| 0⭐ | 1h ago | [CVE-2025-27636-RCE-in-Apache-Camel](https://github.com/AC8999/CVE-2025-27636-RCE-in-Apache-Camel) | CVE-2025-27636 PoC written in Python | | 0⭐ | 1d ago | [CVE-2026-73312](https://github.com/BomboBombone/CVE-2026-73312) | Sanitized XenForo write-up and proof of concept for CVE-2026-73312. | | 0⭐ | 1d ago | KEV [CVE-2025-55182](https://github.com/r3vpwnx/CVE-2025-55182) | CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight… | | 2⭐ | 1d ago | KEV [CVE-2026-39987](https://github.com/Th3Purge/CVE-2026-39987) | Marimo Pre Authentication RCE | | 2⭐ | 1d ago | [CVE-2026-69451-PoC](https://github.com/fj016/CVE-2026-69451-PoC) | PoC for the CVE-2026-69451 - Fastprox EoP | | 0⭐ | 3d ago | KEV [CVE-2025-57819](https://github.com/r3vpwnx/CVE-2025-57819) | CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC) | -| 0⭐ | 3d ago | [CVE-2025-24799](https://github.com/galisko/CVE-2025-24799) | GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection… | +| 0⭐ | 4d ago | [CVE-2025-24799](https://github.com/galisko/CVE-2025-24799) | GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection… | | 0⭐ | 4d ago | KEV [POC-CVE-2025-68613](https://github.com/rmhowe425/POC-CVE-2025-68613) | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4,… | | 0⭐ | 4d ago | [CVE-2025-4255---Buffer-Overflow](https://github.com/Tenor-Z/CVE-2025-4255---Buffer-Overflow) | Exploit Framework for CVE-2025-4255 | -| 2⭐ | 4d ago | [CVE-2026-58138](https://github.com/0xBlackash/CVE-2026-58138) | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that… | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 11⭐ | 22h ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | -| 5⭐ | 22h ago | [CVE-2026-19089-WooCommerce-Tyche](https://github.com/abraxas/CVE-2026-19089-WooCommerce-Tyche) | CVE-2026-19089 WooCommerce Tych Remote Command Execution | +| 12⭐ | 23h ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass | +| 5⭐ | 23h ago | [CVE-2026-19089-WooCommerce-Tyche](https://github.com/abraxas/CVE-2026-19089-WooCommerce-Tyche) | CVE-2026-19089 WooCommerce Tych Remote Command Execution | | 824⭐ | 2d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 532⭐ | 2d ago | KEV [cve-2026-41940-PoC](https://github.com/lanicer/cve-2026-41940-PoC) | A cPanel and WHM authentication bypassing tool | | 26⭐ | 2d ago | [CVE-2026-28576-poc](https://github.com/mobilehackinglab/CVE-2026-28576-poc) | SQL injection vulnerability in Android 17 (AOSP) | @@ -68,7 +67,16 @@ | 14⭐ | 89d ago | [vulnerable-nextjs-14-CVE-2025-29927](https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927) | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior… |
-2023, 2022 +2024, 2023, 2022 + +## Trending in 2024 + +| Stars | Updated | Repository | Description | +| --- | --- | --- | --- | +| 17⭐ | 24d ago | [CVE-2024-56426](https://github.com/Creeeeger/CVE-2024-56426) | A PoC of the CVE-2024-56426 vulnerability. | +| 4⭐ | 25d ago | [CVE-2024-56426](https://github.com/xcracker000/CVE-2024-56426) | CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F | +| 3⭐ | 42d ago | [CVE-2024-36104-PoC](https://github.com/Groppoxx/CVE-2024-36104-PoC) | PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path… | +| 3⭐ | 80d ago | [CVE-2024-36991](https://github.com/0xFZin/CVE-2024-36991) | Exploit for CVE-2024-36991 , written by me, enumerates a handfull of things, not all, cause not needed. | ## Trending in 2023 diff --git a/index/trending.json b/index/trending.json index a3b63f7002f..004540dd4b0 100644 --- a/index/trending.json +++ b/index/trending.json @@ -1,7 +1,7 @@ [ { "year": 2026, - "stars": 11, + "stars": 12, "name": "CVE-2026-83991-writeup-and-poc", "url": "https://github.com/karollooool/CVE-2026-83991-writeup-and-poc", "desc": "CVE-2026-83991: Windows Cloud Files access-check bypass", @@ -373,6 +373,50 @@ "cve": "CVE-2025-29927", "kev": false }, + { + "year": 2024, + "stars": 17, + "name": "CVE-2024-56426", + "url": "https://github.com/Creeeeger/CVE-2024-56426", + "desc": "A PoC of the CVE-2024-56426 vulnerability.", + "pushed": "2026-08-16T15:12:56Z", + "created": "2026-04-07T12:02:52Z", + "cve": "CVE-2024-56426", + "kev": false + }, + { + "year": 2024, + "stars": 4, + "name": "CVE-2024-56426", + "url": "https://github.com/xcracker000/CVE-2024-56426", + "desc": "CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F", + "pushed": "2026-08-15T06:21:41Z", + "created": "2026-08-15T06:12:04Z", + "cve": "CVE-2024-56426", + "kev": false + }, + { + "year": 2024, + "stars": 3, + "name": "CVE-2024-36104-PoC", + "url": "https://github.com/Groppoxx/CVE-2024-36104-PoC", + "desc": "PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path traversal to ProgramExport", + "pushed": "2026-07-29T21:15:12Z", + "created": "2026-07-29T19:59:36Z", + "cve": "CVE-2024-36104", + "kev": false + }, + { + "year": 2024, + "stars": 3, + "name": "CVE-2024-36991", + "url": "https://github.com/0xFZin/CVE-2024-36991", + "desc": "Exploit for CVE-2024-36991 , written by me, enumerates a handfull of things, not all, cause not needed.", + "pushed": "2026-06-21T09:24:33Z", + "created": "2025-07-06T03:50:13Z", + "cve": "CVE-2024-36991", + "kev": false + }, { "year": 2023, "stars": 3, @@ -546,17 +590,5 @@ "cve": "CVE-2025-4255", "kev": false, "landed": true - }, - { - "year": 2026, - "stars": 2, - "name": "CVE-2026-58138", - "url": "https://github.com/0xBlackash/CVE-2026-58138", - "desc": "Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.", - "pushed": "2026-09-05T17:49:45Z", - "created": "2026-09-05T17:16:07Z", - "cve": "CVE-2026-58138", - "kev": false, - "landed": true } ]