diff --git a/README.md b/README.md index 2ad0bd6efa0..ca48c3e7851 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-22%20Sep%202026%2023%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609222307)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C214-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C202-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609222307)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-23%20Sep%202026%2000%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609230007)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C215-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C202-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609230007)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,8 +12,8 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 2h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | -| 2⭐ | 9h ago | [ghostlock-cve-2026-43499](https://github.com/gitchw/ghostlock-cve-2026-43499) | CVE-2026-43499 (GhostLock) - Linux kernel futex PI rt_mutex UAF ARM32 privilege escalation research targeting… | +| 0⭐ | 3h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | +| 2⭐ | 10h ago | [ghostlock-cve-2026-43499](https://github.com/gitchw/ghostlock-cve-2026-43499) | CVE-2026-43499 (GhostLock) - Linux kernel futex PI rt_mutex UAF ARM32 privilege escalation research targeting… | | 1⭐ | 1d ago | [CVE-2025-6325_CVE-2025-6327](https://github.com/JohenLastGen-JLG/CVE-2025-6325_CVE-2025-6327) | CVE-2025-6325 + CVE-2025-6327 - King Addons for Elementor <= 51.1.36 DUAL EXPLOIT PoC (Unauthenticated… | | 2⭐ | 1d ago | [CVE-2026-90817](https://github.com/murrez/CVE-2026-90817) | Unauth REDCap RCE (CVE-2026-90817) mass check PoC - requires public survey hash for full validation. | | 2⭐ | 3d ago | [CVE-2026-89274](https://github.com/murrez/CVE-2026-89274) | PoC for CVE-2026-89274: unauthenticated arbitrary shortcode execution in WP Recipe Maker ≤10.8.1 via recipe… | @@ -27,10 +27,10 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 7⭐ | 1h ago | [CVE-2026-87902](https://github.com/abraxas/CVE-2026-87902) | CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion… | -| 4⭐ | 3h ago | [cve-2026-87902-poc](https://github.com/ressl/cve-2026-87902-poc) | PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP… | -| 825⭐ | 6h ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | -| 5⭐ | 8h ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within… | +| 10⭐ | 2h ago | [CVE-2026-87902](https://github.com/abraxas/CVE-2026-87902) | CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion… | +| 5⭐ | 4h ago | [cve-2026-87902-poc](https://github.com/ressl/cve-2026-87902-poc) | PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP… | +| 825⭐ | 7h ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | +| 5⭐ | 9h ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within… | | 19⭐ | 1d ago | [CVE-2026-43786](https://github.com/Malwation/CVE-2026-43786) | Proof of concept for CVE-2026-43786, a local privilege escalation vulnerability in macOS CoreServices that… | | 4⭐ | 1d ago | [CVE-2026-94129](https://github.com/lzty/CVE-2026-94129) | A POC for CVE-2026-94129 | | 4⭐ | 1d ago | [CVE-2026-94128](https://github.com/lzty/CVE-2026-94128) | POC for CVE-2026-94128 | @@ -53,11 +53,11 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | | 7⭐ | 5d ago | KEV [CVE-2025-32432-exploit-by-P34NUT](https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT) | Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail | -| 3⭐ | 25d ago | KEV [CVE-2025-3248-Langflow-RCE](https://github.com/hideki233/CVE-2025-3248-Langflow-RCE) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | +| 3⭐ | 26d ago | KEV [CVE-2025-3248-Langflow-RCE](https://github.com/hideki233/CVE-2025-3248-Langflow-RCE) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | | 7⭐ | 26d ago | KEV [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… | | 5⭐ | 33d ago | KEV [cve-2025-21479_iqooneo8](https://github.com/Qingizi7/cve-2025-21479_iqooneo8) | Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables… | | 3⭐ | 35d ago | KEV [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案 | -| 21⭐ | 42d ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W | +| 21⭐ | 43d ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W | | 6⭐ | 47d ago | [CVE-2025-8045](https://github.com/kuzeyardabulut/CVE-2025-8045) | Dirty Pagetable Exploit for CVE-2025-8045 | | 7⭐ | 51d ago | KEV [SELinux-Permissive-Only-CVE-2025-21479](https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479) | This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… | | 4⭐ | 63d ago | KEV [CVE-2025-32432](https://github.com/c0gnit00/CVE-2025-32432) | Exploit, POC for CVE-2025-32432, CraftCMS2Shell | @@ -67,8 +67,7 @@ | 7⭐ | 76d ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… | | 4⭐ | 82d ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… | | 3⭐ | 82d ago | KEV [CVE-2025-57819](https://github.com/K3ysTr0K3R/CVE-2025-57819) | CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) | -| 4⭐ | 86d ago | [CVE-2025-69212-PoC](https://github.com/tohib09/CVE-2025-69212-PoC) | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and… | -| 5⭐ | 89d ago | KEV [CVE-2025-8110](https://github.com/joaquinrrr/CVE-2025-8110) | PoC exploit for CVE-2025-8110 | +| 4⭐ | 87d ago | [CVE-2025-69212-PoC](https://github.com/tohib09/CVE-2025-69212-PoC) | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and… |
2024, 2023 diff --git a/cves/2026/CVE-2026-5118.md b/cves/2026/CVE-2026-5118.md index 778c670de58..383cf3b8de2 100644 --- a/cves/2026/CVE-2026-5118.md +++ b/cves/2026/CVE-2026-5118.md @@ -19,3 +19,4 @@ No PoCs from references. - https://github.com/1beelze/CVE-2026-5118 - https://github.com/Jenderal92/CVE-2026-5118 - https://github.com/Yucaerin/CVE-2026-5118 +- https://github.com/SangSenimanWartefak/CVE-2026-5118 diff --git a/cves/2026/CVE-2026-88877.md b/cves/2026/CVE-2026-88877.md new file mode 100644 index 00000000000..05ed2360ad4 --- /dev/null +++ b/cves/2026/CVE-2026-88877.md @@ -0,0 +1,18 @@ +### [CVE-2026-88877](https://www.cve.org/CVERecord?id=CVE-2026-88877) +**Traefik v3.7.0 Authentication Bypass via from-to-www-redirect** +![](https://img.shields.io/static/v1?label=Vendor&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.7.0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/pwnVader/CVE-2026-88877-PoC-pwnVader diff --git a/docs/hero.svg b/docs/hero.svg index 7cefb32cb1e..400e250c9a4 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 83,215 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 172,512 + fill="#e6edf3" letter-spacing="-0.5">172,513 CVES INDEXED83,214 + fill="#2f81f7" letter-spacing="-0.5">83,215 WITH POCS1,202 diff --git a/docs/social-card.svg b/docs/social-card.svg index f47afd70891..8f41fba9ff4 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 172,512 + fill="#e6edf3" letter-spacing="-0.5">172,513 CVES INDEXED83,214 + fill="#2f81f7" letter-spacing="-0.5">83,215 WITH POCS1,202 diff --git a/docs/stats.json b/docs/stats.json index 543e5963eec..255ee99bd5d 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1202, - "total_cves": 172512, - "with_pocs": 83214 + "total_cves": 172513, + "with_pocs": 83215 } diff --git a/index/github.txt b/index/github.txt index 34a0445dd71..e9ba5ab6a4a 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26805,3 +26805,5 @@ CVE-2026-87902 - https://github.com/vulpecuna/CVE-2026-87902 CVE-2026-17089 - https://github.com/pwnVader/CVE-2026-17089-PoC-pwnVader CVE-2026-87902 - https://github.com/pwnVader/CVE-2026-87902-PoC-pwnVader CVE-2026-87915 - https://github.com/pwnVader/CVE-2026-87915-PoC-pwnVader +CVE-2026-5118 - https://github.com/SangSenimanWartefak/CVE-2026-5118 +CVE-2026-88877 - https://github.com/pwnVader/CVE-2026-88877-PoC-pwnVader diff --git a/index/trending.json b/index/trending.json index 1da91214611..1218558ac60 100644 --- a/index/trending.json +++ b/index/trending.json @@ -1,7 +1,7 @@ [ { "year": 2026, - "stars": 7, + "stars": 10, "name": "CVE-2026-87902", "url": "https://github.com/abraxas/CVE-2026-87902", "desc": "CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)", @@ -12,7 +12,7 @@ }, { "year": 2026, - "stars": 4, + "stars": 5, "name": "cve-2026-87902-poc", "url": "https://github.com/ressl/cve-2026-87902-poc", "desc": "PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab", @@ -395,17 +395,6 @@ "cve": "CVE-2025-69212", "kev": false }, - { - "year": 2025, - "stars": 5, - "name": "CVE-2025-8110", - "url": "https://github.com/joaquinrrr/CVE-2025-8110", - "desc": "PoC exploit for CVE-2025-8110", - "pushed": "2026-06-25T16:53:11Z", - "created": "2026-06-25T16:48:18Z", - "cve": "CVE-2025-8110", - "kev": true - }, { "year": 2024, "stars": 17,