Update CVE PoCs 2026-09-18

.github/cve_sync_state.json

@@ -1,3 +1,3 @@
 {
-  "cvelist_fetch_time": "2026-09-17T07:29:47.686Z"
+  "cvelist_fetch_time": "2026-09-18T07:24:50.580Z"
 }

README.md

@@ -1,8 +1,8 @@
 <div align="center">
 
-<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=172192-82972-1199" alt="PoC Index" width="100%"></a>
+<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=172245-83025-1199" alt="PoC Index" width="100%"></a>
 
-[![last sync](https://img.shields.io/badge/last%20sync-18%20Sep%202026%2007%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609180707)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C972-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C199-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609180707)](https://github.com/0xMarcio/pocindex/stargazers)
+[![last sync](https://img.shields.io/badge/last%20sync-18%20Sep%202026%2007%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609180707)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C025-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C199-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609180707)](https://github.com/0xMarcio/pocindex/stargazers)
 
 <a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>
 

cves/2002/CVE-2002-1120.md

@@ -14,6 +14,7 @@ Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to
 
 #### Github
 - https://github.com/TheMalwareGuardian/CVE-2002-1120
+- https://github.com/bluedragonsecurity/savant_version_3.1_remote_post_buffer_overflow
 
 #### ExploitDB
 - https://www.exploit-db.com/exploits/16770

cves/2005/CVE-2005-0338.md

@@ -13,7 +13,7 @@ Buffer overflow in Savant Web Server 3.1 allows remote attackers to execute arbi
 - http://marc.info/?l=bugtraq&m=110756234611259&w=2
 
 #### Github
-No PoCs found on GitHub currently.
+- https://github.com/bluedragonsecurity/savant_version_3.1_remote_post_buffer_overflow
 
 #### ExploitDB
 - https://www.exploit-db.com/exploits/819

cves/2012/CVE-2012-0273.md

@@ -0,0 +1,16 @@
+### [CVE-2012-0273](https://www.cve.org/CVERecord?id=CVE-2012-0273)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Multiple stack-based buffer overflows in MinaliC 2.0.0 allow remote attackers to execute arbitrary code via a (1) session_id cookie in a request to the get_cookie_value function in response.c, (2) directory name in a request to the add_default_file function in response.c, or (3) file name in a request to the retrieve_physical_file_name_or_brows function in response.c.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/bluedragonsecurity/minalic_2.0_remote_post_buffer_overflow

cves/2017/CVE-2017-16114.md

@@ -15,4 +15,5 @@ The marked module is vulnerable to a regular expression denial of service. Based
 
 #### Github
 - https://github.com/ossf-cve-benchmark/CVE-2017-16114
+- https://github.com/appsec-poc-22/scagoat
 

cves/2018/CVE-2018-1000861.md

@@ -17,6 +17,7 @@ A code execution vulnerability exists in the Stapler web framework used by Jenki
 - https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc
 - https://github.com/orangetw/awesome-jenkins-rce-2019
 - https://github.com/smokeintheshell/CVE-2018-1000861
+- https://github.com/williams-surjanto/infrastructure_security
 
 #### Nuclei
 - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000861.yaml

cves/2018/CVE-2018-13379.md

@@ -28,6 +28,7 @@ An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"
 - https://github.com/yukar1z0e/CVE-2018-13379
 - https://github.com/Instructor-Admin/Multi-threaded-mass-exploiter-CVE-2018-13379-POC
 - https://github.com/Zierax/CVE-2018-13379
+- https://github.com/1337or420/FortiGate-FortiWeb-Multi-Exploit-Extractor
 
 #### Nuclei
 - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13379.yaml

cves/2018/CVE-2018-7600.md

@@ -81,8 +81,6 @@ Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1
 - https://github.com/erman-bolukbasi/web-penetration-drupal
 - https://github.com/nayem-m/drupalgeddon2-cli
 - https://github.com/capivara-research/CVE-Exploitation
-- https://github.com/a2u/CVE-2018-7600
-- https://github.com/g0rx/CVE-2018-7600-Drupal-RCE
 
 #### Nuclei
 - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7600.yaml

cves/2021/CVE-2021-43798.md

@@ -82,6 +82,8 @@ Grafana is an open-source platform for monitoring and observability. Grafana ver
 - https://github.com/baktistr/cve-2021-43798-enum
 - https://github.com/davidrxchester/Grafana-8.3-Directory-Traversal
 - https://github.com/kikechans/-Grafana-LFI-CVE-2021-43798
+- https://github.com/Squ1shification/Grafana-Plugin-Enumerator-CVE-2021-43798
+- https://github.com/williams-surjanto/infrastructure_security
 
 #### Nuclei
 - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43798.yaml

cves/2021/CVE-2021-44228.md

@@ -461,6 +461,8 @@ Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12
 - https://github.com/ptn1411/skill
 - https://github.com/DuyPhuc-hust/SecWeave
 - https://github.com/hed1ad/CVE-Omarchy-Plugin
+- https://github.com/hungln105-cell/skill-bug-app
+- https://github.com/appsec-poc-22/scagoat
 
 #### Nuclei
 - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44228.yaml

cves/2023/CVE-2023-42282.md

@@ -16,4 +16,5 @@ The ip package before 1.1.9 for Node.js might allow SSRF because some IP address
 #### Github
 - https://github.com/ds-ac-poc/pt-esign__Damn-vulnerable-sca
 - https://github.com/pantor-org/prisma-cloud-kubernetes-exploitation-demo
+- https://github.com/appsec-poc-22/scagoat
 

cves/2023/CVE-2023-4622.md

@@ -3,6 +3,12 @@
 ![](https://img.shields.io/static/v1?label=Vendor&message=Linux&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue)
 ![](https://img.shields.io/static/v1?label=Version&message=4.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=4.15&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=4.20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=5.5&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=5.11&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=5.16&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=6.2&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%20Use%20After%20Free&color=brightgreen)
 
 ### Description

cves/2024/CVE-2024-5042.md

@@ -2,7 +2,7 @@
 **Submariner-operator: rbac permissions can allow for the spread of node compromises**
 ![](https://img.shields.io/static/v1?label=Vendor&message=Red%20Hat&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=RHODF-4.16-RHEL-9&color=blue)
-![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Openshift%20Data%20Foundation%204.2&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Openshift%20Data%20Foundation%204.20&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Advanced%20Cluster%20Management%20for%20Kubernetes%202&color=blue)
 ![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Version&message=0.15.0&color=brightgreen)

cves/2024/CVE-2024-58306.md

@@ -15,4 +15,4 @@ minaliC 2.0.0 contains a denial of service vulnerability that allows remote atta
 - https://www.exploit-db.com/exploits/51917
 
 #### Github
-No PoCs found on GitHub currently.
+- https://github.com/bluedragonsecurity/minalic_2.0_remote_post_buffer_overflow

cves/2024/CVE-2024-6387.md

@@ -114,7 +114,7 @@ A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd).
 - https://github.com/jasonnorman66994-dot/sovereign-command-center
 - https://github.com/ptn1411/skill
 - https://github.com/Panche1/SSHPentest
-- https://github.com/zgzhang/cve-2024-6387-poc
+- https://github.com/hungln105-cell/skill-bug-app
 
 #### ExploitDB
 - https://www.exploit-db.com/exploits/52269

cves/2024/CVE-2024-8775.md

@@ -8,6 +8,8 @@
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Ansible%20Automation%20Platform%202.5%20for%20RHEL%208&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Ansible%20Automation%20Platform%202.5%20for%20RHEL%209&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%20AI%20%28RHEL%20AI%29&color=blue)
 ![](https://img.shields.io/static/v1?label=Version&message=1.0.0&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=Insertion%20of%20Sensitive%20Information%20into%20Log%20File&color=brightgreen)

cves/2025/CVE-2025-23367.md

@@ -2,6 +2,7 @@
 **Org.wildfly.core:wildfly-server: wildfly improper rbac permission**
 ![](https://img.shields.io/static/v1?label=Vendor&message=Red%20Hat&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4.22&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20for%20RHEL%208&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20for%20RHEL%209&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20on%20RHEL%207&color=blue)

cves/2025/CVE-2025-5222.md

@@ -6,6 +6,7 @@
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.0%20Update%20Services%20for%20SAP%20Solutions&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.2%20Update%20Services%20for%20SAP%20Solutions&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.4%20Extended%20Update%20Support&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.13&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.14&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.15&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.16&color=blue)

cves/2026/CVE-2026-13585.md

@@ -3,7 +3,9 @@
 ![](https://img.shields.io/static/v1?label=Product&message=System%20Control%20Interface%20v3&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=System%20Control%20Interface&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Business%20Manager&color=blue)
-![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=before%20v3.1.66.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=before%20v1.1.40.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=through%20v3.0.38.0&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-226%3A%20Sensitive%20Information%20in%20Resource%20Not%20Removed%20Before%20Reuse&color=brightgreen)
 

cves/2026/CVE-2026-1880.md

@@ -1,7 +1,7 @@
 ### [CVE-2026-1880](https://www.cve.org/CVERecord?id=CVE-2026-1880)
 ![](https://img.shields.io/static/v1?label=Vendor&message=ASUS&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=DriverHub&color=blue)
-![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=before%201.0.6.12&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-367%20Time-of-check%20Time-of-use%20%28TOCTOU%29%20Race%20Condition&color=brightgreen)
 
 ### Description

cves/2026/CVE-2026-4408.md

@@ -16,6 +16,7 @@
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.4%20Update%20Services%20for%20SAP%20Solutions&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.6%20Extended%20Update%20Support&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.12&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.13&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.14&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.15&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.16&color=blue)

cves/2026/CVE-2026-79713.md

@@ -0,0 +1,17 @@
+### [CVE-2026-79713](https://www.cve.org/CVERecord?id=CVE-2026-79713)
+**Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters**
+![](https://img.shields.io/static/v1?label=Product&message=Breeze%20Cache&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.2.5&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-444%20Inconsistent%20Interpretation%20of%20HTTP%20Requests%20%28%27HTTP%20Request%20Smuggling%27%29&color=brightgreen)
+
+### Description
+
+The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/7d62297b-40e3-445f-b970-9a34dcabd7c7/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-81340.md

@@ -0,0 +1,17 @@
+### [CVE-2026-81340](https://www.cve.org/CVERecord?id=CVE-2026-81340)
+**MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR**
+![](https://img.shields.io/static/v1?label=Product&message=MasterStudy%20LMS%20WordPress%20Plugin&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-81810.md

@@ -0,0 +1,17 @@
+### [CVE-2026-81810](https://www.cve.org/CVERecord?id=CVE-2026-81810)
+**All-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure**
+![](https://img.shields.io/static/v1?label=Product&message=All-in-One%20WP%20Migration%20and%20Backup&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-269%20Improper%20Privilege%20Management&color=brightgreen)
+
+### Description
+
+The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/2036592e-09eb-4231-b450-85d8fbc0ba3f/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-84738.md

@@ -0,0 +1,17 @@
+### [CVE-2026-84738](https://www.cve.org/CVERecord?id=CVE-2026-84738)
+**AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE**
+![](https://img.shields.io/static/v1?label=Product&message=AF%20Companion&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%20Improper%20Control%20of%20Generation%20of%20Code%20%28%27Code%20Injection%27%29&color=brightgreen)
+
+### Description
+
+The AF Companion  WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/1d6c7f60-570e-4729-a2d5-463e0b62942e/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-84902.md

@@ -0,0 +1,17 @@
+### [CVE-2026-84902](https://www.cve.org/CVERecord?id=CVE-2026-84902)
+**King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import**
+![](https://img.shields.io/static/v1?label=Product&message=King%20Addons%20for%20Elementor&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20%28XSS%29&color=brightgreen)
+
+### Description
+
+The King Addons for Elementor  WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/4afc5f30-8b30-4e77-9bd7-91c25065bb54/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-84903.md

@@ -0,0 +1,17 @@
+### [CVE-2026-84903](https://www.cve.org/CVERecord?id=CVE-2026-84903)
+**King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode**
+![](https://img.shields.io/static/v1?label=Product&message=King%20Addons%20for%20Elementor&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen)
+
+### Description
+
+The King Addons for Elementor  WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/57853db6-c9e0-4b0a-8a57-8287f0e85eea/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-84904.md

@@ -0,0 +1,17 @@
+### [CVE-2026-84904](https://www.cve.org/CVERecord?id=CVE-2026-84904)
+**King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer**
+![](https://img.shields.io/static/v1?label=Product&message=King%20Addons%20for%20Elementor&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=51.1.56&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+The King Addons for Elementor  WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/08ea6c9d-0bfd-4ad1-91d6-93d592867731/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-85009.md

@@ -0,0 +1,17 @@
+### [CVE-2026-85009](https://www.cve.org/CVERecord?id=CVE-2026-85009)
+**RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery**
+![](https://img.shields.io/static/v1?label=Product&message=RestroPress&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+The RestroPress  WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/9731b0f3-76c2-4e0a-9630-9160299a37ee/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-85122.md

@@ -0,0 +1,17 @@
+### [CVE-2026-85122](https://www.cve.org/CVERecord?id=CVE-2026-85122)
+**Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion**
+![](https://img.shields.io/static/v1?label=Product&message=Easy%20Form%20Builder%20by%20WhiteStudio&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=4.0.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20%28XSS%29&color=brightgreen)
+
+### Description
+
+The Easy Form Builder by WhiteStudio  WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/7263f875-3ff3-410a-94b0-fa4b3694d356/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-85123.md

@@ -0,0 +1,17 @@
+### [CVE-2026-85123](https://www.cve.org/CVERecord?id=CVE-2026-85123)
+**Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion**
+![](https://img.shields.io/static/v1?label=Product&message=Easy%20Form%20Builder%20by%20WhiteStudio&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=4.0.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen)
+
+### Description
+
+The Easy Form Builder by WhiteStudio  WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/a4968578-aac9-4500-bfb1-f5db95a61921/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-85127.md

@@ -0,0 +1,17 @@
+### [CVE-2026-85127](https://www.cve.org/CVERecord?id=CVE-2026-85127)
+**VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment**
+![](https://img.shields.io/static/v1?label=Product&message=VikBooking%20Hotel%20Booking%20Engine%20%26%20PMS&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.8.8&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20%28XSS%29&color=brightgreen)
+
+### Description
+
+The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/4bca17fb-e9b4-4dc7-994f-08ce4aafadc7/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-85350.md

@@ -0,0 +1,17 @@
+### [CVE-2026-85350](https://www.cve.org/CVERecord?id=CVE-2026-85350)
+**UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together**
+![](https://img.shields.io/static/v1?label=Product&message=UpsellWP&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.4.4&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen)
+
+### Description
+
+The UpsellWP  WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/5068ff54-8632-42bd-b50a-4ecb6ac5853f/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-86796.md

@@ -0,0 +1,17 @@
+### [CVE-2026-86796](https://www.cve.org/CVERecord?id=CVE-2026-86796)
+**WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters**
+![](https://img.shields.io/static/v1?label=Product&message=Hide%20My%20WP%20Ghost&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=7.0.10&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-693%20Protection%20Mechanism%20Failure&color=brightgreen)
+
+### Description
+
+The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/38baa866-c8a3-4c92-b7c8-8485e7c2a9b0/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-86800.md

@@ -0,0 +1,17 @@
+### [CVE-2026-86800](https://www.cve.org/CVERecord?id=CVE-2026-86800)
+**WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check**
+![](https://img.shields.io/static/v1?label=Product&message=Hide%20My%20WP%20Ghost&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-693%20Protection%20Mechanism%20Failure&color=brightgreen)
+
+### Description
+
+The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/01772455-89fe-4bcd-b3b7-c29b8646679d/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-87767.md

@@ -0,0 +1,17 @@
+### [CVE-2026-87767](https://www.cve.org/CVERecord?id=CVE-2026-87767)
+**WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url**
+![](https://img.shields.io/static/v1?label=Product&message=wp%20shortcut%20link%20and%20advertisement%20baner&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)
+
+### Description
+
+The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/1d103d80-1904-4aae-87b1-06a429ca85c9/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-87770.md

@@ -0,0 +1,17 @@
+### [CVE-2026-87770](https://www.cve.org/CVERecord?id=CVE-2026-87770)
+**Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product**
+![](https://img.shields.io/static/v1?label=Product&message=Price%20Drop%20Alert%20for%20Woo%20Commerce&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)
+
+### Description
+
+The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/23bd3a5f-f627-4cd4-a25b-3bc79da79c2a/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-87771.md

@@ -0,0 +1,17 @@
+### [CVE-2026-87771](https://www.cve.org/CVERecord?id=CVE-2026-87771)
+**Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read**
+![](https://img.shields.io/static/v1?label=Product&message=Product%20Question%20and%20Answer&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)
+
+### Description
+
+The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/d71642f0-431c-42fc-bf3f-2b7b3c4e3954/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-87774.md

@@ -0,0 +1,17 @@
+### [CVE-2026-87774](https://www.cve.org/CVERecord?id=CVE-2026-87774)
+**Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week**
+![](https://img.shields.io/static/v1?label=Product&message=Tz%20Weekly%20Radio%20Schedule&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)
+
+### Description
+
+The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/802f208f-a3dd-4dc7-b1d2-ec455f0350f7/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-87775.md

@@ -0,0 +1,17 @@
+### [CVE-2026-87775](https://www.cve.org/CVERecord?id=CVE-2026-87775)
+**Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell**
+![](https://img.shields.io/static/v1?label=Product&message=Tz%20Weekly%20Radio%20Schedule&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)
+
+### Description
+
+The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/5a2ed5cd-1a05-4b54-b604-f596d8a8b76b/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-87829.md

@@ -0,0 +1,17 @@
+### [CVE-2026-87829](https://www.cve.org/CVERecord?id=CVE-2026-87829)
+**Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting**
+![](https://img.shields.io/static/v1?label=Product&message=Checkout%20Field%20Manager%20%28Checkout%20Manager%29%20for%20WooCommerce&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=7.8.6&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/8c76bf99-5d3e-4573-a909-040a7ab36d68/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-87831.md

@@ -0,0 +1,17 @@
+### [CVE-2026-87831](https://www.cve.org/CVERecord?id=CVE-2026-87831)
+**Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field**
+![](https://img.shields.io/static/v1?label=Product&message=Checkout%20Field%20Manager%20%28Checkout%20Manager%29%20for%20WooCommerce&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=7.4.9&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/7a871164-ce44-4e4c-8e15-15daa84767c6/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-87965.md

@@ -0,0 +1,17 @@
+### [CVE-2026-87965](https://www.cve.org/CVERecord?id=CVE-2026-87965)
+**Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token**
+![](https://img.shields.io/static/v1?label=Product&message=Easy%20Appointments&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen)
+
+### Description
+
+The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/b498fba8-8969-45af-8cef-e91d6be34912/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-87966.md

@@ -0,0 +1,17 @@
+### [CVE-2026-87966](https://www.cve.org/CVERecord?id=CVE-2026-87966)
+**Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR**
+![](https://img.shields.io/static/v1?label=Product&message=Easy%20Appointments&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=4.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/e2e625f4-c146-4622-b439-3179c4484613/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-88798.md

@@ -0,0 +1,17 @@
+### [CVE-2026-88798](https://www.cve.org/CVERecord?id=CVE-2026-88798)
+**Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header**
+![](https://img.shields.io/static/v1?label=Product&message=Really%20Simple%20Security&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=8.1.6&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+
+### Description
+
+The Really Simple Security  WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/e658dcd2-2ff6-4611-a28d-e2482c65be8b/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-88825.md

@@ -0,0 +1,17 @@
+### [CVE-2026-88825](https://www.cve.org/CVERecord?id=CVE-2026-88825)
+**iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings**
+![](https://img.shields.io/static/v1?label=Product&message=iGMS%20Direct%20Booking&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20%28XSS%29&color=brightgreen)
+
+### Description
+
+The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/12337af6-e465-4010-a54d-be92a5dfa5d6/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-88844.md

@@ -0,0 +1,17 @@
+### [CVE-2026-88844](https://www.cve.org/CVERecord?id=CVE-2026-88844)
+**MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR**
+![](https://img.shields.io/static/v1?label=Product&message=MasterStudy%20LMS%20WordPress%20Plugin&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=3.6.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/13b4f5c4-db4a-4bc2-b092-07747ee790e6/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-88993.md

@@ -0,0 +1,17 @@
+### [CVE-2026-88993](https://www.cve.org/CVERecord?id=CVE-2026-88993)
+**All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute**
+![](https://img.shields.io/static/v1?label=Product&message=All%20Bootstrap%20Blocks&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20%28XSS%29&color=brightgreen)
+
+### Description
+
+The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/fc1f2f62-62cd-4a70-b541-2278eb0edefe/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-88994.md

@@ -0,0 +1,17 @@
+### [CVE-2026-88994](https://www.cve.org/CVERecord?id=CVE-2026-88994)
+**All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes**
+![](https://img.shields.io/static/v1?label=Product&message=All%20Bootstrap%20Blocks&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.3.20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-98%20Improper%20Control%20of%20Filename%20for%20Include%2FRequire%20Statement%20in%20PHP%20Program%20%28%27PHP%20Remote%20File%20Inclusion%27%29&color=brightgreen)
+
+### Description
+
+The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PHP where a local file containing PHP code can be reached. Exploitation requires the plugin's Lightspeed subsystem to be enabled, which is not the default.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/55b1f0b1-dc15-45d4-beb2-4d1d7a9fe3dd/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-89007.md

@@ -0,0 +1,17 @@
+### [CVE-2026-89007](https://www.cve.org/CVERecord?id=CVE-2026-89007)
+**Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization**
+![](https://img.shields.io/static/v1?label=Product&message=Bookit%20%E2%80%94%20Booking%20%26%20Appointment%20Calendar&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/5e174229-a375-456c-b651-7ad4a3c004ab/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-89008.md

@@ -0,0 +1,17 @@
+### [CVE-2026-89008](https://www.cve.org/CVERecord?id=CVE-2026-89008)
+**Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure**
+![](https://img.shields.io/static/v1?label=Product&message=Bookit%20%E2%80%94%20Booking%20%26%20Appointment%20Calendar&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen)
+
+### Description
+
+The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/be5cf196-2f4b-4ad6-b477-287f80f1dd0d/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-89038.md

@@ -0,0 +1,18 @@
+### [CVE-2026-89038](https://www.cve.org/CVERecord?id=CVE-2026-89038)
+**Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity**
+![](https://img.shields.io/static/v1?label=Vendor&message=Verizon&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Verizon%20Cloud%20for%20Android&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20%28%27Path%20Traversal%27%29&color=brightgreen)
+
+### Description
+
+Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted _display_name value containing path-traversal sequences through exported activities OneTouchUploadActivity and PrintShopCloudActivity. Attackers can exploit the unsanitized filename concatenation in the file-staging sink via ACTION_SEND or ACTION_SEND_MULTIPLE intents to achieve arbitrary file write and inject attacker-controlled content into the authenticated user's Verizon Cloud account without user interaction.
+
+### POC
+
+#### Reference
+- https://github.com/actuator/com.vcast.mediamanager
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-90976.md

@@ -0,0 +1,17 @@
+### [CVE-2026-90976](https://www.cve.org/CVERecord?id=CVE-2026-90976)
+**Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled**
+![](https://img.shields.io/static/v1?label=Product&message=Clean%20Login&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen)
+
+### Description
+
+The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/e72f9529-6500-4ed2-a8cc-d77045b6be5c/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-90977.md

@@ -0,0 +1,17 @@
+### [CVE-2026-90977](https://www.cve.org/CVERecord?id=CVE-2026-90977)
+**Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison**
+![](https://img.shields.io/static/v1?label=Product&message=Clean%20Login&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-697%20Incorrect%20Comparison&color=brightgreen)
+
+### Description
+
+The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/368db83e-ed7b-4f67-99db-2e5f1c01568e/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-90978.md

@@ -0,0 +1,17 @@
+### [CVE-2026-90978](https://www.cve.org/CVERecord?id=CVE-2026-90978)
+**Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check**
+![](https://img.shields.io/static/v1?label=Product&message=Filter%20Gallery&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.1.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen)
+
+### Description
+
+The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin before 1.1.5's stored gallery options.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/39321ecd-98e5-4f4e-9a42-bedf5904c3d1/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-90984.md

@@ -0,0 +1,17 @@
+### [CVE-2026-90984](https://www.cve.org/CVERecord?id=CVE-2026-90984)
+**Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field**
+![](https://img.shields.io/static/v1?label=Product&message=Generate%20PDF%20using%20Contact%20Form%207&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/1aa459e4-bd75-49a5-a6de-812375d441e6/
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-92918.md

@@ -0,0 +1,18 @@
+### [CVE-2026-92918](https://www.cve.org/CVERecord?id=CVE-2026-92918)
+**admin3 through 3.0.0 Session Token Disclosure via Audit Log**
+![](https://img.shields.io/static/v1?label=Vendor&message=cjbi&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=admin3&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Insertion%20of%20Sensitive%20Information%20into%20Log%20File&color=brightgreen)
+
+### Description
+
+admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.
+
+### POC
+
+#### Reference
+- https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C02_log_session_token_disclosure.py
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-92919.md

@@ -0,0 +1,18 @@
+### [CVE-2026-92919](https://www.cve.org/CVERecord?id=CVE-2026-92919)
+**admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename**
+![](https://img.shields.io/static/v1?label=Vendor&message=cjbi&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=admin3&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20%28%27Path%20Traversal%27%29&color=brightgreen)
+
+### Description
+
+admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.
+
+### POC
+
+#### Reference
+- https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C03_storage_path_traversal_write.py
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-92920.md

@@ -0,0 +1,18 @@
+### [CVE-2026-92920](https://www.cve.org/CVERecord?id=CVE-2026-92920)
+**admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled**
+![](https://img.shields.io/static/v1?label=Vendor&message=cjbi&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=admin3&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficient%20Session%20Expiration&color=brightgreen)
+
+### Description
+
+admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.
+
+### POC
+
+#### Reference
+- https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C06_account_lockout_bypass.py
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-92921.md

@@ -0,0 +1,18 @@
+### [CVE-2026-92921](https://www.cve.org/CVERecord?id=CVE-2026-92921)
+**admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5**
+![](https://img.shields.io/static/v1?label=Vendor&message=cjbi&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=admin3&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Password%20Hash%20With%20Insufficient%20Computational%20Effort&color=brightgreen)
+
+### Description
+
+admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort.
+
+### POC
+
+#### Reference
+- https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C08_md5_credential_hashing.py
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-92926.md

@@ -0,0 +1,19 @@
+### [CVE-2026-92926](https://www.cve.org/CVERecord?id=CVE-2026-92926)
+**code-projects Matrimonial System partner_preference.php writepartnerprefs sql injection**
+![](https://img.shields.io/static/v1?label=Vendor&message=code-projects&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Matrimonial%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partner_preference.php. Such manipulation of the argument education leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
+
+### POC
+
+#### Reference
+- https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/partner_preference/sqli_education/Readme.md
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-92927.md

@@ -0,0 +1,19 @@
+### [CVE-2026-92927](https://www.cve.org/CVERecord?id=CVE-2026-92927)
+**SourceCodester Drug Recommendation System drug_recommendor.sql information disclosure**
+![](https://img.shields.io/static/v1?label=Vendor&message=SourceCodester&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Drug%20Recommendation%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen)
+
+### Description
+
+A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /db/drug_recommendor.sql. Performing a manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
+
+### POC
+
+#### Reference
+- https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/information_disclosure/Readme.md
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-92992.md

@@ -0,0 +1,24 @@
+### [CVE-2026-92992](https://www.cve.org/CVERecord?id=CVE-2026-92992)
+**Dromara mayfly-go AI Assistant ai.go authorization**
+![](https://img.shields.io/static/v1?label=Vendor&message=Dromara&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=mayfly-go&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.1&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.3&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.4&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.5&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen)
+
+### Description
+
+A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The identifier of the patch is 74bcb926eb4f5f94e7681144d7bf2168a0ec7cde. Applying a patch is the recommended action to fix this issue. The whitelist bypass is one-token wide. Any compound command containing curl, wget or sed auto-runs without approval; approval is granted by the same session user (self-approval). This issue got fixed with a silent patch.
+
+### POC
+
+#### Reference
+- https://gist.github.com/xufengnian/b95662ba0d8881cfc5ba0bb99cbfc086
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-92993.md

@@ -0,0 +1,24 @@
+### [CVE-2026-92993](https://www.cve.org/CVERecord?id=CVE-2026-92993)
+**Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection**
+![](https://img.shields.io/static/v1?label=Vendor&message=Dromara&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=mayfly-go&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.1&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.3&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.4&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.11.5&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=OS%20Command%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen)
+
+### Description
+
+A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machine_script.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Exploitation needs no admin account. Any account holding machine:script:run plus tag access reaches arbitrary command execution on machines whose templates contain {{.param}} placeholders; the SSH exec layer (Cli.Run) also applies no input filtering to any caller. The vendor was contacted early about this disclosure but did not respond in any way.
+
+### POC
+
+#### Reference
+- https://gist.github.com/xufengnian/b95662ba0d8881cfc5ba0bb99cbfc086
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-93307.md

@@ -0,0 +1,19 @@
+### [CVE-2026-93307](https://www.cve.org/CVERecord?id=CVE-2026-93307)
+**O-RAN-SC SMO OAM VES Collector memory allocation**
+![](https://img.shields.io/static/v1?label=Vendor&message=O-RAN-SC&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=SMO%20OAM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2025-06-10&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncontrolled%20Memory%20Allocation&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Resource%20Consumption&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://gist.github.com/fklement/1c1ff92588944a021ceb2b5e894973c5
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-93308.md

@@ -0,0 +1,19 @@
+### [CVE-2026-93308](https://www.cve.org/CVERecord?id=CVE-2026-93308)
+**O-RAN-SC SMO OAM VES Collector allocation of resources**
+![](https://img.shields.io/static/v1?label=Vendor&message=O-RAN-SC&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=SMO%20OAM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2025-06-10&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Resource%20Consumption&color=brightgreen)
+
+### Description
+
+A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through a bug report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://gist.github.com/fklement/9f217219b95f7ced94527a2d18b5f059
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-93309.md

@@ -0,0 +1,19 @@
+### [CVE-2026-93309](https://www.cve.org/CVERecord?id=CVE-2026-93309)
+**O-RAN-SC SMO OAM VES Collector allocation of resources**
+![](https://img.shields.io/static/v1?label=Vendor&message=O-RAN-SC&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=SMO%20OAM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2025-06-10&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Resource%20Consumption&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://gist.github.com/fklement/639eb04a12cc5c015f9b960b0de96d80
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-93310.md

@@ -0,0 +1,19 @@
+### [CVE-2026-93310](https://www.cve.org/CVERecord?id=CVE-2026-93310)
+**O-RAN-SC SMO OAM VES Collector allocation of resources**
+![](https://img.shields.io/static/v1?label=Vendor&message=O-RAN-SC&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=SMO%20OAM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2025-06-10&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Resource%20Consumption&color=brightgreen)
+
+### Description
+
+A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through a bug report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://gist.github.com/fklement/f70321f38513c2e82a87f062e519c587
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-93311.md

@@ -0,0 +1,19 @@
+### [CVE-2026-93311](https://www.cve.org/CVERecord?id=CVE-2026-93311)
+**Freedesktop Poppler SampledFunction Function.cc integer overflow**
+![](https://img.shields.io/static/v1?label=Vendor&message=Freedesktop&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Poppler&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=26.07.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Integer%20Overflow&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Numeric%20Error&color=brightgreen)
+
+### Description
+
+A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-93312.md

@@ -0,0 +1,19 @@
+### [CVE-2026-93312](https://www.cve.org/CVERecord?id=CVE-2026-93312)
+**Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference**
+![](https://img.shields.io/static/v1?label=Vendor&message=Freedesktop&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Poppler&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=26.07.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=NULL%20Pointer%20Dereference&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen)
+
+### Description
+
+A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.
+
+### POC
+
+#### Reference
+- https://github.com/r1ck9-2q/cve_summit/blob/main/Null-pointer-offset-undefined-behavior-in-JBIG2Stream-rewind-JBIG2Stream.cc-1229.md
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-93313.md

@@ -0,0 +1,19 @@
+### [CVE-2026-93313](https://www.cve.org/CVERecord?id=CVE-2026-93313)
+**Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow**
+![](https://img.shields.io/static/v1?label=Vendor&message=Freedesktop&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Poppler&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=26.07.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Integer%20Overflow&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Numeric%20Error&color=brightgreen)
+
+### Description
+
+A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.
+
+### POC
+
+#### Reference
+- https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-JBIG2Stream-readCodeTableSeg-JBIG2Stream.cc-4118.md
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-93314.md

@@ -0,0 +1,19 @@
+### [CVE-2026-93314](https://www.cve.org/CVERecord?id=CVE-2026-93314)
+**Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow**
+![](https://img.shields.io/static/v1?label=Vendor&message=Freedesktop&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Poppler&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=26.07.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Integer%20Overflow&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Numeric%20Error&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.
+
+### POC
+
+#### Reference
+- https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-mapCodeToGID-FoFiTrueType.cc-608.md
+
+#### Github
+No PoCs found on GitHub currently.

cves/2026/CVE-2026-93454.md

@@ -0,0 +1,18 @@
+### [CVE-2026-93454](https://www.cve.org/CVERecord?id=CVE-2026-93454)
+**Aureus ERP through 1.6.0 Stored XSS via Payment Term Note**
+![](https://img.shields.io/static/v1?label=Vendor&message=Webkul&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Aureus%20ERP&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20%28%27Cross-site%20Scripting%27%29&color=brightgreen)
+
+### Description
+
+Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.
+
+### POC
+
+#### Reference
+- https://hackmd.io/@leediay/stored-xss-aureus-via-payment-term
+
+#### Github
+No PoCs found on GitHub currently.

docs/hero.svg

@@ -1,5 +1,5 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="1200" height="180" viewBox="0 0 1200 180"
-     role="img" aria-label="PoC Index, 82,972 CVEs with public proof-of-concept exploits">
+     role="img" aria-label="PoC Index, 83,025 CVEs with public proof-of-concept exploits">
   <clipPath id="card"><rect x="1" y="1" width="1198" height="178" rx="12"/></clipPath>
   <rect x="0.5" y="0.5" width="1199" height="179" rx="12" fill="#0d1117" stroke="#30363d"/>
   <g clip-path="url(#card)" opacity="0.6"><g>
@@ -19,10 +19,10 @@
   <text x="56" y="132" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="15" fill="#2f81f7">pocindex.io</text>
 
   <text x="620" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
-        fill="#e6edf3" letter-spacing="-0.5">172,192</text>
+        fill="#e6edf3" letter-spacing="-0.5">172,245</text>
   <text x="620" y="117" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="12"
         fill="#6e7681" letter-spacing="1.6">CVES INDEXED</text><text x="840" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
-        fill="#2f81f7" letter-spacing="-0.5">82,972</text>
+        fill="#2f81f7" letter-spacing="-0.5">83,025</text>
   <text x="840" y="117" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="12"
         fill="#6e7681" letter-spacing="1.6">WITH POCS</text><text x="1010" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
         fill="#f85149" letter-spacing="-0.5">1,199</text>

docs/social-card.svg

@@ -20,10 +20,10 @@
 
   <rect x="96" y="344" width="1088" height="1" fill="#30363d"/>
   <text x="96" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
-        fill="#e6edf3" letter-spacing="-0.5">172,192</text>
+        fill="#e6edf3" letter-spacing="-0.5">172,245</text>
   <text x="96" y="459" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="16"
         fill="#6e7681" letter-spacing="1.6">CVES INDEXED</text><text x="500" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
-        fill="#2f81f7" letter-spacing="-0.5">82,972</text>
+        fill="#2f81f7" letter-spacing="-0.5">83,025</text>
   <text x="500" y="459" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="16"
         fill="#6e7681" letter-spacing="1.6">WITH POCS</text><text x="880" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
         fill="#f85149" letter-spacing="-0.5">1,199</text>

docs/stats.json

@@ -1,5 +1,5 @@
 {
  "kev": 1199,
- "total_cves": 172192,
- "with_pocs": 82972
+ "total_cves": 172245,
+ "with_pocs": 83025
 }

index/cve_dates.json

@@ -1 +1 @@
-{"CVE-1999-0001":["2000-02-04","2024-08-01"],"CVE-1999-0002":["1999-09-29","2024-08-01"],"CVE-1999-0003":["1999-09-29","2024-08-01"],"CVE-1999-0004":["2000-02-04","2024-08-01"],"CVE-1999-0005":["1999-09-29","2024-08-01"],"CVE-1999-0006":["1999-09-29","2024-10-29"],"CVE-1999-0007":["1999-09-29","2024-08-01"],"CVE-1999-0009":["1999-09-29","2024-08-01"],"CVE-1999-0014":["1999-09-29","2024-08-01"],"CVE-1999-0015":["2000-02-04","2024-08-01"],"CVE-1999-0016":["1999-09-29","2025-03-17"],"CVE-1999-0018":["1999-09-29","2024-08-01"],"CVE-1999-0019":["1999-09-29","2024-08-01"],"CVE-1999-0021":["1999-09-29","2024-08-01"],"CVE-1999-0023":["1999-09-29","2024-08-01"],"CVE-1999-0025":["1999-09-29","2024-08-01"],"CVE-1999-0026":["1999-09-29","2024-08-01"],"CVE-1999-0027":["1999-09-29","2024-08-01"],"CVE-1999-0028":["1999-09-29","2024-08-01"],"CVE-1999-0029":["1999-09-29","2024-10-29"],"CVE-1999-0030":["2000-02-04","2024-08-01"],"CVE-1999-0032":["1999-09-29","2024-08-01"],"CVE-1999-0034":["1999-09-29","2024-08-01"],"CVE-1999-0036":["1999-09-29","2024-10-29"],"CVE-1999-0038":["1999-09-29","2024-09-12"],"CVE-1999-0039":["1999-09-29","2024-09-12"],"CVE-1999-0040":["1999-09-29","2024-08-01"],"CVE-1999-0041":["1999-09-29","2024-09-17"],"CVE-1999-0042":["1999-09-29","2024-08-01"],"CVE-1999-0044":["1999-09-29","2024-08-01"],"CVE-1999-0045":["1999-09-29","2024-08-01"],"CVE-1999-0046":["1999-09-29","2024-08-01"],"CVE-1999-0050":["1999-09-29","2024-08-01"],"CVE-1999-0051":["1999-09-29","2024-08-01"],"CVE-1999-0060":["1999-09-29","2024-08-01"],"CVE-1999-0063":["1999-09-29","2024-08-01"],"CVE-1999-0064":["1999-09-29","2024-08-01"],"CVE-1999-0066":["1999-09-29","2024-08-01"],"CVE-1999-0067":["1999-09-29","2024-08-01"],"CVE-1999-0068":["1999-09-29","2024-08-01"],"CVE-1999-0069":["1999-09-29","2024-08-01"],"CVE-1999-0070":["1999-09-29","2024-08-01"],"CVE-1999-0077":["1999-09-29","2024-08-01"],"CVE-1999-0078":["2000-02-04","2024-08-01"],"CVE-1999-0082":["1999-09-29","2024-08-01"],"CVE-1999-0084":["1999-09-29","2024-08-01"],"CVE-1999-0088":["2000-02-04","2024-08-01"],"CVE-1999-0092":["2000-02-04","2024-08-01"],"CVE-1999-0095":["1999-09-29","2024-08-01"],"CVE-1999-0101":["2000-01-18","2024-08-01"],"CVE-1999-0103":["1999-09-29","2025-03-17"],"CVE-1999-0105":["2000-02-04","2024-08-01"],"CVE-1999-0107":["2000-02-04","2024-08-01"],"CVE-1999-0108":["1999-09-29","2024-08-01"],"CVE-1999-0109":["1999-09-29","2024-08-01"],"CVE-1999-0110":["2000-02-04","2005-02-04"],"CVE-1999-0112":["1999-09-29","2024-08-01"],"CVE-1999-0113":["1999-09-29","2024-08-01"],"CVE-1999-0115":["2001-05-07","2024-08-01"],"CVE-1999-0116":["1999-09-29","2024-08-01"],"CVE-1999-0118":["2000-06-02","2024-08-01"],"CVE-1999-0122":["1999-09-29","2024-08-01"],"CVE-1999-0125":["1999-09-29","2024-08-01"],"CVE-1999-0126":["1999-09-29","2024-08-01"],"CVE-1999-0128":["1999-09-29","2024-08-01"],"CVE-1999-0130":["1999-09-29","2024-08-01"],"CVE-1999-0137":["1999-09-29","2024-08-01"],"CVE-1999-0140":["2000-02-04","2024-08-01"],"CVE-1999-0144":["2000-02-04","2024-08-01"],"CVE-1999-0145":["2000-10-13","2024-08-01"],"CVE-1999-0146":["1999-09-29","2024-08-01"],"CVE-1999-0147":["1999-09-29","2024-08-01"],"CVE-1999-0148":["1999-09-29","2024-08-01"],"CVE-1999-0149":["1999-09-29","2024-08-01"],"CVE-1999-0153":["1999-09-29","2024-08-01"],"CVE-1999-0154":["2001-09-12","2024-08-01"],"CVE-1999-0156":["2000-02-04","2024-08-01"],"CVE-1999-0158":["1999-09-29","2024-08-01"],"CVE-1999-0162":["1999-09-29","2024-08-01"],"CVE-1999-0163":["2000-02-04","2024-08-01"],"CVE-1999-0165":["2000-02-04","2024-08-01"],"CVE-1999-0170":["1999-09-29","2024-08-01"],"CVE-1999-0173":["1999-09-29","2024-08-01"],"CVE-1999-0174":["1999-09-29","2024-08-01"],"CVE-1999-0175":["1999-09-29","2024-08-01"],"CVE-1999-0176":["1999-09-29","2024-08-01"],"CVE-1999-0178":["1999-09-29","2024-08-01"],"CVE-1999-0180":["1999-09-29","2024-08-01"],"CVE-1999-0182":["1999-09-29","2024-08-01"],"CVE-1999-0183":["1999-09-29","2024-08-01"],"CVE-1999-0191":["1999-09-29","2024-08-01"],"CVE-1999-0192":["1999-09-29","2024-08-01"],"CVE-1999-0193":["2000-02-04","2024-08-01"],"CVE-1999-0195":["2000-02-04","2024-08-01"],"CVE-1999-0196":["1999-09-29","2024-08-01"],"CVE-1999-0199":["2020-10-06","2024-08-01"],"CVE-1999-0201":["1999-09-29","2024-08-01"],"CVE-1999-0204":["1999-09-29","2024-08-01"],"CVE-1999-0206":["1999-09-29","2024-08-01"],"CVE-1999-0207":["1999-09-29","2024-08-01"],"CVE-1999-0208":["1999-09-29","2024-08-01"],"CVE-1999-0209":["1999-09-29","2024-08-01"],"CVE-1999-0210":["2000-06-02","2024-08-01"],"CVE-1999-0211":["1999-09-29","2024-08-01"],"CVE-1999-0215":["1999-09-29","2024-08-01"],"CVE-1999-0219":["1999-09-29","2024-08-01"],"CVE-1999-0220":["2000-02-04","2024-08-01"],"CVE-1999-0221":["1999-09-29","2024-08-01"],"CVE-1999-0224":["1999-09-29","2024-08-01"],"CVE-1999-0225":["2000-06-02","2024-08-01"],"CVE-1999-0232":["2000-02-04","2024-08-01"],"CVE-1999-0233":["2000-01-18","2024-08-01"],"CVE-1999-0235":["2000-02-04","2024-08-01"],"CVE-1999-0236":["1999-09-Line truncated
+{"CVE-1999-0001":["2000-02-04","2024-08-01"],"CVE-1999-0002":["1999-09-29","2024-08-01"],"CVE-1999-0003":["1999-09-29","2024-08-01"],"CVE-1999-0004":["2000-02-04","2024-08-01"],"CVE-1999-0005":["1999-09-29","2024-08-01"],"CVE-1999-0006":["1999-09-29","2024-10-29"],"CVE-1999-0007":["1999-09-29","2024-08-01"],"CVE-1999-0009":["1999-09-29","2024-08-01"],"CVE-1999-0014":["1999-09-29","2024-08-01"],"CVE-1999-0015":["2000-02-04","2024-08-01"],"CVE-1999-0016":["1999-09-29","2025-03-17"],"CVE-1999-0018":["1999-09-29","2024-08-01"],"CVE-1999-0019":["1999-09-29","2024-08-01"],"CVE-1999-0021":["1999-09-29","2024-08-01"],"CVE-1999-0023":["1999-09-29","2024-08-01"],"CVE-1999-0025":["1999-09-29","2024-08-01"],"CVE-1999-0026":["1999-09-29","2024-08-01"],"CVE-1999-0027":["1999-09-29","2024-08-01"],"CVE-1999-0028":["1999-09-29","2024-08-01"],"CVE-1999-0029":["1999-09-29","2024-10-29"],"CVE-1999-0030":["2000-02-04","2024-08-01"],"CVE-1999-0032":["1999-09-29","2024-08-01"],"CVE-1999-0034":["1999-09-29","2024-08-01"],"CVE-1999-0036":["1999-09-29","2024-10-29"],"CVE-1999-0038":["1999-09-29","2024-09-12"],"CVE-1999-0039":["1999-09-29","2024-09-12"],"CVE-1999-0040":["1999-09-29","2024-08-01"],"CVE-1999-0041":["1999-09-29","2024-09-17"],"CVE-1999-0042":["1999-09-29","2024-08-01"],"CVE-1999-0044":["1999-09-29","2024-08-01"],"CVE-1999-0045":["1999-09-29","2024-08-01"],"CVE-1999-0046":["1999-09-29","2024-08-01"],"CVE-1999-0050":["1999-09-29","2024-08-01"],"CVE-1999-0051":["1999-09-29","2024-08-01"],"CVE-1999-0060":["1999-09-29","2024-08-01"],"CVE-1999-0063":["1999-09-29","2024-08-01"],"CVE-1999-0064":["1999-09-29","2024-08-01"],"CVE-1999-0066":["1999-09-29","2024-08-01"],"CVE-1999-0067":["1999-09-29","2024-08-01"],"CVE-1999-0068":["1999-09-29","2024-08-01"],"CVE-1999-0069":["1999-09-29","2024-08-01"],"CVE-1999-0070":["1999-09-29","2024-08-01"],"CVE-1999-0077":["1999-09-29","2024-08-01"],"CVE-1999-0078":["2000-02-04","2024-08-01"],"CVE-1999-0082":["1999-09-29","2024-08-01"],"CVE-1999-0084":["1999-09-29","2024-08-01"],"CVE-1999-0088":["2000-02-04","2024-08-01"],"CVE-1999-0092":["2000-02-04","2024-08-01"],"CVE-1999-0095":["1999-09-29","2024-08-01"],"CVE-1999-0101":["2000-01-18","2024-08-01"],"CVE-1999-0103":["1999-09-29","2025-03-17"],"CVE-1999-0105":["2000-02-04","2024-08-01"],"CVE-1999-0107":["2000-02-04","2024-08-01"],"CVE-1999-0108":["1999-09-29","2024-08-01"],"CVE-1999-0109":["1999-09-29","2024-08-01"],"CVE-1999-0110":["2000-02-04","2005-02-04"],"CVE-1999-0112":["1999-09-29","2024-08-01"],"CVE-1999-0113":["1999-09-29","2024-08-01"],"CVE-1999-0115":["2001-05-07","2024-08-01"],"CVE-1999-0116":["1999-09-29","2024-08-01"],"CVE-1999-0118":["2000-06-02","2024-08-01"],"CVE-1999-0122":["1999-09-29","2024-08-01"],"CVE-1999-0125":["1999-09-29","2024-08-01"],"CVE-1999-0126":["1999-09-29","2024-08-01"],"CVE-1999-0128":["1999-09-29","2024-08-01"],"CVE-1999-0130":["1999-09-29","2024-08-01"],"CVE-1999-0137":["1999-09-29","2024-08-01"],"CVE-1999-0140":["2000-02-04","2024-08-01"],"CVE-1999-0144":["2000-02-04","2024-08-01"],"CVE-1999-0145":["2000-10-13","2024-08-01"],"CVE-1999-0146":["1999-09-29","2024-08-01"],"CVE-1999-0147":["1999-09-29","2024-08-01"],"CVE-1999-0148":["1999-09-29","2024-08-01"],"CVE-1999-0149":["1999-09-29","2024-08-01"],"CVE-1999-0153":["1999-09-29","2024-08-01"],"CVE-1999-0154":["2001-09-12","2024-08-01"],"CVE-1999-0156":["2000-02-04","2024-08-01"],"CVE-1999-0158":["1999-09-29","2024-08-01"],"CVE-1999-0162":["1999-09-29","2024-08-01"],"CVE-1999-0163":["2000-02-04","2024-08-01"],"CVE-1999-0165":["2000-02-04","2024-08-01"],"CVE-1999-0170":["1999-09-29","2024-08-01"],"CVE-1999-0173":["1999-09-29","2024-08-01"],"CVE-1999-0174":["1999-09-29","2024-08-01"],"CVE-1999-0175":["1999-09-29","2024-08-01"],"CVE-1999-0176":["1999-09-29","2024-08-01"],"CVE-1999-0178":["1999-09-29","2024-08-01"],"CVE-1999-0180":["1999-09-29","2024-08-01"],"CVE-1999-0182":["1999-09-29","2024-08-01"],"CVE-1999-0183":["1999-09-29","2024-08-01"],"CVE-1999-0191":["1999-09-29","2024-08-01"],"CVE-1999-0192":["1999-09-29","2024-08-01"],"CVE-1999-0193":["2000-02-04","2024-08-01"],"CVE-1999-0195":["2000-02-04","2024-08-01"],"CVE-1999-0196":["1999-09-29","2024-08-01"],"CVE-1999-0199":["2020-10-06","2024-08-01"],"CVE-1999-0201":["1999-09-29","2024-08-01"],"CVE-1999-0204":["1999-09-29","2024-08-01"],"CVE-1999-0206":["1999-09-29","2024-08-01"],"CVE-1999-0207":["1999-09-29","2024-08-01"],"CVE-1999-0208":["1999-09-29","2024-08-01"],"CVE-1999-0209":["1999-09-29","2024-08-01"],"CVE-1999-0210":["2000-06-02","2024-08-01"],"CVE-1999-0211":["1999-09-29","2024-08-01"],"CVE-1999-0215":["1999-09-29","2024-08-01"],"CVE-1999-0219":["1999-09-29","2024-08-01"],"CVE-1999-0220":["2000-02-04","2024-08-01"],"CVE-1999-0221":["1999-09-29","2024-08-01"],"CVE-1999-0224":["1999-09-29","2024-08-01"],"CVE-1999-0225":["2000-06-02","2024-08-01"],"CVE-1999-0232":["2000-02-04","2024-08-01"],"CVE-1999-0233":["2000-01-18","2024-08-01"],"CVE-1999-0235":["2000-02-04","2024-08-01"],"CVE-1999-0236":["1999-09-Line truncated

index/github.txt

@@ -26656,11 +26656,8 @@ CVE-2021-43289 - https://github.com/HigorGabrielDCF/GoCD_PoC_Supply_Chain_Attack
 CVE-2021-43290 - https://github.com/HigorGabrielDCF/GoCD_PoC_Supply_Chain_Attack
 CVE-2022-22715 - https://github.com/vportal/CVE-2022-22715
 CVE-2026-85706 - https://github.com/jweny/vuln-screenshot
-CVE-2018-7600 - https://github.com/a2u/CVE-2018-7600
-CVE-2018-7600 - https://github.com/g0rx/CVE-2018-7600-Drupal-RCE
 CVE-2020-1948 - https://github.com/keloke/Dubbo-deserialization
 CVE-2024-0670 - https://github.com/taktak0x/HTB-NanoCorp-CVE-2024-0670
-CVE-2024-6387 - https://github.com/zgzhang/cve-2024-6387-poc
 CVE-2026-27739 - https://github.com/mr-redoo7/CVE-2026-27739-POC
 CVE-2026-76460 - https://github.com/S3v3n-JG/CVE-2026-76460
 CVE-2026-49179 - https://github.com/overgrowncarrot1/CVE-2026-49179-Active-Directory-WriteSPNScript-Command-Injection
@@ -26690,3 +26687,16 @@ CVE-2026-80844 - https://github.com/manizada/DirtyAH6
 CVE-2026-81000 - https://github.com/manizada/TUNderflow
 CVE-2026-64560 - https://github.com/RMDycz/K80Pro-miro-CVE-2026-64560
 CVE-2026-93453 - https://github.com/Faceless0x7/CVE-2026-93453
+CVE-2002-1120 - https://github.com/bluedragonsecurity/savant_version_3.1_remote_post_buffer_overflow
+CVE-2005-0338 - https://github.com/bluedragonsecurity/savant_version_3.1_remote_post_buffer_overflow
+CVE-2012-0273 - https://github.com/bluedragonsecurity/minalic_2.0_remote_post_buffer_overflow
+CVE-2017-16114 - https://github.com/appsec-poc-22/scagoat
+CVE-2018-1000861 - https://github.com/williams-surjanto/infrastructure_security
+CVE-2018-13379 - https://github.com/1337or420/FortiGate-FortiWeb-Multi-Exploit-Extractor
+CVE-2021-43798 - https://github.com/Squ1shification/Grafana-Plugin-Enumerator-CVE-2021-43798
+CVE-2021-43798 - https://github.com/williams-surjanto/infrastructure_security
+CVE-2021-44228 - https://github.com/appsec-poc-22/scagoat
+CVE-2021-44228 - https://github.com/hungln105-cell/skill-bug-app
+CVE-2023-42282 - https://github.com/appsec-poc-22/scagoat
+CVE-2024-58306 - https://github.com/bluedragonsecurity/minalic_2.0_remote_post_buffer_overflow
+CVE-2024-6387 - https://github.com/hungln105-cell/skill-bug-app

index/reference_pocs.txt

@@ -38523,3 +38523,55 @@ CVE-2026-92813 - https://github.com/geo-chen/oss/blob/main/metabase.md#finding-2
 CVE-2026-92814 - https://github.com/geo-chen/oss/blob/main/changedetection.io.md#finding-1-stored-htmlmarkup-injection-into-html-notifications-via-scraped-page-title-watch_title-not-in-the-escape-set
 CVE-2026-92815 - https://github.com/geo-chen/oss/blob/main/changedetection.io.md#finding-2-ssrf-via-browser-step-goto-url-action-bypasses-the-ssrf-guard-guard-only-applied-to-the-main-watch-url
 CVE-2026-92816 - https://github.com/geo-chen/oss/blob/main/ComfyUI.md
+CVE-2026-79713 - https://wpscan.com/vulnerability/7d62297b-40e3-445f-b970-9a34dcabd7c7/
+CVE-2026-81340 - https://wpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0/
+CVE-2026-81810 - https://wpscan.com/vulnerability/2036592e-09eb-4231-b450-85d8fbc0ba3f/
+CVE-2026-84738 - https://wpscan.com/vulnerability/1d6c7f60-570e-4729-a2d5-463e0b62942e/
+CVE-2026-84902 - https://wpscan.com/vulnerability/4afc5f30-8b30-4e77-9bd7-91c25065bb54/
+CVE-2026-84903 - https://wpscan.com/vulnerability/57853db6-c9e0-4b0a-8a57-8287f0e85eea/
+CVE-2026-84904 - https://wpscan.com/vulnerability/08ea6c9d-0bfd-4ad1-91d6-93d592867731/
+CVE-2026-85009 - https://wpscan.com/vulnerability/9731b0f3-76c2-4e0a-9630-9160299a37ee/
+CVE-2026-85122 - https://wpscan.com/vulnerability/7263f875-3ff3-410a-94b0-fa4b3694d356/
+CVE-2026-85123 - https://wpscan.com/vulnerability/a4968578-aac9-4500-bfb1-f5db95a61921/
+CVE-2026-85127 - https://wpscan.com/vulnerability/4bca17fb-e9b4-4dc7-994f-08ce4aafadc7/
+CVE-2026-85350 - https://wpscan.com/vulnerability/5068ff54-8632-42bd-b50a-4ecb6ac5853f/
+CVE-2026-86796 - https://wpscan.com/vulnerability/38baa866-c8a3-4c92-b7c8-8485e7c2a9b0/
+CVE-2026-86800 - https://wpscan.com/vulnerability/01772455-89fe-4bcd-b3b7-c29b8646679d/
+CVE-2026-87767 - https://wpscan.com/vulnerability/1d103d80-1904-4aae-87b1-06a429ca85c9/
+CVE-2026-87770 - https://wpscan.com/vulnerability/23bd3a5f-f627-4cd4-a25b-3bc79da79c2a/
+CVE-2026-87771 - https://wpscan.com/vulnerability/d71642f0-431c-42fc-bf3f-2b7b3c4e3954/
+CVE-2026-87774 - https://wpscan.com/vulnerability/802f208f-a3dd-4dc7-b1d2-ec455f0350f7/
+CVE-2026-87775 - https://wpscan.com/vulnerability/5a2ed5cd-1a05-4b54-b604-f596d8a8b76b/
+CVE-2026-87829 - https://wpscan.com/vulnerability/8c76bf99-5d3e-4573-a909-040a7ab36d68/
+CVE-2026-87831 - https://wpscan.com/vulnerability/7a871164-ce44-4e4c-8e15-15daa84767c6/
+CVE-2026-87965 - https://wpscan.com/vulnerability/b498fba8-8969-45af-8cef-e91d6be34912/
+CVE-2026-87966 - https://wpscan.com/vulnerability/e2e625f4-c146-4622-b439-3179c4484613/
+CVE-2026-88798 - https://wpscan.com/vulnerability/e658dcd2-2ff6-4611-a28d-e2482c65be8b/
+CVE-2026-88825 - https://wpscan.com/vulnerability/12337af6-e465-4010-a54d-be92a5dfa5d6/
+CVE-2026-88844 - https://wpscan.com/vulnerability/13b4f5c4-db4a-4bc2-b092-07747ee790e6/
+CVE-2026-88993 - https://wpscan.com/vulnerability/fc1f2f62-62cd-4a70-b541-2278eb0edefe/
+CVE-2026-88994 - https://wpscan.com/vulnerability/55b1f0b1-dc15-45d4-beb2-4d1d7a9fe3dd/
+CVE-2026-89007 - https://wpscan.com/vulnerability/5e174229-a375-456c-b651-7ad4a3c004ab/
+CVE-2026-89008 - https://wpscan.com/vulnerability/be5cf196-2f4b-4ad6-b477-287f80f1dd0d/
+CVE-2026-89038 - https://github.com/actuator/com.vcast.mediamanager
+CVE-2026-90976 - https://wpscan.com/vulnerability/e72f9529-6500-4ed2-a8cc-d77045b6be5c/
+CVE-2026-90977 - https://wpscan.com/vulnerability/368db83e-ed7b-4f67-99db-2e5f1c01568e/
+CVE-2026-90978 - https://wpscan.com/vulnerability/39321ecd-98e5-4f4e-9a42-bedf5904c3d1/
+CVE-2026-90984 - https://wpscan.com/vulnerability/1aa459e4-bd75-49a5-a6de-812375d441e6/
+CVE-2026-92918 - https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C02_log_session_token_disclosure.py
+CVE-2026-92919 - https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C03_storage_path_traversal_write.py
+CVE-2026-92920 - https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C06_account_lockout_bypass.py
+CVE-2026-92921 - https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C08_md5_credential_hashing.py
+CVE-2026-92926 - https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/partner_preference/sqli_education/Readme.md
+CVE-2026-92927 - https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/information_disclosure/Readme.md
+CVE-2026-92992 - https://gist.github.com/xufengnian/b95662ba0d8881cfc5ba0bb99cbfc086
+CVE-2026-92993 - https://gist.github.com/xufengnian/b95662ba0d8881cfc5ba0bb99cbfc086
+CVE-2026-93307 - https://gist.github.com/fklement/1c1ff92588944a021ceb2b5e894973c5
+CVE-2026-93308 - https://gist.github.com/fklement/9f217219b95f7ced94527a2d18b5f059
+CVE-2026-93309 - https://gist.github.com/fklement/639eb04a12cc5c015f9b960b0de96d80
+CVE-2026-93310 - https://gist.github.com/fklement/f70321f38513c2e82a87f062e519c587
+CVE-2026-93311 - https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md
+CVE-2026-93312 - https://github.com/r1ck9-2q/cve_summit/blob/main/Null-pointer-offset-undefined-behavior-in-JBIG2Stream-rewind-JBIG2Stream.cc-1229.md
+CVE-2026-93313 - https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-JBIG2Stream-readCodeTableSeg-JBIG2Stream.cc-4118.md
+CVE-2026-93314 - https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-mapCodeToGID-FoFiTrueType.cc-608.md
+CVE-2026-93454 - https://hackmd.io/@leediay/stored-xss-aureus-via-payment-term

index/references.txt

@@ -117275,3 +117275,55 @@ CVE-2026-61560 - https://github.com/advisories/GHSA-cv3r-c5h8-f4g5
 CVE-2026-63127 - https://github.com/advisories/GHSA-33f5-2c5q-wgwj
 CVE-2026-68904 - https://github.com/advisories/GHSA-r2pf-9cw4-5j65
 CVE-2026-8462 - https://github.com/advisories/GHSA-wc3v-3457-c8cm
+CVE-2026-79713 - https://wpscan.com/vulnerability/7d62297b-40e3-445f-b970-9a34dcabd7c7/
+CVE-2026-81340 - https://wpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0/
+CVE-2026-81810 - https://wpscan.com/vulnerability/2036592e-09eb-4231-b450-85d8fbc0ba3f/
+CVE-2026-84738 - https://wpscan.com/vulnerability/1d6c7f60-570e-4729-a2d5-463e0b62942e/
+CVE-2026-84902 - https://wpscan.com/vulnerability/4afc5f30-8b30-4e77-9bd7-91c25065bb54/
+CVE-2026-84903 - https://wpscan.com/vulnerability/57853db6-c9e0-4b0a-8a57-8287f0e85eea/
+CVE-2026-84904 - https://wpscan.com/vulnerability/08ea6c9d-0bfd-4ad1-91d6-93d592867731/
+CVE-2026-85009 - https://wpscan.com/vulnerability/9731b0f3-76c2-4e0a-9630-9160299a37ee/
+CVE-2026-85122 - https://wpscan.com/vulnerability/7263f875-3ff3-410a-94b0-fa4b3694d356/
+CVE-2026-85123 - https://wpscan.com/vulnerability/a4968578-aac9-4500-bfb1-f5db95a61921/
+CVE-2026-85127 - https://wpscan.com/vulnerability/4bca17fb-e9b4-4dc7-994f-08ce4aafadc7/
+CVE-2026-85350 - https://wpscan.com/vulnerability/5068ff54-8632-42bd-b50a-4ecb6ac5853f/
+CVE-2026-86796 - https://wpscan.com/vulnerability/38baa866-c8a3-4c92-b7c8-8485e7c2a9b0/
+CVE-2026-86800 - https://wpscan.com/vulnerability/01772455-89fe-4bcd-b3b7-c29b8646679d/
+CVE-2026-87767 - https://wpscan.com/vulnerability/1d103d80-1904-4aae-87b1-06a429ca85c9/
+CVE-2026-87770 - https://wpscan.com/vulnerability/23bd3a5f-f627-4cd4-a25b-3bc79da79c2a/
+CVE-2026-87771 - https://wpscan.com/vulnerability/d71642f0-431c-42fc-bf3f-2b7b3c4e3954/
+CVE-2026-87774 - https://wpscan.com/vulnerability/802f208f-a3dd-4dc7-b1d2-ec455f0350f7/
+CVE-2026-87775 - https://wpscan.com/vulnerability/5a2ed5cd-1a05-4b54-b604-f596d8a8b76b/
+CVE-2026-87829 - https://wpscan.com/vulnerability/8c76bf99-5d3e-4573-a909-040a7ab36d68/
+CVE-2026-87831 - https://wpscan.com/vulnerability/7a871164-ce44-4e4c-8e15-15daa84767c6/
+CVE-2026-87965 - https://wpscan.com/vulnerability/b498fba8-8969-45af-8cef-e91d6be34912/
+CVE-2026-87966 - https://wpscan.com/vulnerability/e2e625f4-c146-4622-b439-3179c4484613/
+CVE-2026-88798 - https://wpscan.com/vulnerability/e658dcd2-2ff6-4611-a28d-e2482c65be8b/
+CVE-2026-88825 - https://wpscan.com/vulnerability/12337af6-e465-4010-a54d-be92a5dfa5d6/
+CVE-2026-88844 - https://wpscan.com/vulnerability/13b4f5c4-db4a-4bc2-b092-07747ee790e6/
+CVE-2026-88993 - https://wpscan.com/vulnerability/fc1f2f62-62cd-4a70-b541-2278eb0edefe/
+CVE-2026-88994 - https://wpscan.com/vulnerability/55b1f0b1-dc15-45d4-beb2-4d1d7a9fe3dd/
+CVE-2026-89007 - https://wpscan.com/vulnerability/5e174229-a375-456c-b651-7ad4a3c004ab/
+CVE-2026-89008 - https://wpscan.com/vulnerability/be5cf196-2f4b-4ad6-b477-287f80f1dd0d/
+CVE-2026-89038 - https://github.com/actuator/com.vcast.mediamanager
+CVE-2026-90976 - https://wpscan.com/vulnerability/e72f9529-6500-4ed2-a8cc-d77045b6be5c/
+CVE-2026-90977 - https://wpscan.com/vulnerability/368db83e-ed7b-4f67-99db-2e5f1c01568e/
+CVE-2026-90978 - https://wpscan.com/vulnerability/39321ecd-98e5-4f4e-9a42-bedf5904c3d1/
+CVE-2026-90984 - https://wpscan.com/vulnerability/1aa459e4-bd75-49a5-a6de-812375d441e6/
+CVE-2026-92918 - https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C02_log_session_token_disclosure.py
+CVE-2026-92919 - https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C03_storage_path_traversal_write.py
+CVE-2026-92920 - https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C06_account_lockout_bypass.py
+CVE-2026-92921 - https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C08_md5_credential_hashing.py
+CVE-2026-92926 - https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/partner_preference/sqli_education/Readme.md
+CVE-2026-92927 - https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/information_disclosure/Readme.md
+CVE-2026-92992 - https://gist.github.com/xufengnian/b95662ba0d8881cfc5ba0bb99cbfc086
+CVE-2026-92993 - https://gist.github.com/xufengnian/b95662ba0d8881cfc5ba0bb99cbfc086
+CVE-2026-93307 - https://gist.github.com/fklement/1c1ff92588944a021ceb2b5e894973c5
+CVE-2026-93308 - https://gist.github.com/fklement/9f217219b95f7ced94527a2d18b5f059
+CVE-2026-93309 - https://gist.github.com/fklement/639eb04a12cc5c015f9b960b0de96d80
+CVE-2026-93310 - https://gist.github.com/fklement/f70321f38513c2e82a87f062e519c587
+CVE-2026-93311 - https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md
+CVE-2026-93312 - https://github.com/r1ck9-2q/cve_summit/blob/main/Null-pointer-offset-undefined-behavior-in-JBIG2Stream-rewind-JBIG2Stream.cc-1229.md
+CVE-2026-93313 - https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-JBIG2Stream-readCodeTableSeg-JBIG2Stream.cc-4118.md
+CVE-2026-93314 - https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-mapCodeToGID-FoFiTrueType.cc-608.md
+CVE-2026-93454 - https://hackmd.io/@leediay/stored-xss-aureus-via-payment-term