Update CVE PoCs 2026-08-30

.github/cve_sync_state.json

@@ -1,3 +1,3 @@
 {
-  "cvelist_fetch_time": "2026-08-30T08:08:00.342Z"
+  "cvelist_fetch_time": "2026-08-30T14:46:42.048Z"
 }

2025/CVE-2025-20700.md

@@ -0,0 +1,17 @@
+### [CVE-2025-20700](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20700)
+![](https://img.shields.io/static/v1?label=Product&message=AB156x%2C%20AB157x%2C%20AB158x%2C%20AB159x%20series%2C%20AB1627&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=Airoha%20IoT%20SDK%20for%20BT%20audio%20v5.5.0%20and%20earlier&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=Airoha%20AB1561x%2FAB1562x%2FAB1563x%20SDK%20v3.3.1%20and%20earlier&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through Bluetooth LE GATT service. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/xarlord/btsec-testtool

2025/CVE-2025-21479.md

@@ -90,4 +90,5 @@ No PoCs from references.
 - https://github.com/DiscordTonyStark/root
 - https://github.com/FreeXR/eureka_panther-adreno-gpu-exploit-1
 - https://github.com/zhuowei/cheese
+- https://github.com/Type010/cve-2025-21479-iqoo11pro
 

2025/CVE-2025-24813.md

@@ -79,4 +79,5 @@ Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution a
 - https://github.com/yaleman/cve-2025-24813-poc
 - https://github.com/s1lentf00thold/ZoneMinder-v1.29.0
 - https://github.com/leonzhao7/jvuln-platform
+- https://github.com/mrzero-cool/cve-poc-search
 

2025/CVE-2025-27915.md

@@ -13,5 +13,5 @@ An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A s
 No PoCs from references.
 
 #### Github
-No PoCs found on GitHub currently.
+- https://github.com/alsyundawy/eradicate-zimbra-malware
 

2025/CVE-2025-36911.md

@@ -0,0 +1,16 @@
+### [CVE-2025-36911](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-36911)
+![](https://img.shields.io/static/v1?label=Product&message=Android&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=Android%20kernel&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20disclosure&color=brightgreen)
+
+### Description
+
+In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/xarlord/btsec-testtool

2025/CVE-2025-49844.md

@@ -14,3 +14,4 @@ No PoCs from references.
 
 #### Github
 - https://github.com/Zain3311/CVE-2025-49844
+- https://github.com/alsyundawy/eradicate-zimbra-malware

2025/CVE-2025-55182.md

@@ -21,3 +21,4 @@ No PoCs from references.
 - https://github.com/alyaapm/CVE-2025-55182-shellinteractive
 - https://github.com/UwUGreed/CVE-2025-55182-poc
 - https://github.com/Tc3s/REACT2SHELL-WEB-VULN
+- https://github.com/Farhan9488/CVE-2025-55182-research

2025/CVE-2025-5777.md

@@ -42,4 +42,5 @@ Insufficient input validation leading to memory overread when the NetScaler is
 - https://github.com/rootxsushant/Citrix-NetScaler-Memory-Leak-CVE-2025-5777
 - https://github.com/soltanali0/CVE-2025-5777-Exploit
 - https://github.com/win3zz/CVE-2025-5777
+- https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777
 

2025/CVE-2025-6440.md

@@ -0,0 +1,16 @@
+### [CVE-2025-6440](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6440)
+![](https://img.shields.io/static/v1?label=Product&message=WooCommerce%20Designer%20Pro&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brightgreen)
+
+### Description
+
+The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/katranSefa/CVE-2025-6440

2026/CVE-2026-18741.md

@@ -0,0 +1,16 @@
+### [CVE-2026-18741](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18741)
+![](https://img.shields.io/static/v1?label=Product&message=Worksuite%20SaaS&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20%28%27Cross-site%20Scripting%27%29&color=brightgreen)
+
+### Description
+
+Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Attackers can store crafted HTML script tags in the application database that execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/LindHunt/CVE-2026-18741

2026/CVE-2026-23989.md

@@ -0,0 +1,17 @@
+### [CVE-2026-23989](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23989)
+![](https://img.shields.io/static/v1?label=Product&message=reva&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.40.3&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.41.0%2C%20%3C%202.42.3&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen)
+
+### Description
+
+REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/dinosn/cve-2026-23989-opencloud-lab

2026/CVE-2026-43499.md

@@ -138,3 +138,4 @@ No PoCs from references.
 - https://github.com/caramel1205zh/GKI_KernelSU_SUSFS
 - https://github.com/realthotboyshit/sukisu-
 - https://github.com/cancelledbit/x9u-501-unlock-kit
+- https://github.com/Alfnnnnyy/GKI_KernelSU_SUSFS

2026/CVE-2026-50751.md

@@ -20,3 +20,4 @@ No PoCs from references.
 #### Github
 - https://github.com/fevar54/CVE-2026-50751---Check-Point-IKEv1-Authentication-Bypass-Exploit
 - https://github.com/0xBlackash/CVE-2026-50751
+- https://github.com/e4zyy/Project-CVE-2026-50751

2026/CVE-2026-53163.md

@@ -53,3 +53,4 @@ No PoCs from references.
 - https://github.com/PuceLi/GKI_KernelSU_SUSFS_Local
 - https://github.com/caramel1205zh/GKI_KernelSU_SUSFS
 - https://github.com/realthotboyshit/sukisu-
+- https://github.com/Alfnnnnyy/GKI_KernelSU_SUSFS

2026/CVE-2026-64849.md

@@ -16,3 +16,4 @@ No PoCs from references.
 - https://github.com/BiuTrap/CVE-2026-64849
 - https://github.com/zavisco/CVE-2026-64849.yaml
 - https://github.com/codeb0ssx/CVE-2026-64849-PoC
+- https://github.com/mrzero-cool/cve-poc-search

2026/CVE-2026-76581.md

@@ -0,0 +1,16 @@
+### [CVE-2026-76581](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76581)
+![](https://img.shields.io/static/v1?label=Product&message=WPMU%20DEV%20Dashboard&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-347%20Improper%20Verification%20of%20Cryptographic%20Signature&color=brightgreen)
+
+### Description
+
+The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/HORKimhab/CVE-2026-76581

2026/CVE-2026-8222.md

@@ -20,4 +20,4 @@ A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function
 - https://github.com/open5gs/open5gs/issues/4437
 
 #### Github
-No PoCs found on GitHub currently.
+- https://github.com/dinosn/givewp-cve-2026-82222-rce-lab

2026/CVE-2026-82222.md

@@ -16,3 +16,4 @@ No PoCs from references.
 
 #### Github
 - https://github.com/UdinChan/cve-2026-82222-poc
+- https://github.com/dinosn/givewp-cve-2026-82222-rce-lab

2026/CVE-2026-82286.md

@@ -0,0 +1,16 @@
+### [CVE-2026-82286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82286)
+![](https://img.shields.io/static/v1?label=Product&message=gpt-crawler&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20%28%27Path%20Traversal%27%29&color=brightgreen)
+
+### Description
+
+gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourced from attacker-controlled URLs.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/BiiTts/CVE-2026-82286-gpt-crawler-Arbitrary-File-Write

2026/CVE-2026-82484.md

@@ -0,0 +1,17 @@
+### [CVE-2026-82484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82484)
+![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/emp_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
+
+### POC
+
+#### Reference
+- https://github.com/ltranquility/submit_vuln/issues/20
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-82485.md

@@ -0,0 +1,17 @@
+### [CVE-2026-82485](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82485)
+![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pro_edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
+
+### POC
+
+#### Reference
+- https://github.com/ltranquility/submit_vuln/issues/21
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-82487.md

@@ -0,0 +1,16 @@
+### [CVE-2026-82487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82487)
+![](https://img.shields.io/static/v1?label=Product&message=450TC3&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=01.00.00_01&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Weak%20Password%20Recovery&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
+
+### POC
+
+#### Reference
+- https://github.com/Greejith-k/Authenticated-Privilege-Escalation-Vulnerability-in-Beetel-450TC3-Router
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-82488.md

@@ -0,0 +1,17 @@
+### [CVE-2026-82488](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82488)
+![](https://img.shields.io/static/v1?label=Product&message=450TC3&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=01.00.00_01&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen)
+
+### Description
+
+A vulnerability was identified in Beetel 450TC3 01.00.00_01. This vulnerability affects unknown code of the component User Management. The manipulation of the argument Username leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
+
+### POC
+
+#### Reference
+- https://github.com/Greejith-k/Stored-Cross-Site-Scripting-Stored-XSS-Vulnerability-in-Beetel-450TC3-Router
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-82539.md

@@ -0,0 +1,16 @@
+### [CVE-2026-82539](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82539)
+![](https://img.shields.io/static/v1?label=Product&message=A720R&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=4.1.5cu.630_B20250509&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering. Executing a manipulation of the argument desc can lead to memory corruption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
+
+### POC
+
+#### Reference
+- https://github.com/Xernary/CVE-2026-82539
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-82540.md

@@ -0,0 +1,17 @@
+### [CVE-2026-82540](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82540)
+![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_searchfrm.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
+
+### POC
+
+#### Reference
+- https://github.com/niadwj221/cve/issues/2
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-82541.md

@@ -0,0 +1,17 @@
+### [CVE-2026-82541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82541)
+![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
+
+### POC
+
+#### Reference
+- https://github.com/kimjh1946/cve/issues/1
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-82542.md

@@ -0,0 +1,17 @@
+### [CVE-2026-82542](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82542)
+![](https://img.shields.io/static/v1?label=Product&message=HG10&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=300001138&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Buffer%20Overflow&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen)
+
+### Description
+
+A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
+
+### POC
+
+#### Reference
+- https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formIPv6Route-destNt.md
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-82543.md

@@ -0,0 +1,19 @@
+### [CVE-2026-82543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82543)
+![](https://img.shields.io/static/v1?label=Product&message=FileCodeBox&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.1&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.3&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Race%20Condition&color=brightgreen)
+
+### Description
+
+A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage of the file apps/base/views.py of the component Pickup Limit Handler. Performing a manipulation results in race condition. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.5.0 is able to resolve this issue. The patch is named 8d7d856c62d73badd0797eb4daec8d2ff10a403a. Upgrading the affected component is recommended.
+
+### POC
+
+#### Reference
+- https://github.com/vastsa/FileCodeBox/issues/482
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-82545.md

@@ -0,0 +1,17 @@
+### [CVE-2026-82545](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82545)
+![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/sup_searchfrm.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
+
+### POC
+
+#### Reference
+- https://github.com/ltranquility/submit_vuln/issues/22
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-82547.md

@@ -0,0 +1,16 @@
+### [CVE-2026-82547](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82547)
+![](https://img.shields.io/static/v1?label=Product&message=Magma&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.9.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen)
+
+### Description
+
+A vulnerability was found in Linux Foundation Magma 1.9.0. The affected element is an unknown function of the file tasks/amf/amf_fsm.cpp of the component Registration Complete Message Handler. The manipulation results in improper authentication. The attack can be launched remotely. The exploit has been made public and could be used.
+
+### POC
+
+#### Reference
+- https://github.com/magma/magma/issues/16020
+
+#### Github
+No PoCs found on GitHub currently.

2026/CVE-2026-8452.md

@@ -18,3 +18,4 @@ No PoCs from references.
 
 #### Github
 - https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452
+- https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777

github.txt

@@ -62621,3 +62621,23 @@ CVE-2026-81578 - https://github.com/yora1928/PaperCut-CVE-2026-81578-82078
 CVE-2026-82078 - https://github.com/yora1928/PaperCut-CVE-2026-81578-82078
 CVE-2026-82222 - https://github.com/UdinChan/cve-2026-82222-poc
 CVE-2026-9198 - https://github.com/joaovicdev/EXPLOIT-CVE-2026-9198
+CVE-2025-20700 - https://github.com/xarlord/btsec-testtool
+CVE-2025-21479 - https://github.com/Type010/cve-2025-21479-iqoo11pro
+CVE-2025-24813 - https://github.com/mrzero-cool/cve-poc-search
+CVE-2025-27915 - https://github.com/alsyundawy/eradicate-zimbra-malware
+CVE-2025-36911 - https://github.com/xarlord/btsec-testtool
+CVE-2025-49844 - https://github.com/alsyundawy/eradicate-zimbra-malware
+CVE-2025-55182 - https://github.com/Farhan9488/CVE-2025-55182-research
+CVE-2025-5777 - https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777
+CVE-2025-6440 - https://github.com/katranSefa/CVE-2025-6440
+CVE-2026-18741 - https://github.com/LindHunt/CVE-2026-18741
+CVE-2026-23989 - https://github.com/dinosn/cve-2026-23989-opencloud-lab
+CVE-2026-43499 - https://github.com/Alfnnnnyy/GKI_KernelSU_SUSFS
+CVE-2026-50751 - https://github.com/e4zyy/Project-CVE-2026-50751
+CVE-2026-53163 - https://github.com/Alfnnnnyy/GKI_KernelSU_SUSFS
+CVE-2026-64849 - https://github.com/mrzero-cool/cve-poc-search
+CVE-2026-76581 - https://github.com/HORKimhab/CVE-2026-76581
+CVE-2026-8222 - https://github.com/dinosn/givewp-cve-2026-82222-rce-lab
+CVE-2026-82222 - https://github.com/dinosn/givewp-cve-2026-82222-rce-lab
+CVE-2026-82286 - https://github.com/BiiTts/CVE-2026-82286-gpt-crawler-Arbitrary-File-Write
+CVE-2026-8452 - https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777

references.txt

@@ -147864,3 +147864,14 @@ CVE-2026-82424 - https://github.com/Bai-public/CVE/issues/8
 CVE-2026-82473 - https://github.com/geo-chen/oss/blob/main/kubeedge.md
 CVE-2026-82482 - https://github.com/Leousum/VulnPoC/blob/main/CPG1.6.x/stored_xss_biography.md
 CVE-2026-82483 - https://github.com/Leousum/VulnPoC/blob/main/CPG1.6.x/stored_xss_album_desc.md
+CVE-2026-82484 - https://github.com/ltranquility/submit_vuln/issues/20
+CVE-2026-82485 - https://github.com/ltranquility/submit_vuln/issues/21
+CVE-2026-82487 - https://github.com/Greejith-k/Authenticated-Privilege-Escalation-Vulnerability-in-Beetel-450TC3-Router
+CVE-2026-82488 - https://github.com/Greejith-k/Stored-Cross-Site-Scripting-Stored-XSS-Vulnerability-in-Beetel-450TC3-Router
+CVE-2026-82539 - https://github.com/Xernary/CVE-2026-82539
+CVE-2026-82540 - https://github.com/niadwj221/cve/issues/2
+CVE-2026-82541 - https://github.com/kimjh1946/cve/issues/1
+CVE-2026-82542 - https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formIPv6Route-destNt.md
+CVE-2026-82543 - https://github.com/vastsa/FileCodeBox/issues/482
+CVE-2026-82545 - https://github.com/ltranquility/submit_vuln/issues/22
+CVE-2026-82547 - https://github.com/magma/magma/issues/16020