mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
Update CVE PoCs 2026-09-07
This commit is contained in:
CVE-BOT committed
1 parent
fb2b62faa0
commit
ba2b4e272a
115 files changed
+1918
-32
No files matched your search
@@ -1,3 +1,3 @@
|
||||
{
|
||||
"cvelist_fetch_time": "2026-09-05T06:44:40.610Z"
|
||||
"cvelist_fetch_time": "2026-09-07T07:05:19.474Z"
|
||||
}
|
||||
@@ -1,8 +1,8 @@
|
||||
<div align="center">
|
||||
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=171288-82655-1186" alt="PoC Index" width="100%"></a>
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=171373-82740-1186" alt="PoC Index" width="100%"></a>
|
||||
|
||||
[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
|
||||
[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
|
||||
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>
|
||||
|
||||
|
||||
@@ -17,6 +17,7 @@ No PoCs from references.
|
||||
- https://github.com/M41doror/cve-2010-4221
|
||||
- https://github.com/Sreenivas-147/internal-penetration-testing
|
||||
- https://github.com/ankh2054/python-exploits
|
||||
- https://github.com/Esh001/MACHINE-BASIC-PENTESTING-1
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/16878
|
||||
|
||||
@@ -17,5 +17,4 @@ There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcor
|
||||
#### Github
|
||||
- https://github.com/FenrirSec/CVE-2018-17240_exploit
|
||||
- https://github.com/Xewdy444/Netgrave
|
||||
- https://github.com/BBge/CVE-2018-17240
|
||||
|
||||
@@ -17,5 +17,4 @@ The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCor
|
||||
- https://github.com/Offensive-Panda/NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE
|
||||
- https://github.com/Rydersel/PlaguewareCSGO_3.0
|
||||
- https://github.com/abraxas/veneficus-implant-public
|
||||
- https://github.com/Barakat/CVE-2019-16098
|
||||
|
||||
@@ -101,6 +101,7 @@ Windows Print Spooler Remote Code Execution Vulnerability
|
||||
- https://github.com/yu2u/CVE-2021-1675
|
||||
- https://github.com/zha0/Microsoft-CVE-2021-1675
|
||||
- https://github.com/ccordeiro/CVE-2021-1675
|
||||
- https://github.com/HKenzoKimura/CVE-2021-1675
|
||||
|
||||
#### Metasploit
|
||||
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb
|
||||
@@ -236,6 +236,7 @@ A local privilege escalation vulnerability was found on polkit's pkexec utility.
|
||||
- https://github.com/rvzsec/CVE-2021-4034
|
||||
- https://github.com/tachote/CVE-2021-4034
|
||||
- https://github.com/usmansec/-CVE-2021-4034
|
||||
- https://github.com/iurhfiu6/CVE-2021-4034
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/50689
|
||||
|
||||
@@ -191,6 +191,7 @@ A flaw was found in a change made to path normalization in Apache HTTP Server 2.
|
||||
- https://github.com/sobanahmed6061/CVE-2021-41773-RedTeam
|
||||
- https://github.com/sudo0xksh/cve-2021-41773-checker
|
||||
- https://github.com/zubairahm3d/apache-cve-2021-41773-lab
|
||||
- https://github.com/MrFrost232/binary-exploitation-labs
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41773.yaml
|
||||
|
||||
@@ -462,6 +462,7 @@ Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12
|
||||
- https://github.com/kwekre/poc
|
||||
- https://github.com/N0tOd2y/PenForge
|
||||
- https://github.com/ARPSyndicate/puncia
|
||||
- https://github.com/ptn1411/skill
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44228.yaml
|
||||
|
||||
@@ -23,4 +23,5 @@ No PoCs from references.
|
||||
- https://github.com/LeoChen-CoreMind/spd_flasher
|
||||
- https://github.com/sloden1977-lang/ROOT-ZTE-X1001
|
||||
- https://github.com/TripleU613/Tabwee-T20-Booloader-Unlock
|
||||
- https://github.com/Abrish-Yir/UnisocUnlock
|
||||
|
||||
@@ -58,6 +58,7 @@ No PoCs from references.
|
||||
- https://github.com/ro0tmylove/CVE-2024-35250-BOF
|
||||
- https://github.com/yinsel/CVE-2024-35250-BOF
|
||||
- https://github.com/zsxen/WHS3-KernelPanic
|
||||
- https://github.com/cli0xfa/simple-krw-vuln
|
||||
|
||||
#### Metasploit
|
||||
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2024_35250_ks_driver.rb
|
||||
@@ -113,7 +113,7 @@ A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd).
|
||||
- https://github.com/evilbotnet/ilovemalware
|
||||
- https://github.com/hackingyseguridad/ssha
|
||||
- https://github.com/jasonnorman66994-dot/sovereign-command-center
|
||||
- https://github.com/zgzhang/cve-2024-6387-poc
|
||||
- https://github.com/ptn1411/skill
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/52269
|
||||
@@ -15,7 +15,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
### [CVE-2025-2842](https://www.cve.org/CVERecord?id=CVE-2025-2842)
|
||||
**Tempo-operator: tempo operator token exposition lead to read sensitive data**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -28,7 +28,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -28,7 +28,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -3,10 +3,10 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -28,10 +28,10 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -7,11 +7,11 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -31,11 +31,11 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-13159](https://www.cve.org/CVERecord?id=CVE-2026-13159)
|
||||
**Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/3eea9204-d9ea-474e-a299-31d1aa0385e0/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18480](https://www.cve.org/CVERecord?id=CVE-2026-18480)
|
||||
**SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/88839ada-9c59-44cb-96e6-3548e5a59b9f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-19859](https://www.cve.org/CVERecord?id=CVE-2026-19859)
|
||||
**JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later shortcode-expansion pass rather than after it, so the escaping can be bypassed.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/19c115a5-4280-4b78-a460-140ecfc78d4f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-19862](https://www.cve.org/CVERecord?id=CVE-2026-19862)
|
||||
**JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/b3fe5552-6736-4479-9c61-c05bc3328b8e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -15,4 +15,4 @@ Ekushey Project Manager CRM stores the administrator-configured system name and
|
||||
- https://github.com/LindHunt/CVE-2026-26211
|
||||
|
||||
#### Github
|
||||
- https://github.com/LindHunt/CVE-2026-26211
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -1,7 +1,19 @@
|
||||
### [CVE-2026-2670](https://www.cve.org/CVERecord?id=CVE-2026-2670)
|
||||
**Advantech WISE-6610 Background Management openvpn_apply os command injection**
|
||||
**Advantech WISE-6610-NB Background Management openvpn_apply os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -14,7 +14,8 @@ RouterOS does not compare the complete RSA public key when matching an SSH authe
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
|
||||
|
||||
#### Github
|
||||
- https://github.com/BlackHatExploitation/exploit-mikrotik-2026
|
||||
- https://github.com/HORKimhab/CVE-2026-67276
|
||||
@@ -0,0 +1,24 @@
|
||||
### [CVE-2026-67277](https://www.cve.org/CVERecord?id=CVE-2026-67277)
|
||||
**Kernel memory disclosure and denial of service in MikroTik RouterOS btest service**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.
|
||||
|
||||
|
||||
|
||||
This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,22 @@
|
||||
### [CVE-2026-67278](https://www.cve.org/CVERecord?id=CVE-2026-67278)
|
||||
**TLS server impersonation possible in Mikrotik RouterOS**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation.
|
||||
|
||||
This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-67279](https://www.cve.org/CVERecord?id=CVE-2026-67279)
|
||||
**SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-67281](https://www.cve.org/CVERecord?id=CVE-2026-67281)
|
||||
**Unauthenticated file read in Mikrotik RouterOS**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-75793](https://www.cve.org/CVERecord?id=CVE-2026-75793)
|
||||
**SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d1c2ea43-2643-4cdf-8dfe-e11109266f51/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,31 @@
|
||||
### [CVE-2026-79697](https://www.cve.org/CVERecord?id=CVE-2026-79697)
|
||||
**Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://uvxbywu62qm.feishu.cn/wiki/EzwXwS0vKiroHmk9rqzcjP0EnMe?from=from_copylink
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,31 @@
|
||||
### [CVE-2026-79698](https://www.cve.org/CVERecord?id=CVE-2026-79698)
|
||||
**Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://uvxbywu62qm.feishu.cn/wiki/RgziwoXf2iD9zKkI4MJcfWcNn7c?from=from_copylink
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-80437](https://www.cve.org/CVERecord?id=CVE-2026-80437)
|
||||
**Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/473a3321-7dc6-454a-82f4-89b6a393d09a/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-80439](https://www.cve.org/CVERecord?id=CVE-2026-80439)
|
||||
**Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/96562897-f18c-45d3-9f31-0e40e8df1383/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-84028](https://www.cve.org/CVERecord?id=CVE-2026-84028)
|
||||
**Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6abd5d49-af3a-4515-ba33-57b56a9fba4e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-84219](https://www.cve.org/CVERecord?id=CVE-2026-84219)
|
||||
**Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e95bd1e3-6f61-423f-add6-519e1ca7bf66/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-85038](https://www.cve.org/CVERecord?id=CVE-2026-85038)
|
||||
**B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a397aeaf-7629-45dd-a2ee-3e904cc19550/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-86060](https://www.cve.org/CVERecord?id=CVE-2026-86060)
|
||||
**SSH session privilege manipulation via a crafted username in Mikrotik RouterOS**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
RouterOS contains an argument-handling flaw in the SSH login
|
||||
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86159](https://www.cve.org/CVERecord?id=CVE-2026-86159)
|
||||
**SourceCodester Online Voting System ajax.php save_user sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_user. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/lwcc223/CVE/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86160](https://www.cve.org/CVERecord?id=CVE-2026-86160)
|
||||
**SourceCodester Online Voting System ajax.php delete_voting sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/lwcc223/CVE/issues/2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86161](https://www.cve.org/CVERecord?id=CVE-2026-86161)
|
||||
**SourceCodester Online Voting System ajax.php delete_category sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/lwcc223/CVE/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86162](https://www.cve.org/CVERecord?id=CVE-2026-86162)
|
||||
**SourceCodester Online Voting System ajax.php login sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Aurora-Song/cve/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86163](https://www.cve.org/CVERecord?id=CVE-2026-86163)
|
||||
**itsourcecode Sales and Inventory System pro_del.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/pro_del.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/CSDVi/cve/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86164](https://www.cve.org/CVERecord?id=CVE-2026-86164)
|
||||
**itsourcecode Sales and Inventory System trans_view.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/trans_view.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86165](https://www.cve.org/CVERecord?id=CVE-2026-86165)
|
||||
**Tenda HG10 formURL buffer overflow**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formURL-keywd.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86166](https://www.cve.org/CVERecord?id=CVE-2026-86166)
|
||||
**Tenda HG10 Boa Web Server formWanRedirect buffer overflow**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formWanRedirect-if.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86167](https://www.cve.org/CVERecord?id=CVE-2026-86167)
|
||||
**Tenda HG10 Boa formgponConf os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/command-formgponConf-fmgpon_loid.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86168](https://www.cve.org/CVERecord?id=CVE-2026-86168)
|
||||
**code-projects Content Management System login.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the file /login.php. The manipulation of the argument user_name results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20Vulnerability%20in%20Content%20Management%20System%20%60user_name%60%20Parameter.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86170](https://www.cve.org/CVERecord?id=CVE-2026-86170)
|
||||
**DefaultFuction CRM edit.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/DefaultFuction/Customer-Relationship-Management-System/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86171](https://www.cve.org/CVERecord?id=CVE-2026-86171)
|
||||
**DefaultFuction CRM delete.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/DefaultFuction/Customer-Relationship-Management-System/issues/4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86172](https://www.cve.org/CVERecord?id=CVE-2026-86172)
|
||||
**DefaultFuction CRM delete.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/DefaultFuction/Customer-Relationship-Management-System/issues/5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86175](https://www.cve.org/CVERecord?id=CVE-2026-86175)
|
||||
**NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/geo-chen/oss/blob/main/netbox.md#finding-2-netbox-data-source-backend-credentials-git-password--s3-secret-key-returned-in-plaintext-via-rest-api-and-graphql-to-users-with-only-view-permission-incomplete-fix-of-12625
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86176](https://www.cve.org/CVERecord?id=CVE-2026-86176)
|
||||
**NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/geo-chen/oss/blob/main/netbox.md#finding-1-cross-user-disclosure-of-private-notifications-subscriptions-and-bookmarks-via-rest-api-and-graphql-missing-per-user-scoping
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86177](https://www.cve.org/CVERecord?id=CVE-2026-86177)
|
||||
**Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/geo-chen/oss/blob/main/panel.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86178](https://www.cve.org/CVERecord?id=CVE-2026-86178)
|
||||
**Pixelfed through 0.12.9 Unauthorized Story Access via API**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/geo-chen/oss/blob/main/Pixelfed.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86179](https://www.cve.org/CVERecord?id=CVE-2026-86179)
|
||||
**code-projects Daily Expense Manager Database Backup exp_ak.sql information disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/exp_ak.sql of the component Database Backup Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Daily%20Expense%20Manager%20in%20PHP%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20SQL%20Database%20File.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86180](https://www.cve.org/CVERecord?id=CVE-2026-86180)
|
||||
**code-projects Task Management System In PHP Login index.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Task%20Management%20System%20in%20PHP%20%E2%80%93%20SQL%20Injection%20in%20%60email%60%20Parameter.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86181](https://www.cve.org/CVERecord?id=CVE-2026-86181)
|
||||
**code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the component User Profile Update. The manipulation of the argument lname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Task%20Management%20System%20%60lname%60%20Parameter.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,22 @@
|
||||
### [CVE-2026-86182](https://www.cve.org/CVERecord?id=CVE-2026-86182)
|
||||
**diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm_command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/diem-project/diem/issues/449
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,22 @@
|
||||
### [CVE-2026-86183](https://www.cve.org/CVERecord?id=CVE-2026-86183)
|
||||
**diem-project diem dmWidget BasedmWidgetActions.class.php authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget_id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/diem-project/diem/issues/450
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86208](https://www.cve.org/CVERecord?id=CVE-2026-86208)
|
||||
**SourceCodester Class and Exam Timetabling System delete_teacher.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /delete_teacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/justconter/cve/issues/10
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86209](https://www.cve.org/CVERecord?id=CVE-2026-86209)
|
||||
**SourceCodester Class and Exam Timetabling System delete_user.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_user.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/justconter/cve/issues/9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86210](https://www.cve.org/CVERecord?id=CVE-2026-86210)
|
||||
**SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_user_account.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/justconter/cve/issues/8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86211](https://www.cve.org/CVERecord?id=CVE-2026-86211)
|
||||
**rabindralamsal inventory-management-system Login index.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yingxiujie/cve/issues/8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86212](https://www.cve.org/CVERecord?id=CVE-2026-86212)
|
||||
**Open5GS AMF/MME improper authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9468de94caed2fc940f4a23cbf734651896d0fde. To fix this issue, it is recommended to deploy a patch.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/open5gs/open5gs/issues/4680
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-86213](https://www.cve.org/CVERecord?id=CVE-2026-86213)
|
||||
**Mstfakts College-Management-System Search university.php mysqli_query sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/university.php of the component Search Handler. The manipulation of the argument book_name/book_author results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Mstfakts/College-Management-System/issues/5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86214](https://www.cve.org/CVERecord?id=CVE-2026-86214)
|
||||
**Mstfakts College-Management-System login.php improper authentication**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the argument email causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Mstfakts/College-Management-System/issues/6
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-86215](https://www.cve.org/CVERecord?id=CVE-2026-86215)
|
||||
**Mstfakts College-Management-System Logout server.php session expiration**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the component Logout Handler. Such manipulation of the argument log_out leads to session expiration. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Mstfakts/College-Management-System/issues/7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86216](https://www.cve.org/CVERecord?id=CVE-2026-86216)
|
||||
**code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20Hotel%20and%20Tourism%20Reservation%20System%20%60room%60%20Parameter.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86217](https://www.cve.org/CVERecord?id=CVE-2026-86217)
|
||||
**code-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%20(1).sql information disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of the component Database Backup Handler. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Hotel%20and%20Tourism%20Reservation%20System%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20SQL%20Database%20File.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86221](https://www.cve.org/CVERecord?id=CVE-2026-86221)
|
||||
**SourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_course1.php. This manipulation of the argument course causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/justconter/_CVE/issues/2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86226](https://www.cve.org/CVERecord?id=CVE-2026-86226)
|
||||
**Projectwolds Online Attendance System profile.php cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/CyberShailendra1/Online-Attendance-System-Projectworlds
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,26 @@
|
||||
### [CVE-2026-86227](https://www.cve.org/CVERecord?id=CVE-2026-86227)
|
||||
**valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/user-attachments/files/30195539/RDB.zip
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-86228](https://www.cve.org/CVERecord?id=CVE-2026-86228)
|
||||
**JeecgBoot AiragModelController.java exportXls access control**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. You should upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/jeecgboot/JeecgBoot/issues/9600
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,24 @@
|
||||
### [CVE-2026-86231](https://www.cve.org/CVERecord?id=CVE-2026-86231)
|
||||
**mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/mwiede/jsch/issues/1091
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86232](https://www.cve.org/CVERecord?id=CVE-2026-86232)
|
||||
**itsourcecode Sales and Inventory System sup_del.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_del.php?type=supplier. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/v89269561-web/CyberseReasearch/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86233](https://www.cve.org/CVERecord?id=CVE-2026-86233)
|
||||
**itsourcecode Sales and Inventory System us_del.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/us_del.php?type=user. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/v89269561-web/CyberseReasearch/issues/2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86234](https://www.cve.org/CVERecord?id=CVE-2026-86234)
|
||||
**itsourcecode Sales and Inventory System cust_transac.php add sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/cust_transac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/v89269561-web/CyberseReasearch/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86235](https://www.cve.org/CVERecord?id=CVE-2026-86235)
|
||||
**itsourcecode Sales and Inventory System pos_transac.php add sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/pos_transac.php?action=add. This manipulation of the argument Customer causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86236](https://www.cve.org/CVERecord?id=CVE-2026-86236)
|
||||
**itsourcecode Sales and Inventory System pro_transac.php add sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/pro_transac.php?action=add. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/6
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,38 @@
|
||||
### [CVE-2026-86237](https://www.cve.org/CVERecord?id=CVE-2026-86237)
|
||||
**openagents-org openagents http.py test_default_model server-side request forgery**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test_default_model of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument base_url results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. Endpoint and both sinks unchanged since filing; only the file moved (e277dd1a). Maintainer closed as inapplicable yet the identical unguarded code still ships in 0.9.3.post20. Sibling admin endpoints do call the shipped-but-unused-by-this-handler _require_admin().
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/openagents-org/openagents/issues/566
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86238](https://www.cve.org/CVERecord?id=CVE-2026-86238)
|
||||
**projectworlds Online Examination System Feedback Form feedback.php cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/CyberShailendra1/Online-Examination-System-Project
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-86239](https://www.cve.org/CVERecord?id=CVE-2026-86239)
|
||||
**liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yang5ynag/cve/blob/main/FEHI-001-UEditor-Unauthorized-File-Upload.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86240](https://www.cve.org/CVERecord?id=CVE-2026-86240)
|
||||
**liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source[] results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yang5ynag/cve/blob/main/FEHI-002-UEditor-catchImage-SSRF.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-86241](https://www.cve.org/CVERecord?id=CVE-2026-86241)
|
||||
**liufee FeehiCMS Cookie Validation main-local.php hard-coded key**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key
|
||||
. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yang5ynag/cve/blob/main/FEHI-003-Empty-cookieValidationKey.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86244](https://www.cve.org/CVERecord?id=CVE-2026-86244)
|
||||
**FastAdmin User Controller User.php login cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://lhzzz08.github.io/posts/cveapplication4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86245](https://www.cve.org/CVERecord?id=CVE-2026-86245)
|
||||
**itsourcecode Sales and Inventory System sup_transac.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_transac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/9ue33/cve/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86260](https://www.cve.org/CVERecord?id=CVE-2026-86260)
|
||||
**sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function modifyPassWord of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java of the component Password Recovery. Performing a manipulation results in unverified password change. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/sfturing/hosp_order/issues/113
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86261](https://www.cve.org/CVERecord?id=CVE-2026-86261)
|
||||
**sfturing hosp_order Order Controller OrderController.java authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument userIdenf can lead to authorization bypass. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/sfturing/hosp_order/issues/114
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86262](https://www.cve.org/CVERecord?id=CVE-2026-86262)
|
||||
**sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation of the argument userID/id leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/sfturing/hosp_order/issues/115
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86263](https://www.cve.org/CVERecord?id=CVE-2026-86263)
|
||||
**sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/sfturing/hosp_order/issues/116
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86264](https://www.cve.org/CVERecord?id=CVE-2026-86264)
|
||||
**sfturing ssm_pro Order Endpoint OrderController.java cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/sfturing/hosp_order/issues/117
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86265](https://www.cve.org/CVERecord?id=CVE-2026-86265)
|
||||
**itsourcecode Sales and Inventory System us_transac.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/us_transac.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86267](https://www.cve.org/CVERecord?id=CVE-2026-86267)
|
||||
**itsourcecode Information System Society Membership System check_student.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/check_student.php. The manipulation of the argument student_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/anglemsg2401-bot/cve/issues/5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86268](https://www.cve.org/CVERecord?id=CVE-2026-86268)
|
||||
**itsourcecode School Management System User_Login.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/anglemsg2401-bot/cve/issues/6
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86269](https://www.cve.org/CVERecord?id=CVE-2026-86269)
|
||||
**itsourcecode Sales and Inventory System emp_edit1.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/emp_edit1.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86270](https://www.cve.org/CVERecord?id=CVE-2026-86270)
|
||||
**itsourcecode Sales and Inventory System settings_edit.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settings_edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/10
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,22 @@
|
||||
### [CVE-2026-86271](https://www.cve.org/CVERecord?id=CVE-2026-86271)
|
||||
**FluentCMS PermissionManager.cs GetAccessible authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. Performing a manipulation results in missing authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/fluentcms/FluentCMS/issues/2409
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
Loaded 100 of 115 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user