mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
Update CVE PoCs 2026-09-15
This commit is contained in:
CVE-BOT committed
1 parent
9a452b4088
commit
bfe6c649c9
130 files changed
+2190
-38
No files matched your search
@@ -1,3 +1,3 @@
|
||||
{
|
||||
"cvelist_fetch_time": "2026-09-14T07:50:49.857Z"
|
||||
"cvelist_fetch_time": "2026-09-15T07:38:36.359Z"
|
||||
}
|
||||
@@ -1,8 +1,8 @@
|
||||
<div align="center">
|
||||
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=171819-82663-1196" alt="PoC Index" width="100%"></a>
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=171912-82756-1196" alt="PoC Index" width="100%"></a>
|
||||
|
||||
[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
|
||||
[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
|
||||
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>
|
||||
|
||||
|
||||
@@ -67,7 +67,7 @@ IBM AIX contains an unspecified vulnerability that would allow a locally authent
|
||||
- https://www.exploit-db.com/exploits/40709/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
- https://github.com/RhinoSecurityLabs/CVEs
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/40709
|
||||
@@ -115,6 +115,7 @@ Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allo
|
||||
- https://github.com/maur0amaya/Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow
|
||||
- https://github.com/ramahmdr/dirtycow
|
||||
- https://github.com/voidgguy/lenovo-a1000g-mt8317-A412_01_09_130907-kernel-3.4.0-root-cve-2016-5195
|
||||
- https://github.com/vudangducminh/CVE-2016-5195
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/40847
|
||||
|
||||
@@ -17,7 +17,7 @@ IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would
|
||||
- https://www.exploit-db.com/exploits/40710/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
- https://github.com/RhinoSecurityLabs/CVEs
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/40710
|
||||
@@ -16,7 +16,7 @@ IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using
|
||||
- https://www.exploit-db.com/exploits/40950/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
- https://github.com/RhinoSecurityLabs/CVEs
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/40950
|
||||
@@ -132,6 +132,7 @@ The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x be
|
||||
- https://github.com/smancke/CVE-2017-5638
|
||||
- https://github.com/btamburi/strutszeiro
|
||||
- https://github.com/xieyanran/Metasploit-Agent
|
||||
- https://github.com/ajhaigh/struts2-rce
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5638.yaml
|
||||
|
||||
@@ -237,6 +237,7 @@ A local privilege escalation vulnerability was found on polkit's pkexec utility.
|
||||
- https://github.com/tachote/CVE-2021-4034
|
||||
- https://github.com/usmansec/-CVE-2021-4034
|
||||
- https://github.com/iurhfiu6/CVE-2021-4034
|
||||
- https://github.com/r00t-byte/Pwnkit-CVE-2021-4034-LPE
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/50689
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
**scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -8,7 +8,8 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
**Xnio: stackoverflowexception when the chain of notifier states becomes problematically big**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -3,6 +3,12 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,6 +2,8 @@
|
||||
**net: hsr: must allocate more bytes for RedBox support**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -114,7 +114,6 @@ A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd).
|
||||
- https://github.com/jasonnorman66994-dot/sovereign-command-center
|
||||
- https://github.com/ptn1411/skill
|
||||
- https://github.com/Panche1/SSHPentest
|
||||
- https://github.com/zgzhang/cve-2024-6387-poc
|
||||
|
||||
#### ExploitDB
|
||||
- https://www.exploit-db.com/exploits/52269
|
||||
@@ -2,15 +2,16 @@
|
||||
**predictable WebSocket mask**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
|
||||
@@ -2,8 +2,8 @@
|
||||
**md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
### [CVE-2025-23367](https://www.cve.org/CVERecord?id=CVE-2025-23367)
|
||||
**Org.wildfly.core:wildfly-server: wildfly improper rbac permission**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -12,6 +12,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
**Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,11 +2,12 @@
|
||||
**Out of bounds read for cookie path**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16592](https://www.cve.org/CVERecord?id=CVE-2026-16592)
|
||||
**WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/aed24421-3bc6-4b36-bb61-d842d40d7c3c/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16593](https://www.cve.org/CVERecord?id=CVE-2026-16593)
|
||||
**WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/87379d9b-7d20-40c3-ab33-c3698bb59a51/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18232](https://www.cve.org/CVERecord?id=CVE-2026-18232)
|
||||
**WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/69d10ee3-0d36-47d1-b5bf-88b8516d99f4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -2,14 +2,15 @@
|
||||
**use after free in SMB connection reuse**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
### [CVE-2026-63769](https://www.cve.org/CVERecord?id=CVE-2026-63769)
|
||||
**Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method**
|
||||
**Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method**
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2026-64705](https://www.cve.org/CVERecord?id=CVE-2026-64705)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,6 +2,8 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,6 +2,9 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,6 +2,9 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -15,4 +15,4 @@ XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerabilit
|
||||
- https://github.com/BomboBombone/CVE-2026-73313
|
||||
|
||||
#### Github
|
||||
- https://github.com/BomboBombone/CVE-2026-73313
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -15,4 +15,4 @@ XenForo before 2.3.13 contains a missing authorization vulnerability in the forc
|
||||
- https://github.com/BomboBombone/CVE-2026-73318
|
||||
|
||||
#### Github
|
||||
- https://github.com/BomboBombone/CVE-2026-73318
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-82019](https://www.cve.org/CVERecord?id=CVE-2026-82019)
|
||||
**TripleLift video-bundle.js DOM-based XSS via postMessage**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to visit an attacker-controlled page that sends malicious postMessage events to a publisher page running the ad script, enabling session hijacking and unauthorized DOM manipulation.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hussein-mahmoud7.medium.com/cve-2026-82019-how-a-random-ad-led-to-dom-xss-while-testing-chess-com-f043584e1e68
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -2,12 +2,14 @@
|
||||
**incomplete mTLS config matching in conn reuse**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -195,7 +197,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
|
||||
@@ -14,6 +14,7 @@ A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build
|
||||
|
||||
#### Reference
|
||||
- https://github.com/KnCRJVirX/IDM_LPE_PoC/tree/main/poc
|
||||
- https://github.com/KnCRJVirX/IDM_LPE_PoC/blob/main/report_en.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90696](https://www.cve.org/CVERecord?id=CVE-2026-90696)
|
||||
**SourceCodester Inventory Management System Product Management products_handler.php cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/products_handler.php of the component Product Management Module. Executing a manipulation of the argument Product_Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/fhewm98/95f2ce47c88e1f08151397c0320d2752
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90697](https://www.cve.org/CVERecord?id=CVE-2026-90697)
|
||||
**SourceCodester Inventory Management System invoice.php authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/fhewm98/079112d415afa63ed1368a798a352665
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-90698](https://www.cve.org/CVERecord?id=CVE-2026-90698)
|
||||
**memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://protectiv.ph/research/memcached-asciiauth-empty-line-dos
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90699](https://www.cve.org/CVERecord?id=CVE-2026-90699)
|
||||
**D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/H3rmesk1t/vulnerability-paper/issues/9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90700](https://www.cve.org/CVERecord?id=CVE-2026-90700)
|
||||
**itsourcecode Sales and Inventory System pro_edit1.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. Such manipulation of the argument prodcode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/rooboot501/CVE-project/blob/main/sql/sql.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90701](https://www.cve.org/CVERecord?id=CVE-2026-90701)
|
||||
**subhajitkhan online-clinic-management-system listdoctor.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown function of the file listdoctor.php. Performing a manipulation of the argument searchtext results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/subhajitkhan/online-clinic-management-system/issues/2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90702](https://www.cve.org/CVERecord?id=CVE-2026-90702)
|
||||
**D-Link DWR-M921 formDiskFormat system os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/H3rmesk1t/1f7efbf4584ce13222e8b0c669e7784a
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90703](https://www.cve.org/CVERecord?id=CVE-2026-90703)
|
||||
**D-Link DWR-M921 formDiskCreateShare system os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argument folderpath leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/H3rmesk1t/24a09e799cd873abde6a2a806a030568
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90704](https://www.cve.org/CVERecord?id=CVE-2026-90704)
|
||||
**D-Link DWR-M921 formDiskPartition system command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/H3rmesk1t/2052767b9fb397e311c17383a0e19021
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90705](https://www.cve.org/CVERecord?id=CVE-2026-90705)
|
||||
**D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/H3rmesk1t/42bca7c81530b8419811ddcbd39b3b56
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90706](https://www.cve.org/CVERecord?id=CVE-2026-90706)
|
||||
**D-Link DWR-M921 formWsc os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/H3rmesk1t/f2d1f9115192b7af18699a8214a5b7ad
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-90708](https://www.cve.org/CVERecord?id=CVE-2026-90708)
|
||||
**Yot CMS Cookie global.php login sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3_user/yot3_pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/dddwmr/CVE/blob/main/YOT%20III%20cookie%20auto-login%20SQL%20injection%20enables%20forged%20administrator%20sessions%20.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-90709](https://www.cve.org/CVERecord?id=CVE-2026-90709)
|
||||
**Yot CMS Admin Console admin.php eval code injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/dddwmr/CVE/blob/main/YOT%20III%20modsys%3Aconsole%20admin%20eval%20of%20POST%20text%20leads%20to%20remote%20code%20execution.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90710](https://www.cve.org/CVERecord?id=CVE-2026-90710)
|
||||
**taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java of the component Theme Download Function. Executing a manipulation of the argument httpUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gitee.com/taisan/tarzan-cms/issues/IK768M
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,47 @@
|
||||
### [CVE-2026-90712](https://www.cve.org/CVERecord?id=CVE-2026-90712)
|
||||
**Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of service**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the component xAI OAuth Callback Handler. The manipulation of the argument Error leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Gitlawb/openclaude/issues/2101
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,46 @@
|
||||
### [CVE-2026-90713](https://www.cve.org/CVERecord?id=CVE-2026-90713)
|
||||
**vllm-project vLLM tiktoken vocab File mod.rs new denial of service**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/Yunzez/4b08ec3568a8cbfb120062e2558382b8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,25 @@
|
||||
### [CVE-2026-90714](https://www.cve.org/CVERecord?id=CVE-2026-90714)
|
||||
**marcobambini Gravity JSON parser gravity_json.c memory corruption**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/marcobambini/gravity/issues/448
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,26 @@
|
||||
### [CVE-2026-90715](https://www.cve.org/CVERecord?id=CVE-2026-90715)
|
||||
**marcobambini Gravity udp json-parser gravity_json.c integer overflow**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.8 mitigates this issue. The name of the patch is 9b337c3eae5833c3956bed1fc01c21c14fd443f2. Upgrading the affected component is recommended.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/marcobambini/gravity/issues/447
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,26 @@
|
||||
### [CVE-2026-90716](https://www.cve.org/CVERecord?id=CVE-2026-90716)
|
||||
**marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/marcobambini/gravity/issues/446
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,22 @@
|
||||
### [CVE-2026-90784](https://www.cve.org/CVERecord?id=CVE-2026-90784)
|
||||
**Dvidelabs flatcc semantics.c fb_clear_parser memory leak**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 8dbc3419738da066151991fd2bf1d0c85591dea2. It is suggested to install a patch to address this issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/dvidelabs/flatcc/issues/389
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-90785](https://www.cve.org/CVERecord?id=CVE-2026-90785)
|
||||
**Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f705032346ee39efd7d3848c50b73d455d28d06d. A patch should be applied to remediate this issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/dvidelabs/flatcc/issues/388
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-90786](https://www.cve.org/CVERecord?id=CVE-2026-90786)
|
||||
**Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertion**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the file src/compiler/semantics.c of the component Duplicate Symbol Handler. This manipulation causes reachable assertion. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 8b19ba4e992ebcad7f5970704d1afc5507fa5205. To fix this issue, it is recommended to deploy a patch.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/dvidelabs/flatcc/issues/387
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90787](https://www.cve.org/CVERecord?id=CVE-2026-90787)
|
||||
**Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Soarkey/StudentManagement/issues/35
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90788](https://www.cve.org/CVERecord?id=CVE-2026-90788)
|
||||
**magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/magicblack/maccms10/issues/1378
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90789](https://www.cve.org/CVERecord?id=CVE-2026-90789)
|
||||
**itsourcecode Leave Management System login.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument user_email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Relax-1626/submit/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90791](https://www.cve.org/CVERecord?id=CVE-2026-90791)
|
||||
**GPAC MP4Box base_scenegraph.c gf_node_unregister use after free**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to resolve this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Ech06/CVE_submit/blob/main/gpac_3801.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90792](https://www.cve.org/CVERecord?id=CVE-2026-90792)
|
||||
**GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Ech06/CVE_submit/blob/main/gpac_3802.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90793](https://www.cve.org/CVERecord?id=CVE-2026-90793)
|
||||
**GPAC MP4Box base_scenegraph.c gf_node_get_name use after free**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is recommended to address this issue. The name of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Ech06/CVE_submit/blob/main/gpac_3803.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90794](https://www.cve.org/CVERecord?id=CVE-2026-90794)
|
||||
**GPAC MP4Box vrml_tools.c gf_sg_script_load use after free**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is sufficient to fix this issue. The patch is named 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is advisable to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Ech06/CVE_submit/blob/main/gpac_3799.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90795](https://www.cve.org/CVERecord?id=CVE-2026-90795)
|
||||
**itsourcecode Loan Management System navbar.php cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ch4os4/re-function/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90796](https://www.cve.org/CVERecord?id=CVE-2026-90796)
|
||||
**itsourcecode Leave Management System index.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/lincenjun/submit/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90801](https://www.cve.org/CVERecord?id=CVE-2026-90801)
|
||||
**GNU Binutils ld cache.c cache_bwrite buffer overflow**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/r1ck9-2q/cve_summit/blob/main/Heap-buffer-overflow%20in%20%60cache_bwrite%60%20(bfdcache.c436)%20via%20malformed%20ELF%20with%20%60--gc-sections%20-w%60.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90802](https://www.cve.org/CVERecord?id=CVE-2026-90802)
|
||||
**GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/r1ck9-2q/cve_summit/blob/main/SEGV%20in%20%60bfd_putl64%60%20(bfdlibbfd.c989)%20during%20relocation%20output%20via%20malformed%20ELF.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90803](https://www.cve.org/CVERecord?id=CVE-2026-90803)
|
||||
**GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file bfd/elf64-x86-64.c of the component ld. Such manipulation of the argument roff leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 2.48 addresses this issue. The name of the patch is 471130b39c03623ec6d78ece377ff4da3f6bfe7b. It is recommended to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/r1ck9-2q/cve_summit/blob/main/Heap%20OOB%20readwrite%20and%20SEGV%20in%20%60elf_x86_64_relocate_section%60%20(bfdelf64-x86-64.c4530%20%204835)%20via%20malformed%20relocation.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90804](https://www.cve.org/CVERecord?id=CVE-2026-90804)
|
||||
**GNU Binutils Eh Frame Section elf-eh-frame.c _bfd_elf_write_section_eh_frame buffer overflow**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulation of the argument cie_length/fde_length/augmentation_data_size/write_offset results in buffer overflow. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/r1ck9-2q/cve_summit/blob/main/Heap%20OOB%20write%20%20negative-size%20%60memmove%60%20%20SEGV%20in%20%60_bfd_elf_write_section_eh_frame%60%20(bfdelf-eh-frame.c2064%20%202083%20%202193)%20via%20malformed%20%60.eh_frame%60.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90805](https://www.cve.org/CVERecord?id=CVE-2026-90805)
|
||||
**subhajitkhan online-clinic-management-system doctorlogin.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument doc_mail/doc_pswd can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/subhajitkhan/online-clinic-management-system/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,35 @@
|
||||
### [CVE-2026-90807](https://www.cve.org/CVERecord?id=CVE-2026-90807)
|
||||
**nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The exploit has been made public and could be used. The patch is identified as 3f9ed607b7e7a4872747295f75286f1c377d7c33. It is advisable to implement a patch to correct this issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/nanocoai/nanoclaw/issues/2828
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,32 @@
|
||||
### [CVE-2026-90810](https://www.cve.org/CVERecord?id=CVE-2026-90810)
|
||||
**cosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorization**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13. The impacted element is the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Command Permission Check. Performing a manipulation results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cosmicstack-labs/mercury-agent/issues/101
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-90811](https://www.cve.org/CVERecord?id=CVE-2026-90811)
|
||||
**cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Permission Manifest. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cosmicstack-labs/mercury-agent/issues/102
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-90812](https://www.cve.org/CVERecord?id=CVE-2026-90812)
|
||||
**cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission. The manipulation leads to incorrect privilege assignment. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cosmicstack-labs/mercury-agent/issues/80
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,32 @@
|
||||
### [CVE-2026-90813](https://www.cve.org/CVERecord?id=CVE-2026-90813)
|
||||
**cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cosmicstack-labs/mercury-agent/issues/95
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,31 @@
|
||||
### [CVE-2026-90814](https://www.cve.org/CVERecord?id=CVE-2026-90814)
|
||||
**cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cosmicstack-labs/mercury-agent/issues/81
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,44 @@
|
||||
### [CVE-2026-90815](https://www.cve.org/CVERecord?id=CVE-2026-90815)
|
||||
**FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-90818](https://www.cve.org/CVERecord?id=CVE-2026-90818)
|
||||
**netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/YLChen-007/e5f88777e7c50549fd98b23b2988f78d
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90824](https://www.cve.org/CVERecord?id=CVE-2026-90824)
|
||||
**GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/user-attachments/files/30398880/poc_08_add.zip
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90825](https://www.cve.org/CVERecord?id=CVE-2026-90825)
|
||||
**GPAC MP4Box base_scenegraph.c gf_node_unregister use after free**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/user-attachments/files/30399108/poc_09_add.zip
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90826](https://www.cve.org/CVERecord?id=CVE-2026-90826)
|
||||
**GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 can resolve this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/user-attachments/files/30400210/poc_19_nstatx.zip
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90827](https://www.cve.org/CVERecord?id=CVE-2026-90827)
|
||||
**GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in GPAC 26.07.0. This affects the function gf_node_deactivate_ex of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to mitigate this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/user-attachments/files/30400423/poc_20_nstatx.zip
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90828](https://www.cve.org/CVERecord?id=CVE-2026-90828)
|
||||
**GNU Binutils ELF Orphan Section ldelf.c elf_orphan_compatible null pointer dereference**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible of the file ld/ldelf.c of the component ELF Orphan Section Handler. Performing a manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sourceware.org/bugzilla/attachment.cgi?id=16882
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90829](https://www.cve.org/CVERecord?id=CVE-2026-90829)
|
||||
**GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sourceware.org/bugzilla/attachment.cgi?id=16883
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90830](https://www.cve.org/CVERecord?id=CVE-2026-90830)
|
||||
**GNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereference**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a bug report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sourceware.org/bugzilla/attachment.cgi?id=16884
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90831](https://www.cve.org/CVERecord?id=CVE-2026-90831)
|
||||
**GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the file bfd/elf-strtab.c of the component ELF String Table. The manipulation results in memory corruption. The attack requires a local approach. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sourceware.org/bugzilla/attachment.cgi?id=16886
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,38 @@
|
||||
### [CVE-2026-90835](https://www.cve.org/CVERecord?id=CVE-2026-90835)
|
||||
**michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/michaelliao/itranswarp/issues/74
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-90840](https://www.cve.org/CVERecord?id=CVE-2026-90840)
|
||||
**PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authentication**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/usernamevnq/CVEs/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90841](https://www.cve.org/CVERecord?id=CVE-2026-90841)
|
||||
**PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/usernamevnq/CVEs/issues/2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90842](https://www.cve.org/CVERecord?id=CVE-2026-90842)
|
||||
**PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/Login_Model.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext storage in a file or on disk. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/usernamevnq/CVEs/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90843](https://www.cve.org/CVERecord?id=CVE-2026-90843)
|
||||
**SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of the file functions_nmap.py of the component New Nmap Scan Handler. Such manipulation of the argument target/params leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 3d52f65803a2716bff14d938352c6fef45b0cfb6. A patch should be applied to remediate this issue. This issue got fixed with a silent patch.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://calledstriker.gitbook.io/blog/security-research/webmap
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90844](https://www.cve.org/CVERecord?id=CVE-2026-90844)
|
||||
**PHPGurukul Daily Expense Tracker System Login index.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/usernamevnq/CVEs/issues/4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90845](https://www.cve.org/CVERecord?id=CVE-2026-90845)
|
||||
**PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/usernamevnq/CVEs/issues/6
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90846](https://www.cve.org/CVERecord?id=CVE-2026-90846)
|
||||
**PHPGurukul Daily Expense Tracker System forgot-password.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/usernamevnq/CVEs/issues/8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90847](https://www.cve.org/CVERecord?id=CVE-2026-90847)
|
||||
**EFM ipTIME C200E System Setup iux_set.cgi os command injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://youtu.be/qdFGRSpCiY0
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90849](https://www.cve.org/CVERecord?id=CVE-2026-90849)
|
||||
**SourceCodester College Notes Gallery Management System login.php sql injection**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akaiwen/cve/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90850](https://www.cve.org/CVERecord?id=CVE-2026-90850)
|
||||
**PHPGurukul Hostel Management System manage-students.php cross site scripting**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/usernamevnq/CVEs/issues/9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90851](https://www.cve.org/CVERecord?id=CVE-2026-90851)
|
||||
**PHPGurukul Hostel Management System checklogin.php access control**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/usernamevnq/CVEs/issues/10
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90852](https://www.cve.org/CVERecord?id=CVE-2026-90852)
|
||||
**luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/luben/zstd-jni/issues/404
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-90856](https://www.cve.org/CVERecord?id=CVE-2026-90856)
|
||||
**SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.php of the component Registration Flow. Such manipulation of the argument role leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Andyov0/cve/issues/4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
Loaded 100 of 130 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user