mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
Update CVE PoCs 2026-10-09
This commit is contained in:
CVE-BOT committed
1 parent
b4e4411663
commit
d110bafef7
112 files changed
+1614
-28
No files matched your search
@@ -1,3 +1,3 @@
|
||||
{
|
||||
"cvelist_fetch_time": "2026-10-06T19:00:02.836Z"
|
||||
"cvelist_fetch_time": "2026-10-09T09:03:30.675Z"
|
||||
}
|
||||
@@ -1,8 +1,8 @@
|
||||
<div align="center">
|
||||
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=173643-84196-1225" alt="PoC Index" width="100%"></a>
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=173720-84275-1225" alt="PoC Index" width="100%"></a>
|
||||
|
||||
[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
|
||||
[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
|
||||
|
||||
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>
|
||||
|
||||
|
||||
@@ -95,6 +95,7 @@ vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which
|
||||
- https://github.com/zainezw/metasploitable2-vsftpd-exploit
|
||||
- https://github.com/sagarjain0456/Metasploit-Project-using-KaliLinux-plus-Metasploitable2-VMs
|
||||
- https://github.com/Maalfer/vsftpd-2.3.4-exploit
|
||||
- https://github.com/HibaShaik13/Task4-Exploitation-SystemSecurity
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2011/CVE-2011-2523.yaml
|
||||
|
||||
@@ -13,5 +13,5 @@ golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to c
|
||||
No PoCs from references.
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
- https://github.com/patrickdevsec/chainguard-exploit-demo
|
||||
|
||||
@@ -194,6 +194,7 @@ A flaw was found in a change made to path normalization in Apache HTTP Server 2.
|
||||
- https://github.com/MrFrost232/binary-exploitation-labs
|
||||
- https://github.com/luisito666/Whitehat-agent
|
||||
- https://github.com/s-amnajafri/CVE-2021-41773-Apache-Lab/blob/d7bb533447fa4195965501fd11bc4600e454d386/exploit/exploit.py
|
||||
- https://github.com/LordX404/CVE_2021-41773
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41773.yaml
|
||||
|
||||
@@ -467,6 +467,7 @@ Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12
|
||||
- https://github.com/ckiellandpanw/brokenbank
|
||||
- https://github.com/Is3x/cti-exploit-index
|
||||
- https://github.com/domanhcuongkent1991-blip/security-tool
|
||||
- https://github.com/ResoluteRacoons/log4-Java-logging-poc
|
||||
|
||||
#### Nuclei
|
||||
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44228.yaml
|
||||
|
||||
@@ -15,5 +15,5 @@ An attacker may cause a denial of service by crafting an Accept-Language header
|
||||
No PoCs from references.
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
- https://github.com/patrickdevsec/chainguard-exploit-demo
|
||||
|
||||
@@ -15,5 +15,5 @@ The filename parameter of the Context.FileAttachment function is not properly sa
|
||||
- https://github.com/gin-gonic/gin/issues/3555
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
- https://github.com/patrickdevsec/chainguard-exploit-demo
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
**Jberet: jberet-core logging database credentials**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -18,7 +18,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -29,12 +28,10 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,9 +2,9 @@
|
||||
**Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-15700](https://www.cve.org/CVERecord?id=CVE-2025-15700)
|
||||
**AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6d3e7721-41d4-4e5f-9a44-c601f0cdfe50/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -34,7 +34,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -35,7 +35,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
### [CVE-2025-5154](https://www.cve.org/CVERecord?id=CVE-2025-5154)
|
||||
**PhonePe App SQLite Database databases cleartext storage in a file or on disk**
|
||||
**PhonePe App SQLite Database databases cleartext storage in file**
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -33,7 +33,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -5,7 +5,13 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -24,7 +24,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103309](https://www.cve.org/CVERecord?id=CVE-2026-103309)
|
||||
**GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e791e349-932b-4e59-bacb-a49b57343cf3/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103323](https://www.cve.org/CVERecord?id=CVE-2026-103323)
|
||||
**Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f1859c64-e1d1-4efc-9f34-15d1f4aa3311/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103378](https://www.cve.org/CVERecord?id=CVE-2026-103378)
|
||||
**Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers to retrieve the key and use it to modify WooCommerce order statuses. The same log file also exposes customer information from orders the shop has processed.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f95d8558-2225-416c-8968-752a40cdc17f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103517](https://www.cve.org/CVERecord?id=CVE-2026-103517)
|
||||
**Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/17179c6d-32e0-4a22-88b4-9768a5f36365/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103646](https://www.cve.org/CVERecord?id=CVE-2026-103646)
|
||||
**Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know.
|
||||
This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a05da0ad-5d92-406f-b182-b3ed1f8389f3/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103681](https://www.cve.org/CVERecord?id=CVE-2026-103681)
|
||||
**Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/33674814-6329-4833-8d9a-3cca80dd5a14/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103692](https://www.cve.org/CVERecord?id=CVE-2026-103692)
|
||||
**Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d2341538-77fa-48a0-83e3-bc9a3818276c/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104049](https://www.cve.org/CVERecord?id=CVE-2026-104049)
|
||||
**Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of paid or private courses they are not enrolled in.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/277f48d0-c5e8-4790-ada6-51050d308217/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104050](https://www.cve.org/CVERecord?id=CVE-2026-104050)
|
||||
**Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/cb3393ad-4f50-4907-a7d4-1226126f76c2/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104645](https://www.cve.org/CVERecord?id=CVE-2026-104645)
|
||||
**Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/fe1a3c33-637c-426c-91f8-8b15f556b4b2/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104646](https://www.cve.org/CVERecord?id=CVE-2026-104646)
|
||||
**Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d5ba5fe5-aec0-4df3-b990-775358c3e80a/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104651](https://www.cve.org/CVERecord?id=CVE-2026-104651)
|
||||
**Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/be0e4e18-0bd7-455a-93f6-8f4a7f18b7e1/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104652](https://www.cve.org/CVERecord?id=CVE-2026-104652)
|
||||
**Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/bbeb86c6-201e-4d43-9290-ee75f8c0e296/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104653](https://www.cve.org/CVERecord?id=CVE-2026-104653)
|
||||
**Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6fba4124-edb1-4363-8ad9-4aa77e1b3890/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104667](https://www.cve.org/CVERecord?id=CVE-2026-104667)
|
||||
**Animated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/ccaedf47-6a6b-429b-aae9-3b4254181dd9/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104671](https://www.cve.org/CVERecord?id=CVE-2026-104671)
|
||||
**TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6ecea67e-8019-4ef2-bd27-a9da7dc27d43/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104677](https://www.cve.org/CVERecord?id=CVE-2026-104677)
|
||||
**WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/2e730bf3-ebf9-4c0d-bb05-8ca94c7cab60/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104678](https://www.cve.org/CVERecord?id=CVE-2026-104678)
|
||||
**CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin before 1.3.4 option that should require administrator access.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d650ea4e-62f9-48a0-8cb3-e6761a95eeaa/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104953](https://www.cve.org/CVERecord?id=CVE-2026-104953)
|
||||
**MPG < 4.2.3 - Editor+ SQLi via Project Import**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e0b17720-b055-4d90-b0fa-68911274dafa/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-105110](https://www.cve.org/CVERecord?id=CVE-2026-105110)
|
||||
**Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/BlackHatExploitation/innbox_root
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105190](https://www.cve.org/CVERecord?id=CVE-2026-105190)
|
||||
**Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d167e184-af71-4ff8-8a2d-a665f7539fe4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105193](https://www.cve.org/CVERecord?id=CVE-2026-105193)
|
||||
**Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/c6a81cf3-095d-4d7e-83c5-80f44327e7fe/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105194](https://www.cve.org/CVERecord?id=CVE-2026-105194)
|
||||
**Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/aa49b193-8409-436f-a034-70b166afc483/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105195](https://www.cve.org/CVERecord?id=CVE-2026-105195)
|
||||
**Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/9d6e9047-410e-4d3d-81f0-e3f89cf7a494/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105196](https://www.cve.org/CVERecord?id=CVE-2026-105196)
|
||||
**LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/b7b6c989-b484-4ad6-844c-1dec1c74c34d/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105197](https://www.cve.org/CVERecord?id=CVE-2026-105197)
|
||||
**LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff and outside their assigned scope.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/05f690b9-8696-4e73-8f42-f6964db3d092/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105198](https://www.cve.org/CVERecord?id=CVE-2026-105198)
|
||||
**LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/736056ca-5825-4cb7-8775-4010efe1f7cd/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105260](https://www.cve.org/CVERecord?id=CVE-2026-105260)
|
||||
**Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafted page.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/532d21c1-448f-422d-8d58-a76e9cff99e4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105316](https://www.cve.org/CVERecord?id=CVE-2026-105316)
|
||||
**Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/8240033a-bb4b-490f-97da-4ae768d2cb6d/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105322](https://www.cve.org/CVERecord?id=CVE-2026-105322)
|
||||
**Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/3adcac09-7e0f-4a43-90bd-58952aef80dd/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-106095](https://www.cve.org/CVERecord?id=CVE-2026-106095)
|
||||
**Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite network to activate, deactivate and reprioritise network-scoped snippets that run across every site in the network.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/4aeddbb6-d7a9-48cb-96ea-5898586bce04/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-106097](https://www.cve.org/CVERecord?id=CVE-2026-106097)
|
||||
**Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f5206366-2e9c-42d5-90b9-ddfaf39aa02f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,25 @@
|
||||
### [CVE-2026-107166](https://www.cve.org/CVERecord?id=CVE-2026-107166)
|
||||
**Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 9ffc252482d9b03ac01abcedbe95497ff4f95dd0. It is recommended to apply a patch to fix this issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/open5gs/open5gs/issues/4792
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-107181](https://www.cve.org/CVERecord?id=CVE-2026-107181)
|
||||
**Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-107269](https://www.cve.org/CVERecord?id=CVE-2026-107269)
|
||||
**Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-107270](https://www.cve.org/CVERecord?id=CVE-2026-107270)
|
||||
**Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-107271](https://www.cve.org/CVERecord?id=CVE-2026-107271)
|
||||
**Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-107272](https://www.cve.org/CVERecord?id=CVE-2026-107272)
|
||||
**Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view campaign results or send test emails, stealing API keys.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-107273](https://www.cve.org/CVERecord?id=CVE-2026-107273)
|
||||
**Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -44,3 +44,4 @@ No PoCs from references.
|
||||
|
||||
#### Github
|
||||
- https://github.com/techupdate24/citrix-netscaler-rce-cve-2026-107406
|
||||
- https://github.com/ApexBreach/CVE-2026-107406-Poc
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107449](https://www.cve.org/CVERecord?id=CVE-2026-107449)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/kashishtopi/heimdall-unauth-ssrf
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-107450](https://www.cve.org/CVERecord?id=CVE-2026-107450)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/kashishtopi/stump-smartlist-bola
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-107640](https://www.cve.org/CVERecord?id=CVE-2026-107640)
|
||||
**Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.enablesecurity.com/advisories/ES2026-06-enswitch-password-reset-bypass/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-107695](https://www.cve.org/CVERecord?id=CVE-2026-107695)
|
||||
**FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-107696](https://www.cve.org/CVERecord?id=CVE-2026-107696)
|
||||
**FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-107707](https://www.cve.org/CVERecord?id=CVE-2026-107707)
|
||||
**Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://blog.quarkslab.com/milking-the-last-drop-of-intego-time-for-windows-to-get-its-lpe.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-11318](https://www.cve.org/CVERecord?id=CVE-2026-11318)
|
||||
**Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Cr0wld3r/CVE-2026-11318
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-1403](https://www.cve.org/CVERecord?id=CVE-2026-1403)
|
||||
**Allocation of Resources Without Limits or Throttling in GitLab**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file structure.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hackerone.com/reports/3328937
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -26,7 +26,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-82211](https://www.cve.org/CVERecord?id=CVE-2026-82211)
|
||||
**Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/c1ab38b4-2445-4a56-a47e-aab2b8e8de1e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-82212](https://www.cve.org/CVERecord?id=CVE-2026-82212)
|
||||
**Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/66df6adb-336c-4660-9a63-5e6e550a2edb/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-84220](https://www.cve.org/CVERecord?id=CVE-2026-84220)
|
||||
**Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e5cfd004-dd57-4d42-858c-fbb9b9e320f6/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-84224](https://www.cve.org/CVERecord?id=CVE-2026-84224)
|
||||
**Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6a2455dd-8da9-4c7e-a249-3c694cf2983e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -17,3 +17,4 @@ A vulnerability was determined in projectworlds Online Examination System 1.0. T
|
||||
|
||||
#### Github
|
||||
- https://github.com/CyberShailendra1/Online-Examination-System-Project
|
||||
- https://github.com/CyberShailendra/Online-Examination-System-Project
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86816](https://www.cve.org/CVERecord?id=CVE-2026-86816)
|
||||
**WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e644bbb2-aae7-4f7a-baf7-34e578bcee2a/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86826](https://www.cve.org/CVERecord?id=CVE-2026-86826)
|
||||
**BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/ee9f0772-ac6f-4e2d-a2c0-cc8892291932/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86827](https://www.cve.org/CVERecord?id=CVE-2026-86827)
|
||||
**BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/c7785a5b-f580-416f-a23d-58c28c717b60/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86828](https://www.cve.org/CVERecord?id=CVE-2026-86828)
|
||||
**BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/be8c0eab-1874-4490-b94e-394f62a522f3/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86833](https://www.cve.org/CVERecord?id=CVE-2026-86833)
|
||||
**MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6d6850d6-6fdf-4b97-9ccb-c90f9ed01ab0/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86850](https://www.cve.org/CVERecord?id=CVE-2026-86850)
|
||||
**SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/889aaa2a-ad05-423a-a601-70ac1d8b7920/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-87782](https://www.cve.org/CVERecord?id=CVE-2026-87782)
|
||||
**Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/0f3af398-4a70-4987-9da8-b876b9e932c7/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-87841](https://www.cve.org/CVERecord?id=CVE-2026-87841)
|
||||
**UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f04babb4-2dee-4c41-8b4c-0c2428009180/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-87971](https://www.cve.org/CVERecord?id=CVE-2026-87971)
|
||||
**If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f03cb198-7d64-4405-9c2c-5342f24deb4f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-88931](https://www.cve.org/CVERecord?id=CVE-2026-88931)
|
||||
**Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e1341110-abad-47f5-aed5-1c06cb0c8071/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-9209](https://www.cve.org/CVERecord?id=CVE-2026-9209)
|
||||
**mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.sprocketsecurity.com/blog/cve-2026-9209-pre-authentication-sql-injection-to-remote-code-execution-in-mjobtime
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-92989](https://www.cve.org/CVERecord?id=CVE-2026-92989)
|
||||
**SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/771aeab9-2bd2-4d77-b3b8-9fdfb651507f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-92990](https://www.cve.org/CVERecord?id=CVE-2026-92990)
|
||||
**SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/595c6a6b-d346-4ed4-9a4e-674d90a35e74/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-93509](https://www.cve.org/CVERecord?id=CVE-2026-93509)
|
||||
**Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a31138af-234e-44c8-bced-9058553a8b81/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-93548](https://www.cve.org/CVERecord?id=CVE-2026-93548)
|
||||
**FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/7d9238eb-f56e-49db-a804-7505f59fca5c/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-94244](https://www.cve.org/CVERecord?id=CVE-2026-94244)
|
||||
**Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/991f28f3-9cd8-4918-8431-a063eb2ba536/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-94245](https://www.cve.org/CVERecord?id=CVE-2026-94245)
|
||||
**Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/fd44c88d-2ca4-4e3d-9e9f-570e239df4bd/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-94246](https://www.cve.org/CVERecord?id=CVE-2026-94246)
|
||||
**Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/20949357-8fe6-4151-88b8-15abdef292cb/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-94258](https://www.cve.org/CVERecord?id=CVE-2026-94258)
|
||||
**SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network.
|
||||
This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/25af3225-3b4b-4882-9af8-ab24597f9be2/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-94275](https://www.cve.org/CVERecord?id=CVE-2026-94275)
|
||||
**Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/0037e6ef-5163-4508-9eef-3173a3951fcc/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,16 @@
|
||||
### [CVE-2026-95210](https://www.cve.org/CVERecord?id=CVE-2026-95210)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/lkloliver/poc/tree/main/CVE-2026-95210
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-96530](https://www.cve.org/CVERecord?id=CVE-2026-96530)
|
||||
**Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/2153d029-a16d-4b8c-b232-6629a6abf34b/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-97188](https://www.cve.org/CVERecord?id=CVE-2026-97188)
|
||||
**String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/cfb495ac-32fc-43e2-81b4-74faa8c164a4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-97331](https://www.cve.org/CVERecord?id=CVE-2026-97331)
|
||||
**User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e61799b5-1ea7-407b-9303-4b828bb5e5f5/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-97354](https://www.cve.org/CVERecord?id=CVE-2026-97354)
|
||||
**PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects**
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/473239c2-0b66-466b-98ac-391dad2853b9/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
+3
-3
@@ -1,5 +1,5 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="180" viewBox="0 0 1200 180"
|
||||
role="img" aria-label="PoC Index, 84,196 CVEs with public proof-of-concept exploits">
|
||||
role="img" aria-label="PoC Index, 84,275 CVEs with public proof-of-concept exploits">
|
||||
<clipPath id="card"><rect x="1" y="1" width="1198" height="178" rx="12"/></clipPath>
|
||||
<rect x="0.5" y="0.5" width="1199" height="179" rx="12" fill="#0d1117" stroke="#30363d"/>
|
||||
<g clip-path="url(#card)" opacity="0.6"><g>
|
||||
@@ -19,10 +19,10 @@
|
||||
<text x="56" y="132" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="15" fill="#2f81f7">pocindex.io</text>
|
||||
|
||||
<text x="620" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
|
||||
fill="#e6edf3" letter-spacing="-0.5">173,643</text>
|
||||
fill="#e6edf3" letter-spacing="-0.5">173,720</text>
|
||||
<text x="620" y="117" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="12"
|
||||
fill="#6e7681" letter-spacing="1.6">CVES INDEXED</text><text x="840" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
|
||||
fill="#2f81f7" letter-spacing="-0.5">84,196</text>
|
||||
fill="#2f81f7" letter-spacing="-0.5">84,275</text>
|
||||
<text x="840" y="117" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="12"
|
||||
fill="#6e7681" letter-spacing="1.6">WITH POCS</text><text x="1010" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
|
||||
fill="#f85149" letter-spacing="-0.5">1,225</text>
|
||||
|
||||
|
Before Width: | Height: | Size: 2.6 KiB After Width: | Height: | Size: 2.6 KiB |
@@ -20,10 +20,10 @@
|
||||
|
||||
<rect x="96" y="344" width="1088" height="1" fill="#30363d"/>
|
||||
<text x="96" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
|
||||
fill="#e6edf3" letter-spacing="-0.5">173,643</text>
|
||||
fill="#e6edf3" letter-spacing="-0.5">173,720</text>
|
||||
<text x="96" y="459" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="16"
|
||||
fill="#6e7681" letter-spacing="1.6">CVES INDEXED</text><text x="500" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
|
||||
fill="#2f81f7" letter-spacing="-0.5">84,196</text>
|
||||
fill="#2f81f7" letter-spacing="-0.5">84,275</text>
|
||||
<text x="500" y="459" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="16"
|
||||
fill="#6e7681" letter-spacing="1.6">WITH POCS</text><text x="880" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
|
||||
fill="#f85149" letter-spacing="-0.5">1,225</text>
|
||||
|
||||
|
Before Width: | Height: | Size: 2.7 KiB After Width: | Height: | Size: 2.7 KiB |
Loaded 100 of 112 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user