diff --git a/README.md b/README.md index 40226fcd776..f4f6d6d2681 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-25%20Sep%202026%2007%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609250707)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C451-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C206-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609250707)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-25%20Sep%202026%2008%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609250807)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C452-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C206-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609250807)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,10 +12,10 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 2h ago | [CVE-2025-9974](https://github.com/HORKimhab/CVE-2025-9974) | The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows… | -| 1⭐ | 23h ago | [CVE-2025-7771](https://github.com/yulisec/CVE-2025-7771) | ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write… | +| 0⭐ | 3h ago | [CVE-2025-9974](https://github.com/HORKimhab/CVE-2025-9974) | The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows… | +| 0⭐ | 5h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | +| 1⭐ | 1d ago | [CVE-2025-7771](https://github.com/yulisec/CVE-2025-7771) | ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write… | | 0⭐ | 1d ago | [CVE-2026-87902](https://github.com/zer0dayf/CVE-2026-87902) | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable… | -| 0⭐ | 2d ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | | 2⭐ | 2d ago | [ghostlock-cve-2026-43499](https://github.com/gitchw/ghostlock-cve-2026-43499) | CVE-2026-43499 (GhostLock) - Linux kernel futex PI rt_mutex UAF ARM32 privilege escalation research targeting… | | 1⭐ | 3d ago | [CVE-2025-6325_CVE-2025-6327](https://github.com/JohenLastGen-JLG/CVE-2025-6325_CVE-2025-6327) | CVE-2025-6325 + CVE-2025-6327 - King Addons for Elementor <= 51.1.36 DUAL EXPLOIT PoC (Unauthenticated… | | 2⭐ | 4d ago | [CVE-2026-90817](https://github.com/murrez/CVE-2026-90817) | Unauth REDCap RCE (CVE-2026-90817) mass check PoC - requires public survey hash for full validation. | @@ -27,9 +27,9 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 9⭐ | 37m ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI Drone DUML Command Injection over Bluetooth - Proof of Concept for CVE-2026-78306 | -| 14⭐ | 7h ago | [CVE-2026-0073-PoC-Exploit](https://github.com/tc4dy/CVE-2026-0073-PoC-Exploit) | 🔓 CVE-2026-0073 - Android ADB Wireless Debugging Auth Bypass (CVSS 8.8) / Zero-click TLS type confusion to… | -| 4⭐ | 11h ago | KEV [watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127](https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127) | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious… | +| 9⭐ | 1h ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI Drone DUML Command Injection over Bluetooth - Proof of Concept for CVE-2026-78306 | +| 14⭐ | 8h ago | [CVE-2026-0073-PoC-Exploit](https://github.com/tc4dy/CVE-2026-0073-PoC-Exploit) | 🔓 CVE-2026-0073 - Android ADB Wireless Debugging Auth Bypass (CVSS 8.8) / Zero-click TLS type confusion to… | +| 4⭐ | 12h ago | KEV [watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127](https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127) | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious… | | 4⭐ | 1d ago | [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | | 25⭐ | 1d ago | [CVE-2026-84543](https://github.com/petermalone/CVE-2026-84543) | Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability | | 9⭐ | 1d ago | [CVE-2026-87902](https://github.com/vulpecuna/CVE-2026-87902) | Unauthenticated RCE on Wordpress | @@ -54,7 +54,7 @@ | --- | --- | --- | --- | | 7⭐ | 8d ago | KEV [CVE-2025-32432-exploit-by-P34NUT](https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT) | Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail | | 3⭐ | 28d ago | KEV [CVE-2025-3248-Langflow-RCE](https://github.com/hideki233/CVE-2025-3248-Langflow-RCE) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | -| 7⭐ | 28d ago | KEV [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… | +| 7⭐ | 29d ago | KEV [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… | | 6⭐ | 36d ago | KEV [cve-2025-21479_iqooneo8](https://github.com/Qingizi7/cve-2025-21479_iqooneo8) | Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables… | | 3⭐ | 38d ago | KEV [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案 | | 20⭐ | 45d ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W | @@ -64,7 +64,7 @@ | 3⭐ | 66d ago | [CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation](https://github.com/JM00NJ/CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation) | CVE-2025-6019: udisks2 XFS Resize TOCTOU Privilege Escalation | | 4⭐ | 67d ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads | | 4⭐ | 69d ago | KEV [CVE-2025-8110-gogs-poc](https://github.com/Shirouuu/CVE-2025-8110-gogs-poc) | PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink | -| 7⭐ | 78d ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… | +| 7⭐ | 79d ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… | | 4⭐ | 84d ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… | | 3⭐ | 84d ago | KEV [CVE-2025-57819](https://github.com/K3ysTr0K3R/CVE-2025-57819) | CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) | | 4⭐ | 89d ago | [CVE-2025-69212-PoC](https://github.com/tohib09/CVE-2025-69212-PoC) | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and… | diff --git a/cves/2026/CVE-2026-93399.md b/cves/2026/CVE-2026-93399.md new file mode 100644 index 00000000000..e425f142e64 --- /dev/null +++ b/cves/2026/CVE-2026-93399.md @@ -0,0 +1,18 @@ +### [CVE-2026-93399](https://www.cve.org/CVERecord?id=CVE-2026-93399) +**Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter** +![](https://img.shields.io/static/v1?label=Vendor&message=ladela&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Online%20Scheduling%20and%20Appointment%20Booking%20System%20%E2%80%93%20Bookly&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/murrez/CVE-2026-93399 diff --git a/docs/hero.svg b/docs/hero.svg index c5a8d95be0c..31cd72649f0 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 83,452 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 172,759 + fill="#e6edf3" letter-spacing="-0.5">172,760 CVES INDEXED83,451 + fill="#2f81f7" letter-spacing="-0.5">83,452 WITH POCS1,206 diff --git a/docs/social-card.svg b/docs/social-card.svg index 03d9dac709d..c4e2e31cd7e 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 172,759 + fill="#e6edf3" letter-spacing="-0.5">172,760 CVES INDEXED83,451 + fill="#2f81f7" letter-spacing="-0.5">83,452 WITH POCS1,206 diff --git a/docs/stats.json b/docs/stats.json index 88d8cad6111..4be937cf516 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1206, - "total_cves": 172759, - "with_pocs": 83451 + "total_cves": 172760, + "with_pocs": 83452 } diff --git a/index/github.txt b/index/github.txt index 5e0fdf8293c..8db2358480a 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26858,4 +26858,4 @@ CVE-2021-44228 - https://github.com/Is3x/cti-exploit-index CVE-2023-49070 - https://github.com/BardLaudian/CVE-2023-49070 CVE-2026-14281 - https://github.com/murrez/CVE-2026-14281 CVE-2026-89055 - https://github.com/murrez/CVE-2026-89055 -CVE-2026-93349 - https://github.com/SaiTeja-Erukude/CVE-2026-93349-frictionless-command-injection +CVE-2026-93399 - https://github.com/murrez/CVE-2026-93399 diff --git a/index/trending.json b/index/trending.json index c53a08857c5..38bda022ca2 100644 --- a/index/trending.json +++ b/index/trending.json @@ -484,6 +484,18 @@ "kev": false, "landed": true }, + { + "year": 2025, + "stars": 0, + "name": "CVE-2025-39964", + "url": "https://github.com/suominen/CVE-2025-39964", + "desc": "In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.", + "pushed": "2026-09-25T02:46:42Z", + "created": "2026-09-20T05:55:14Z", + "cve": "CVE-2025-39964", + "kev": true, + "landed": true + }, { "year": 2025, "stars": 1, @@ -508,18 +520,6 @@ "kev": false, "landed": true }, - { - "year": 2025, - "stars": 0, - "name": "CVE-2025-39964", - "url": "https://github.com/suominen/CVE-2025-39964", - "desc": "In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.", - "pushed": "2026-09-23T02:41:58Z", - "created": "2026-09-20T05:55:14Z", - "cve": "CVE-2025-39964", - "kev": true, - "landed": true - }, { "year": 2026, "stars": 2,