diff --git a/README.md b/README.md index c6b02025282..21be5fb2ba0 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-04%20Oct%202026%2017%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610041707)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-84%2C014-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C221-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610041707)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-04%20Oct%202026%2018%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610041807)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-84%2C015-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C221-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610041807)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,13 +12,13 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 7h ago | KEV [React2Shell_CVE-2025-55182](https://github.com/RashmithaDeSilva/React2Shell_CVE-2025-55182) | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0,… | -| 0⭐ | 18h ago | [CVE-2025-60787](https://github.com/diamorphine666/CVE-2025-60787) | MotionEye OS Command Injection (CVE-2025-60787) | -| 0⭐ | 23h ago | [CVE-2025-21065](https://github.com/Pealeap/CVE-2025-21065) | A PoC for CVE-2025-21065 that allows any self-attacker to execute commands with Retail Mode privileges (UID… | +| 0⭐ | 8h ago | KEV [React2Shell_CVE-2025-55182](https://github.com/RashmithaDeSilva/React2Shell_CVE-2025-55182) | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0,… | +| 0⭐ | 19h ago | [CVE-2025-60787](https://github.com/diamorphine666/CVE-2025-60787) | MotionEye OS Command Injection (CVE-2025-60787) | +| 0⭐ | 1d ago | [CVE-2025-21065](https://github.com/Pealeap/CVE-2025-21065) | A PoC for CVE-2025-21065 that allows any self-attacker to execute commands with Retail Mode privileges (UID… | | 0⭐ | 2d ago | [CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE](https://github.com/kevenpanchal/CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE) | GLPI is a free asset and IT management software package. An authenticated user can upload and force the… | | 0⭐ | 2d ago | [CVE-2025-47947](https://github.com/yel1337/CVE-2025-47947) | POC for libapache2-mod-security2 | | 0⭐ | 3d ago | KEV [CVE-2025-8110](https://github.com/Makis6/CVE-2025-8110) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | -| 1⭐ | 3d ago | [CVE-2025-29927](https://github.com/vulnace/CVE-2025-29927) | POC for react2shell | +| 1⭐ | 4d ago | [CVE-2025-29927](https://github.com/vulnace/CVE-2025-29927) | POC for react2shell | | 0⭐ | 4d ago | [CVE-2025-59528-Poc](https://github.com/Amoru-Bek/CVE-2025-59528-Poc) | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,… | | 1⭐ | 4d ago | KEV [CVE-2025-31161](https://github.com/0xBlackash/CVE-2025-31161) | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin… | | 0⭐ | 4d ago | [cve-2025-30208](https://github.com/Minseo9503/cve-2025-30208) | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2,… | @@ -27,8 +27,8 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 4⭐ | 19h ago | [cve-2026-103956-loom-unauth](https://github.com/abraxas/cve-2026-103956-loom-unauth) | CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is… | -| 51⭐ | 1d ago | KEV [cve-2026-41940-PoC](https://github.com/yasouxken/cve-2026-41940-PoC) | A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing… | +| 4⭐ | 20h ago | [cve-2026-103956-loom-unauth](https://github.com/abraxas/cve-2026-103956-loom-unauth) | CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is… | +| 61⭐ | 1d ago | KEV [cve-2026-41940-PoC](https://github.com/yasouxken/cve-2026-41940-PoC) | A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing… | | 825⭐ | 1d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 3⭐ | 2d ago | [CVE-2026-40281-exploit](https://github.com/MRdark-ops/CVE-2026-40281-exploit) | Gotenberg 8.30.1 unauthenticated RCE exploit | | 4⭐ | 2d ago | [CVE-2026-100520-laranode-path-traversal](https://github.com/wvllxe/CVE-2026-100520-laranode-path-traversal) | Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup. | diff --git a/cves/2026/CVE-2026-83627.md b/cves/2026/CVE-2026-83627.md new file mode 100644 index 00000000000..3343d1cf9bb --- /dev/null +++ b/cves/2026/CVE-2026-83627.md @@ -0,0 +1,18 @@ +### [CVE-2026-83627](https://www.cve.org/CVERecord?id=CVE-2026-83627) +**Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log** +![](https://img.shields.io/static/v1?label=Vendor&message=wpmudev&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Hummingbird%20Performance%20%E2%80%93%20Cache%20%26%20Page%20Speed%20Optimization%20for%20Core%20Web%20Vitals%20%7C%20Critical%20CSS%20%7C%20Minify%20CSS%20%7C%20Defer%20CSS%20Javascript%20%7C%20CDN&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%20Improper%20Control%20of%20Generation%20of%20Code%20%28%27Code%20Injection%27%29&color=brightgreen) + +### Description + +The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be created during a front-end request — a state reached by the plugin's own 'Clear logs' action, any cache flush, or unattended via the plugin's daily log-rotation cron, which can strip the protective header from an existing log file. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/K52-ai/CVE-2026-83627 diff --git a/docs/hero.svg b/docs/hero.svg index d2e5168f0b3..0e9244580de 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 84,015 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 173,328 + fill="#e6edf3" letter-spacing="-0.5">173,329 CVES INDEXED84,014 + fill="#2f81f7" letter-spacing="-0.5">84,015 WITH POCS1,221 diff --git a/docs/social-card.svg b/docs/social-card.svg index bb92be4181d..10ac43dd36e 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 173,328 + fill="#e6edf3" letter-spacing="-0.5">173,329 CVES INDEXED84,014 + fill="#2f81f7" letter-spacing="-0.5">84,015 WITH POCS1,221 diff --git a/docs/stats.json b/docs/stats.json index 8cad7857ccb..268683ebdbf 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1221, - "total_cves": 173328, - "with_pocs": 84014 + "total_cves": 173329, + "with_pocs": 84015 } diff --git a/index/github.txt b/index/github.txt index 5da4a7c52bc..f912838e55e 100644 --- a/index/github.txt +++ b/index/github.txt @@ -27171,3 +27171,4 @@ CVE-2025-55182 - https://github.com/RashmithaDeSilva/React2Shell_CVE-2025-55182 CVE-2026-19632 - https://github.com/TheJesterrrr/CVE-2026-19632 CVE-2026-96451 - https://github.com/Nxploited/CVE-2026-96451 CVE-2026-104991 - https://github.com/wvllxe/CVE-2026-104991 +CVE-2026-83627 - https://github.com/K52-ai/CVE-2026-83627 diff --git a/index/trending.json b/index/trending.json index a0f7cac7d22..072dec48104 100644 --- a/index/trending.json +++ b/index/trending.json @@ -12,7 +12,7 @@ }, { "year": 2026, - "stars": 51, + "stars": 61, "name": "cve-2026-41940-PoC", "url": "https://github.com/yasouxken/cve-2026-41940-PoC", "desc": "A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header - no credentials required.",