From fd5dd2b2ac10e96cc6ddd2ae23da118d1b4e0917 Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Sat, 3 Oct 2026 19:09:34 +0000 Subject: [PATCH] Trending CVEs update 2026-10-03 19:09 :robot: --- README.md | 14 +++++++------- cves/2026/CVE-2026-60137.md | 1 + cves/2026/CVE-2026-63030.md | 1 + index/github.txt | 2 ++ index/trending.json | 2 +- 5 files changed, 12 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index bb7af196bf6..20562b7e443 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-03%20Oct%202026%2018%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610031807)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C965-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C220-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610031807)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-03%20Oct%202026%2019%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610031907)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C965-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C220-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610031907)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,9 +12,9 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 6m ago | [CVE-2025-21065](https://github.com/Pealeap/CVE-2025-21065) | A PoC for CVE-2025-21065 that allows any self-attacker to execute commands with Retail Mode privileges (UID… | +| 0⭐ | 1h ago | [CVE-2025-21065](https://github.com/Pealeap/CVE-2025-21065) | A PoC for CVE-2025-21065 that allows any self-attacker to execute commands with Retail Mode privileges (UID… | | 0⭐ | 1d ago | [CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE](https://github.com/kevenpanchal/CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE) | GLPI is a free asset and IT management software package. An authenticated user can upload and force the… | -| 0⭐ | 1d ago | [CVE-2025-47947](https://github.com/yel1337/CVE-2025-47947) | POC for libapache2-mod-security2 | +| 0⭐ | 2d ago | [CVE-2025-47947](https://github.com/yel1337/CVE-2025-47947) | POC for libapache2-mod-security2 | | 0⭐ | 2d ago | KEV [CVE-2025-8110](https://github.com/Makis6/CVE-2025-8110) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | | 1⭐ | 3d ago | [CVE-2025-29927](https://github.com/vulnace/CVE-2025-29927) | POC for react2shell | | 0⭐ | 3d ago | [CVE-2025-59528-Poc](https://github.com/Amoru-Bek/CVE-2025-59528-Poc) | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,… | @@ -27,13 +27,13 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 825⭐ | 1h ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | +| 825⭐ | 2h ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 3⭐ | 3d ago | KEV [CVE-2026-87902](https://github.com/tonydelouvre/CVE-2026-87902) | XWP_RCE - CVE-2026-87902 Hacker Console | | 4⭐ | 4d ago | KEV [CVE-2026-41091-PoC-Exploit](https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit) | CVE-2026-41091 RedSun / Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM - via… | | 29⭐ | 4d ago | [CVE-2026-54121-PoC-Exploit](https://github.com/tc4dy/CVE-2026-54121-PoC-Exploit) | CVE-2026-54121 - CertiGhost AD CS Multi-Exploit Framework / Rogue DC + LDAP spoofing, certificate abuse,… | | 7⭐ | 4d ago | KEV [CVE-2026-24061-PoC-Exploit](https://github.com/tc4dy/CVE-2026-24061-PoC-Exploit) | CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON… | | 6⭐ | 4d ago | KEV [watchTowr-vs-Citrix-Netscaler-CVE-2026-88772](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772) | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before… | -| 44⭐ | 4d ago | [CVE-2026-94545](https://github.com/EQSTLab/CVE-2026-94545) | Next.js RCE | +| 45⭐ | 4d ago | [CVE-2026-94545](https://github.com/EQSTLab/CVE-2026-94545) | Next.js RCE | | 3⭐ | 4d ago | KEV [CVE-2026-49869](https://github.com/EQSTLab/CVE-2026-49869) | Kestra Unauthenticated RCE | | 3⭐ | 5d ago | [CVE-2026-56096](https://github.com/yairHinkis/CVE-2026-56096) | Proof of Concept and Write-up for CVE-2026-56096 (Blind Parameter Injection in TYPO3 EXT:solr) | | 23⭐ | 5d ago | KEV [watchTowr-vs-Citrix-Netscaler-CVE-2026-88771](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771) | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue… | @@ -42,7 +42,7 @@ | 17⭐ | 5d ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | | 13⭐ | 5d ago | KEV [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… | | 29⭐ | 5d ago | [CVE-2026-34990](https://github.com/predyy/CVE-2026-34990) | CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. | -| 13⭐ | 5d ago | [CVE-2026-28695](https://github.com/predyy/CVE-2026-28695) | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. | +| 13⭐ | 6d ago | [CVE-2026-28695](https://github.com/predyy/CVE-2026-28695) | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. | | 3⭐ | 6d ago | [mediawiki-CVE-2026-100382](https://github.com/nth347/mediawiki-CVE-2026-100382) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in… | | 5⭐ | 6d ago | [opace6-cve-2026-64560](https://github.com/qingle009/opace6-cve-2026-64560) | OnePlus Ace 6 temporary root tool (CVE-2026-64560) - device-verified port with corrected bootidParent address | | 3⭐ | 6d ago | [CVE-2026-48842](https://github.com/4minx/CVE-2026-48842) | CVE-2026-48842 PoC - Roundcube virtuser_query pre-auth SQLi | @@ -74,7 +74,7 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 17⭐ | 9h ago | [CVE-2024-56426](https://github.com/Creeeeger/CVE-2024-56426) | A PoC of the CVE-2024-56426 vulnerability. | +| 17⭐ | 10h ago | [CVE-2024-56426](https://github.com/Creeeeger/CVE-2024-56426) | A PoC of the CVE-2024-56426 vulnerability. | | 4⭐ | 49d ago | [CVE-2024-56426](https://github.com/xcracker000/CVE-2024-56426) | CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F | | 3⭐ | 65d ago | [CVE-2024-36104-PoC](https://github.com/Groppoxx/CVE-2024-36104-PoC) | PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path… | diff --git a/cves/2026/CVE-2026-60137.md b/cves/2026/CVE-2026-60137.md index c17d80098b0..afb1d3b8649 100644 --- a/cves/2026/CVE-2026-60137.md +++ b/cves/2026/CVE-2026-60137.md @@ -65,6 +65,7 @@ No PoCs from references. - https://github.com/arvindear/wp2shell-PoC - https://github.com/MRdark-ops/WP2Shell--CVE-2026-63030-CVE-2026-60137- - https://github.com/pedroMPMartins/wordpress_exploit +- https://github.com/hitechcloud-vietnam/wp2shell-PoC #### Metasploit - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb diff --git a/cves/2026/CVE-2026-63030.md b/cves/2026/CVE-2026-63030.md index bd0d6052e47..90cfac8df5b 100644 --- a/cves/2026/CVE-2026-63030.md +++ b/cves/2026/CVE-2026-63030.md @@ -83,6 +83,7 @@ No PoCs from references. - https://github.com/jed-parsec/CVE-2026-63030-60137-wp2shell-lab - https://github.com/MRdark-ops/WP2Shell--CVE-2026-63030-CVE-2026-60137- - https://github.com/pedroMPMartins/wordpress_exploit +- https://github.com/hitechcloud-vietnam/wp2shell-PoC #### Nuclei - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63030.yaml diff --git a/index/github.txt b/index/github.txt index e4a36f39869..b04a4c20241 100644 --- a/index/github.txt +++ b/index/github.txt @@ -27149,3 +27149,5 @@ CVE-2026-19660 - https://github.com/MRdark-ops/CVE-2026-19660-exploit CVE-2026-39808 - https://github.com/gotr00t0day/CVE-2026-39808 CVE-2026-4480 - https://github.com/AlanNewberry/CVE-2026-4480-samba-print-command-injection-rce CVE-2025-21065 - https://github.com/Pealeap/CVE-2025-21065 +CVE-2026-60137 - https://github.com/hitechcloud-vietnam/wp2shell-PoC +CVE-2026-63030 - https://github.com/hitechcloud-vietnam/wp2shell-PoC diff --git a/index/trending.json b/index/trending.json index e18cc707172..20302f3a093 100644 --- a/index/trending.json +++ b/index/trending.json @@ -67,7 +67,7 @@ }, { "year": 2026, - "stars": 44, + "stars": 45, "name": "CVE-2026-94545", "url": "https://github.com/EQSTLab/CVE-2026-94545", "desc": "Next.js RCE",