nomi-sec/PoC-in-GitHub
1
0 Fork 0
mirror of https://github.com/nomi-sec/PoC-in-GitHub.git synced 2026-11-07 08:30:25 -10:00
Code Issues Packages Projects Releases Wiki Activity

Auto Update README.md 2026/11/05 13:53:48

Browse Source
This commit is contained in:
motikan2010-bot committed 2026-11-05 22:53:53 +09:00
1 parent 05807bdf8e
commit 83ab63be46
1 file changed
+16 -25
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+16 -25
View File
@@ -3537,13 +3537,6 @@
- [BiiTts/CVE-2026-12940-Langflow-Unauth-RCE](https://github.com/BiiTts/CVE-2026-12940-Langflow-Unauth-RCE)
### CVE-2026-12944 (2026-09-14)
<code>IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns &quot;validated&quot;: true, providing a false security signal.
</code>
- [ShadowForge-Cyber/CVE-2026-12944](https://github.com/ShadowForge-Cyber/CVE-2026-12944)
### CVE-2026-12948 (2026-07-07)
<code>A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79).
@@ -6269,7 +6262,6 @@
- [X-croot/CVE-2026-24061_POC](https://github.com/X-croot/CVE-2026-24061_POC)
- [SeptembersEND/CVE--2026-24061](https://github.com/SeptembersEND/CVE--2026-24061)
- [obrunolima1910/CVE-2026-24061](https://github.com/obrunolima1910/CVE-2026-24061)
- [lavabyte/telnet-CVE-2026-24061](https://github.com/lavabyte/telnet-CVE-2026-24061)
- [canpilayda/inetutils-telnetd-cve-2026-24061](https://github.com/canpilayda/inetutils-telnetd-cve-2026-24061)
- [killsystema/scan-cve-2026-24061](https://github.com/killsystema/scan-cve-2026-24061)
- [nrnw/CVE-2026-24061-GNU-inetutils-Telnet-Detector](https://github.com/nrnw/CVE-2026-24061-GNU-inetutils-Telnet-Detector)
@@ -7344,21 +7336,21 @@
### CVE-2026-27540 (2026-03-19)
<code>Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through &lt;= 2.0.3.1.
<code>Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.
</code>
- [winrarzipsexploit/CVE-2026-27540](https://github.com/winrarzipsexploit/CVE-2026-27540)
### CVE-2026-27541 (2026-03-05)
<code>Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through &lt;= 2.2.6.
<code>Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite allows Privilege Escalation.\n\nThis issue affects Wholesale Suite: through 2.2.6.
</code>
- [rootdirective-sec/CVE-2026-27541-Analysis-Lab](https://github.com/rootdirective-sec/CVE-2026-27541-Analysis-Lab)
### CVE-2026-27542 (2026-03-19)
<code>Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a through &lt;= 2.0.3.1.
<code>Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.
</code>
- [Nxploited/CVE-2026-27542-CVE-2026-27540-](https://github.com/Nxploited/CVE-2026-27542-CVE-2026-27540-)
@@ -11815,7 +11807,6 @@
- [k-o-n-t-o-r/ghostlock-sabrina](https://github.com/k-o-n-t-o-r/ghostlock-sabrina)
- [mouseos/aquos-r6-ghostlock](https://github.com/mouseos/aquos-r6-ghostlock)
- [kurtulusakyuz/IonStack_S21](https://github.com/kurtulusakyuz/IonStack_S21)
- [DeAurity/ghost-hoock](https://github.com/DeAurity/ghost-hoock)
- [huaguiqi/asus-i005-cve-2026-43499](https://github.com/huaguiqi/asus-i005-cve-2026-43499)
- [imeiplus/ghostlock-pfem10](https://github.com/imeiplus/ghostlock-pfem10)
- [anksgls-sj/-Help-vivo-Y200i-5.10.218-GKI-CVE-2026-43499-stack-reclaim-reaches-0x300-need-0x318](https://github.com/anksgls-sj/-Help-vivo-Y200i-5.10.218-GKI-CVE-2026-43499-stack-reclaim-reaches-0x300-need-0x318)
@@ -11870,6 +11861,7 @@
- [SnowbakaQWQ/ghostlock-ares](https://github.com/SnowbakaQWQ/ghostlock-ares)
- [Linkenpro/ghostlock-pd2118c-4.19.152](https://github.com/Linkenpro/ghostlock-pd2118c-4.19.152)
- [heikeyangle-code/mi11-venus-temproot](https://github.com/heikeyangle-code/mi11-venus-temproot)
- [thedavidweng/ghostlock-z3q](https://github.com/thedavidweng/ghostlock-z3q)
### CVE-2026-43500 (2026-05-11)
@@ -15885,7 +15877,6 @@
</code>
- [HORKimhab/CVE-2026-65660](https://github.com/HORKimhab/CVE-2026-65660)
- [ShadowForge-Cyber/CVE-2026-65660-Poc](https://github.com/ShadowForge-Cyber/CVE-2026-65660-Poc)
### CVE-2026-65694 (2026-07-23)
@@ -17143,7 +17134,6 @@
<code>A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\r\n\r\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
</code>
- [ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept](https://github.com/ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept)
- [pastelghost3/cve-2026-76504-nuclei](https://github.com/pastelghost3/cve-2026-76504-nuclei)
- [maxprog-svg/CVE-2026-76504-Cisco](https://github.com/maxprog-svg/CVE-2026-76504-Cisco)
@@ -17961,13 +17951,6 @@
- [dinosn/libheif-cve-2026-84383-lab](https://github.com/dinosn/libheif-cve-2026-84383-lab)
- [sachincool/cve-2026-84383-poc](https://github.com/sachincool/cve-2026-84383-poc)
### CVE-2026-84388 (2026-09-22)
<code>A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack
</code>
- [ShadowForge-Cyber/CVE-2026-84388-POC](https://github.com/ShadowForge-Cyber/CVE-2026-84388-POC)
### CVE-2026-84411 (2026-10-02)
<code>The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.
@@ -18435,7 +18418,6 @@
<code>An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
</code>
- [DeAurity/CVE-2026-86950-POC](https://github.com/DeAurity/CVE-2026-86950-POC)
- [34zY/CVE-2026-86950](https://github.com/34zY/CVE-2026-86950)
- [msuiche/hotcell](https://github.com/msuiche/hotcell)
- [java99999/CVE-2026-86950-POC](https://github.com/java99999/CVE-2026-86950-POC)
@@ -18911,6 +18893,7 @@
- [hubly12/javafix](https://github.com/hubly12/javafix)
- [FahrihFatahilah/CVE-2026-91403-eMudhra-Java-Scanner](https://github.com/FahrihFatahilah/CVE-2026-91403-eMudhra-Java-Scanner)
- [siladu/fix-cve-2026-91403](https://github.com/siladu/fix-cve-2026-91403)
- [bryanHsiao/domino-emudhra-cert-mitigation](https://github.com/bryanHsiao/domino-emudhra-cert-mitigation)
### CVE-2026-91737 (2026-09-15)
@@ -19687,6 +19670,8 @@
- [Haor/CVE-2026-98260-OPD2513](https://github.com/Haor/CVE-2026-98260-OPD2513)
- [starriv/CVE-2026-98260-Xiaomi-17-Pro-Max](https://github.com/starriv/CVE-2026-98260-Xiaomi-17-Pro-Max)
- [al123xiaaaa/CVE-2026-98260-GT7Pro-RMX5010](https://github.com/al123xiaaaa/CVE-2026-98260-GT7Pro-RMX5010)
- [whooslizi/infinitycore-x200pro](https://github.com/whooslizi/infinitycore-x200pro)
- [Yukaneko520/RootMyZ9Turbo](https://github.com/Yukaneko520/RootMyZ9Turbo)
### CVE-2026-98385 (2026-10-12)
@@ -19768,11 +19753,12 @@
- [t0ge-kun/CVE-2026-98432-check](https://github.com/t0ge-kun/CVE-2026-98432-check)
- [downitch/CVE-2026-98432_poc](https://github.com/downitch/CVE-2026-98432_poc)
- [cybervenom01/Mitigation_CVE-2026-98432](https://github.com/cybervenom01/Mitigation_CVE-2026-98432)
- [ScudraServicos/cve-2026-98432-mitigation](https://github.com/ScudraServicos/cve-2026-98432-mitigation)
- [Certbn/CVE-2026-98432-Linux-IPv4-TCP-IP-Use-After-Free](https://github.com/Certbn/CVE-2026-98432-Linux-IPv4-TCP-IP-Use-After-Free)
- [datacenter-metrotel/Mitigating-CVE-2026-98432](https://github.com/datacenter-metrotel/Mitigating-CVE-2026-98432)
- [INFOKOM-KI/CVE-2026-98432-Wazuh-](https://github.com/INFOKOM-KI/CVE-2026-98432-Wazuh-)
- [keithel/ubuntu-26.04-kernel-cve-2026-98432-patch-build-docker](https://github.com/keithel/ubuntu-26.04-kernel-cve-2026-98432-patch-build-docker)
- [dolistblesson/CVE-2026-98432-update](https://github.com/dolistblesson/CVE-2026-98432-update)
- [carlosbustillordguez/cve-2026-98432-mitigation](https://github.com/carlosbustillordguez/cve-2026-98432-mitigation)
### CVE-2026-98937 (2026-10-23)
@@ -20334,7 +20320,6 @@
<code>An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
</code>
- [ShadowForge-Cyber/CVE-2026-104286-POC](https://github.com/ShadowForge-Cyber/CVE-2026-104286-POC)
- [techupdate24/fortimail-zero-day-cve-2026-104286](https://github.com/techupdate24/fortimail-zero-day-cve-2026-104286)
- [kh20134/fortimail-cve-2026-104286-response](https://github.com/kh20134/fortimail-cve-2026-104286-response)
- [CompleteTech-Security/fortimail-cve-2026-104286-check](https://github.com/CompleteTech-Security/fortimail-cve-2026-104286-check)
@@ -20902,6 +20887,7 @@
- [NeoArtemis37/PHP2shell](https://github.com/NeoArtemis37/PHP2shell)
- [Quaerendir/cve-2026-109518-audit](https://github.com/Quaerendir/cve-2026-109518-audit)
- [jordanhardee/cve-2026-109518-apt-patch-proxmox-and-generic](https://github.com/jordanhardee/cve-2026-109518-apt-patch-proxmox-and-generic)
### CVE-2026-109519 (2026-10-13)
@@ -21653,6 +21639,7 @@
- [esskslifetech/php-secure-patch](https://github.com/esskslifetech/php-secure-patch)
- [shellharbor/php-7.4-cve-2026-docker](https://github.com/shellharbor/php-7.4-cve-2026-docker)
- [marceloaugu/php2shell-ubuntu](https://github.com/marceloaugu/php2shell-ubuntu)
- [piVentures/php2shell-agentic-offsec](https://github.com/piVentures/php2shell-agentic-offsec)
- [Cgdocx/php2shell-lab-verification](https://github.com/Cgdocx/php2shell-lab-verification)
- [haseebanjum/php-patch-check](https://github.com/haseebanjum/php-patch-check)
- [riyadh920/php2shell-2026-incident-analysis](https://github.com/riyadh920/php2shell-2026-incident-analysis)
@@ -21679,6 +21666,8 @@
- [ncpz/cloudflare-php-ctf-research](https://github.com/ncpz/cloudflare-php-ctf-research)
- [sam00/CVE-2026-109618-CVE-2026-109619-POC](https://github.com/sam00/CVE-2026-109618-CVE-2026-109619-POC)
- [Nbill27/php2sherlloktakparani](https://github.com/Nbill27/php2sherlloktakparani)
- [D-1P1X/php2shell-web](https://github.com/D-1P1X/php2shell-web)
- [Nebur692/php-legacy-ubuntu](https://github.com/Nebur692/php-legacy-ubuntu)
### CVE-2026-109619 (2026-10-21)
@@ -22351,7 +22340,7 @@
<code>The Project Manager – AI Powered Project Management, Task Management, Kanban Board &amp; Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.
</code>
- [BabyMushr00w/CVE-2026-116512](https://github.com/BabyMushr00w/CVE-2026-116512)
- [Mushr00w/CVE-2026-116512](https://github.com/Mushr00w/CVE-2026-116512)
- [0xCyp1337/CVE-2026-116512](https://github.com/0xCyp1337/CVE-2026-116512)
### CVE-2026-116521
@@ -71863,6 +71852,7 @@
- [ShyVictor/minecraft-rce-lab](https://github.com/ShyVictor/minecraft-rce-lab)
- [mcpmark-eval-liuhezi/security-digest-modern-classics](https://github.com/mcpmark-eval-liuhezi/security-digest-modern-classics)
- [mcpmark-eval-liuhezi/log4j-xz-lessons](https://github.com/mcpmark-eval-liuhezi/log4j-xz-lessons)
- [Certbn/CVE-2021-44228-Apache-Log4j2-JNDI-Lookup](https://github.com/Certbn/CVE-2021-44228-Apache-Log4j2-JNDI-Lookup)
### CVE-2021-44255 (2022-01-31)
@@ -88924,6 +88914,7 @@
- [h0cksr/Fastjson--CVE-2017-18349-](https://github.com/h0cksr/Fastjson--CVE-2017-18349-)
- [Dungsocool/CVE-2017-18349](https://github.com/Dungsocool/CVE-2017-18349)
- [dichen-L/CVE-2017-18349-fastjson1.2.24-vul](https://github.com/dichen-L/CVE-2017-18349-fastjson1.2.24-vul)
### CVE-2017-18486 (2019-08-09)