mirror of
https://github.com/trickest/cve.git
synced 2026-11-07 04:29:23 -10:00
Update Mon Sep 14 12:18:06 UTC 2026
This commit is contained in:
trickest-workflows committed
1 parent
f9372750db
commit
57f7185085
120 files changed
+2156
-1
No files matched your search
@@ -10,6 +10,7 @@ Stack consumption vulnerability in the dissect_ber_unknown function in epan/diss
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2011-0370.html
|
||||
- http://www.vupen.com/english/advisories/2011/0626
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2011-0024](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0024)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Heap-based buffer overflow in wiretap/pcapng.c in Wireshark before 1.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted capture file.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2011-0370.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,6 +10,7 @@ Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitia
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2011-0370.html
|
||||
- http://www.vupen.com/english/advisories/2011/0626
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -10,6 +10,7 @@ wiretap/pcapng.c in Wireshark 1.2.0 through 1.2.14 and 1.4.0 through 1.4.3 allow
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2011-0370.html
|
||||
- http://www.vupen.com/english/advisories/2011/0626
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -10,6 +10,7 @@ Multiple stack consumption vulnerabilities in the dissect_ms_compressed_string a
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2011-0370.html
|
||||
- http://www.vupen.com/english/advisories/2011/0626
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -10,6 +10,7 @@ epan/dissectors/packet-ldap.c in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2011-0370.html
|
||||
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5732
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -10,6 +10,7 @@ epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2011-0370.html
|
||||
- http://www.vupen.com/english/advisories/2011/0626
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2013-4158](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4158)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4158
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2015-6117](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6117)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2016-0011.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,7 +10,7 @@ Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1,
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004
|
||||
|
||||
#### Github
|
||||
- https://github.com/ARPSyndicate/cvemon
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2016-0011](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0011)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2015-6117.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2016-0012](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0012)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office 2016, Excel 2016, PowerPoint 2016, Visio 2016, Word 2016, and Visual Basic 6.0 Runtime allow remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Microsoft Office ASLR Bypass."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2016-0035](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0035)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2023-24034](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24034)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
|
||||
#### Github
|
||||
- https://github.com/hotblac/cve-2023-34034
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2023-37366](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37366)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300, an Exynos Auto T5123. In the Shannon SM Task, improper handling of a loop with an unreachable exit condition cannot guarantee the termination of a required service via a malformed SM message.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
|
||||
#### Github
|
||||
- https://github.com/N3vv/N3vv
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2023-44449](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44449)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability.The specific flaw exists within the clearAlertByIds function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-21875.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://kb.netgear.com/000065866/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2023-0114-PSV-2023-0115
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2023-44450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44450)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability.The specific flaw exists within the getNodesByTopologyMapSearch function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21858.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://kb.netgear.com/000065866/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2023-0114-PSV-2023-0115
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2024-53922](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53922)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial of Service in the kernel.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://diconium.com/de/blog/cybersecurity/hunting-bugs-in-linux-kernel-with-kasan
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-25550](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25550)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 <= R9, and DataServiceSingleton for BarTender 2019 <= R10 — configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling to read or write arbitrary files on the server using the .NET WebClient class, or coerce NTLMv2 authentication by supplying a UNC path to an attacker-controlled server, enabling sensitive credential disclosure, remote code execution, or lateral movement depending on service account privileges and network environment. The service runs in the context of NT AUTHORITY\\SYSTEM. This vulnerability is corrected in BarTender 12.1. Users of affected releases should upgrade to BarTender 12.1 or later.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/VAMorales/dde5b1c0415a8505ccd6fafdb095a618
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-37008](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-37008)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://yerangamage.com/cves/detail/?slug=crewai-sandbox-escape
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-38924](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-38924)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://dash.security/blog/cve-2026-38924-unauthenticated-rce-in-the-serena-mcp-server
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-47156](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47156)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via the SOAP API. The REST API is NOT affected. The REST API's AuthMiddleware derives the username server-side from the API token or session cookie, so the username cannot be spoofed. The Web UI is NOT affected. The Web UI authenticates via PHP session cookies (PHPSESSID) and validates the MANTIS_STRING_COOKIE against the logged-in user through auth_is_cookie_valid(). The username is derived server-side from the cookie, not supplied by the client. Version 2.28.4 contains a patch. No known workarounds are available.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://mantisbt.org/bugs/view.php?id=37121
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
### [CVE-2026-5125](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5125)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in raine consult-llm-mcp up to 2.5.3. Affected by this vulnerability is the function child_process.execSync of the file src/server.ts. The manipulation of the argument git_diff.base_ref/git_diff.files results in os command injection. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 2.5.4 addresses this issue. The patch is identified as 4abf297b34e5e8a9cb364b35f52c5f0ca1d599d3. Upgrading the affected component is recommended.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://vuldb.com/submit/780154
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-68955](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68955)
|
||||
&color=blue)
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://help.kobo.com/hc/en-us/articles/42294089837463-Security-Advisory-Kobo-Desktop-App-Installer
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-71198](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71198)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254), and retrieve the response by downloading the image data. This affects both the new POST /v2/images/{id}/locations API and the old PATCH API when show_multiple_locations is enabled. Deployments with the HTTP store backend enabled are affected.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://launchpad.net/bugs/2161330
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-74933](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74933)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/23dc45bb-e7b6-4cae-81ce-2c6394afb454/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-76017](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76017)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/522819252
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-79088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-79088)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/496401361
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-79122](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-79122)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Information leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/513608831
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-81648](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81648)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/9b1490a0-1381-4d22-8086-f75aade4e898/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-85129](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85129)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a50f6ec1-4297-453e-b45f-6fd889b6b0d2/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-85388](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85388)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86096](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86096)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/PX4/PX4-Autopilot/pull/28487
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86111](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86111)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-1-authenticated-idor-in-editstatus-exposes-private-review-comment-and-quotation-content
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86112](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86112)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-2-authenticated-idor-in-favoriteunfavorite-allows-interaction-with-private-statuses
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86113](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86113)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/geo-chen/oss/blob/main/bookwyrm.md#finding-3-authenticated-idor-in-edit-readthrough-allows-tampering-with-other-users-reading-progress
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86116)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/geo-chen/oss/blob/main/metabase.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86118](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86118)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86119](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86119)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/webstudio-is/webstudio/issues/5816
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86159](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86159)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_user. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/lwcc223/CVE/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86162](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86162)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Aurora-Song/cve/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86163](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86163)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/pro_del.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/CSDVi/cve/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86167](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86167)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/command-formgponConf-fmgpon_loid.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86171)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/DefaultFuction/Customer-Relationship-Management-System/issues/4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86174](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86174)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/makeplane/plane/issues/9441
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86177](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86177)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/geo-chen/oss/blob/main/panel.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86179](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86179)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/exp_ak.sql of the component Database Backup Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Daily%20Expense%20Manager%20in%20PHP%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20SQL%20Database%20File.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86180](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86180)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Task%20Management%20System%20in%20PHP%20%E2%80%93%20SQL%20Injection%20in%20%60email%60%20Parameter.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86181](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86181)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the component User Profile Update. The manipulation of the argument lname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Task%20Management%20System%20%60lname%60%20Parameter.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86186](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86186)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing attempts against any account from a single IP address.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/WWBN/AVideo/security/advisories/GHSA-qmmw-hmm4-xxp7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86188](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86188)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/WWBN/AVideo/security/advisories/GHSA-xpx7-h2x7-59qq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86189](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86189)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/WWBN/AVideo/security/advisories/GHSA-cprx-fggj-7vpq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86190](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86190)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/WWBN/AVideo/security/advisories/GHSA-82q2-88mq-p44q
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86191](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86191)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4qq-w6qx-6839
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86192](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86192)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vc7j-5f5p-3x75
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86196)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/getgrav/grav/security/advisories/GHSA-262p-56vv-7v5r
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86199](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86199)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g2fj-p69p-9chp
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86201](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86201)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6rj-3m53-887h
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86204](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86204)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86205](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86205)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a Location header interpreted by browsers as a protocol-relative redirect to an external domain.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/h3js/h3/security/advisories/GHSA-fp4x-ggrf-wmc6
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86208](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86208)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /delete_teacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/justconter/cve/issues/10
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86209)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_user.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/justconter/cve/issues/9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86210](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86210)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_user_account.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/justconter/cve/issues/8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86211](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86211)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yingxiujie/cve/issues/8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86217](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86217)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of the component Database Backup Handler. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Hotel%20and%20Tourism%20Reservation%20System%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20SQL%20Database%20File.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86220](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86220)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected element is the function mysqli_query of the file /admin/modal_add_course.php. The manipulation of the argument course results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/justconter/_CVE/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86221](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86221)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_course1.php. This manipulation of the argument course causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/justconter/_CVE/issues/2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86225](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86225)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqli_query of the file /admin/modal_add_room.php. The manipulation of the argument room_name leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/justconter/_CVE/issues/6
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86226](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86226)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/CyberShailendra1/Online-Attendance-System-Projectworlds
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
### [CVE-2026-86228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86228)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. You should upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/jeecgboot/JeecgBoot/issues/9600
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86232](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86232)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_del.php?type=supplier. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/v89269561-web/CyberseReasearch/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86233](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86233)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/us_del.php?type=user. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/v89269561-web/CyberseReasearch/issues/2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86235](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86235)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/pos_transac.php?action=add. This manipulation of the argument Customer causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86239)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yang5ynag/cve/blob/main/FEHI-001-UEditor-Unauthorized-File-Upload.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86250](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86250)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/h3js/h3/security/advisories/GHSA-q5pr-72pq-83v3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86251](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86251)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-86253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86253)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/h3js/h3/security/advisories/GHSA-wr4h-v87w-p3r7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86254)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.manage_gym permission and gym=None affiliation can permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations by exploiting the None != None comparison edge case.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/wger-project/wger/security/advisories/GHSA-mw8f-w6p8-xrf4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86267](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86267)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/check_student.php. The manipulation of the argument student_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/anglemsg2401-bot/cve/issues/5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86268](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86268)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/anglemsg2401-bot/cve/issues/6
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86269](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86269)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/emp_edit1.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86273](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86273)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/projeto-siga/siga/issues/2492
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
### [CVE-2026-86274](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86274)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/projeto-siga/siga/issues/2493
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86277](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86277)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. Impacted is an unknown function of the file delete_exam.php. The manipulation of the argument ID leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/hackliu/Vulnerability-Reports/blob/master/Syllabus%20Aligned%20Learning%20Management%20Examination%20System/VULN-04-IDOR-Broken-Access-Control.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86280](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86280)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This affects an unknown function of the file cict_portal.sql. Such manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/hackliu/Vulnerability-Reports/blob/master/Syllabus%20Aligned%20Learning%20Management%20Examination%20System/VULN-07-Sensitive-Information-Exposure.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-86288](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86288)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file gptqmodel/nn_modules/qlinear/tritonv2.py of the component Triton dequantization kernel. Such manipulation of the argument g_idx leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.3.0 is able to resolve this issue. The name of the patch is 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1. Upgrading the affected component is recommended.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ModelCloud/GPTQModel/issues/2949
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86299](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86299)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/limou89/somevul/blob/main/Linksys_RE7000_v2_PingTest_Command_Injection.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86303)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called c000d2f9cf390c315378d3717cf20911cf3e80a6. A patch should be applied to remediate this issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/92181/markdown/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86309](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86309)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yunfan668/cve/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86310](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86310)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86321)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/java-json-tools/jackson-coreutils/issues/64
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86426](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86426)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to match token hashes, gaining access to API functionality including device credentials and administrative features that enable remote code execution through alert templates.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/librenms/librenms/security/advisories/GHSA-cvq8-gqfq-3mvg
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
### [CVE-2026-86512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86512)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/java-json-tools/json-patch/issues/170
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86517](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86517)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query of the file /pages/us_searchfrm.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/wakakakaaaaha/vuln/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86518](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86518)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Student%20CRUD%20Operation%20in%20PHP%20%E2%80%93%20Time-Based%20Blind%20SQL%20Injection%20in%20%60edit.php%60%20via%20%60id%60%20Parameter.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-86519](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86519)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Student%20CRUD%20Operation%20in%20PHP%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20%60card_activation.sql%60%20Database%20File.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86713)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/PX4/PX4-Autopilot/pull/28544
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86718](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86718)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrator browsers to delete all live transmission history or mark streams as finished when an admin visits the attacker-controlled site.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/WWBN/AVideo/security/advisories/GHSA-gmx5-mhqr-h7rj
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86719](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86719)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users_id from $_REQUEST and invokes User::swapUser() without calling forbidIfNotPost() or forbidIfInvalidToken(), and the global autoCSRFGuard() check only runs for POST requests to *.json.php, so the action is reachable via GET. An attacker who causes an authenticated administrator's browser to issue a cross-origin GET (for example via an <img> tag or link) can replace that administrator's session with a non-admin user account, causing the administrator to lose administrative access until the swap is cancelled; swapping to another administrator account is rejected, so this is not privilege escalation. The JSON response also discloses the session_id. The CustomizeUser plugin is enabled by default, and no patch was available at the time of publication.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/WWBN/AVideo/security/advisories/GHSA-xrp7-6w7g-q7fx
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-86721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86721)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/WWBN/AVideo/security/advisories/GHSA-5664-h9h4-3gwc
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
Loaded 100 of 120 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user