Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

state:has-public-poc — CVE vulnerabilities tagged 126

126 CVE security advisories tagged "state:has-public-poc" with AI Chinese analysis, CVSS, references and POCs.

The tag "state:has-public-poc" signifies that a specific Common Vulnerabilities and Exposures identifier has been confirmed to have a publicly available proof-of-concept exploit. This designation is critical because it transitions a theoretical flaw into an immediate, actionable threat, allowing attackers to validate the vulnerability’s existence and impact without needing to reverse-engineer the underlying code. Consequently, the risk profile escalates significantly, as the barrier to entry for exploitation drops dramatically, enabling both malicious actors and security researchers to demonstrate the breach. Typical scenarios involve critical remote code execution or privilege escalation flaws where developers can no longer claim ignorance of the exploitability. For organizations, this tag serves as a high-priority alert, necessitating immediate patching or mitigation strategies to prevent active exploitation in the wild, thereby reducing the window of opportunity for adversaries to compromise systems before official fixes are deployed.

CVE ID Title CVSS Severity Published
CVE-2026-122146 101arrowz fflate index.mjs unzipSync memory corruption — fflate CWE-119 7.3 High 2026-11-05
CVE-2026-121597 TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow — A950RG CWE-121 9.9 Critical 2026-11-04
CVE-2026-116114 Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission — GM8135S Camera CWE-319 3.7 Low 2026-10-26
CVE-2026-116053 dbcli mycli Whitelist source.py source_special_command_is_safe os command injection — mycli CWE-78 5.3 Medium 2026-10-25
CVE-2026-114441 oretnom23 php-travel-agency-system update.php sql injection — php-travel-agency-system CWE-89 7.3 High 2026-10-21
CVE-2026-114376 leomoon-studios wiki-go API editor.go SourceHandler path traversal — wiki-go CWE-22 6.3 Medium 2026-10-21
CVE-2026-113396 DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection — Vigor2960 CWE-77 7.4 High 2026-10-20
CVE-2026-112140 llSourcell Doctor-Dignity chat_module.py _get_lib_module code injection — Doctor-Dignity CWE-94 6.3 Medium 2026-10-19
CVE-2026-112087 itsourcecode Online Cake Ordering System confirm.php sql injection — Online Cake Ordering System CWE-89 6.3 Medium 2026-10-19
CVE-2026-111871 itsmeravitejak Online-Examination-System subjectsdb.php sql injection — Online-Examination-System CWE-89 7.3 High 2026-10-18
CVE-2026-110695 turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow — ExLlamaV2 CWE-120 6.3 Medium 2026-10-14
CVE-2026-109523 girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection — Online-Appointment-Booking-System CWE-89 7.3 High 2026-10-13
CVE-2026-109107 Wavlink WL-WN592AX6 upload.cgi main null pointer dereference — WL-WN592AX6 CWE-476 6.5 Medium 2026-10-13
CVE-2026-108968 SourceCodester Performance Indicator System sales_history.php sql injection — Performance Indicator System CWE-89 7.3 High 2026-10-13
CVE-2026-108934 Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting — BR-6208AC CWE-79 2.4 Low 2026-10-12
CVE-2026-108909 Netcore NR268 CGI Endpoint cross-site request forgery — NR268 CWE-352 4.3 Medium 2026-10-12
CVE-2026-108791 westboy CicadasCMS Template Management input TemplateController.input path traversal — CicadasCMS CWE-22 4.3 Medium 2026-10-12
CVE-2026-108782 erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection — JEEWMS CWE-89 6.3 Medium 2026-10-12
CVE-2026-108539 GPAC MP4Box filter_queue.c gf_fq_pop use after free — GPAC CWE-416 6.3 Medium 2026-10-11
CVE-2026-107166 Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources — Open5GS CWE-770 5.3 Medium 2026-10-07
CVE-2026-105610 chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization — SpringBlade CWE-285 4.7 Medium 2026-10-06
CVE-2026-105487 yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection — reNgine CWE-78 6.3 Medium 2026-10-06
CVE-2026-105146 Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection — Discuz! CWE-89 4.7 Medium 2026-10-04
CVE-2026-101260 Ziroom ZHOME A0101 firstLogin command injection — ZHOME A0101 CWE-77 9.1 Critical 2026-09-28
CVE-2026-101143 Eleveo Quality Management QMBODownload information disclosure — Quality Management CWE-200 4.3 Medium 2026-09-28
CVE-2026-101074 Netcore NR289-GE Authentication boa password-check stack-based overflow — NR289-GE CWE-121 9.8 Critical 2026-09-28
CVE-2026-100906 Eyeplus ONVIF Device GetUsers information disclosure — Eyeplus CWE-200 5.3 Medium 2026-09-28
CVE-2026-100885 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization — laravel-crm CWE-639 7.3 High 2026-09-27
CVE-2026-100315 mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection — CloudClassroom-PHP-Project CWE-89 7.3 High 2026-09-26
CVE-2026-97646 ningzichun student-management-system getStudent.php authorization — student-management-system CWE-639 7.3 High 2026-09-25

Vulnerabilities classified as state:has-public-poc represent 126 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.