CVE-2026-97000 to CVE-2026-97999

56 CVEs with public proof-of-concept exploits.

• CVE-2026-970601 PoCX-SpringBoot through 6.0 Authorization Bypass via User Management
• CVE-2026-970621 PoCAureus ERP 1.6.0 Stored XSS via SVG File Upload
• CVE-2026-970631 PoCX-SpringBoot through 6.0 Authentication Bypass via Login Code
• CVE-2026-970641 PoCX-SpringBoot through 6.0 Authentication Bypass via Static Master Code
• CVE-2026-971601 PoCJoomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
• CVE-2026-971611 PoCJoomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
• CVE-2026-971633 PoCsJoomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
• CVE-2026-971791 PoCO2OA Cipher Connection CipherConnectionAction.java list information disclosure
• CVE-2026-971821 PoChalo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization
• CVE-2026-971831 PoCWP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers
• CVE-2026-971881 PoCString Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor
• CVE-2026-972191 PoCMStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter
• CVE-2026-972271 PoCNextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion
• CVE-2026-972297 PoCsInteger Overflow or Wraparound in GitLab
• CVE-2026-972311 PoCvolotat Anagnorisis Socket.IO Connect app.py missing authentication
• CVE-2026-972321 PoCvolotat Anagnorisis page.html start_streaming path traversal
• CVE-2026-972331 PoCvolotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting
• CVE-2026-973141 PoCThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection
• CVE-2026-973151 PoCResponsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email
• CVE-2026-973161 PoCBroken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass
• CVE-2026-973171 PoCGiveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page
• CVE-2026-973181 PoCGiveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter
• CVE-2026-973191 PoCPowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block
• CVE-2026-973261 PoCsongxinjianqwe Chat chat-server ChatServer.java server-side request forgery
• CVE-2026-973311 PoCUser Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access
• CVE-2026-973322 PoCsUser Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
• CVE-2026-973471 PoCPost Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
• CVE-2026-973541 PoCPowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects
• CVE-2026-973591 PoCHFS2 2.4.0 RCE via Multipart Upload Filename Template Injection
• CVE-2026-973601 PoCHFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine
• CVE-2026-973621 PoCHFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread
• CVE-2026-973661 PoCjhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection
• CVE-2026-973681 PoCchillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization
• CVE-2026-973941 PoCkin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
• CVE-2026-974711 PoCAvada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic…
• CVE-2026-976461 PoCningzichun student-management-system getStudent.php authorization
• CVE-2026-976471 PoCningzichun student-management-system editLog.php authorization
• CVE-2026-976481 PoCningzichun student-management-system cross-site request forgery
• CVE-2026-976491 PoCningzichun student-management-system example_lite.sql default credentials
• CVE-2026-976501 PoCningzichun student-management-system addLog.php echo cross site scripting
• CVE-2026-976571 PoCAbandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via…
• CVE-2026-976701 PoCAvada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form…
• CVE-2026-977211 PoCSanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization
• CVE-2026-978661 PoCZhonglun CloudPOS Automatic Update Program.cs channel accessible
• CVE-2026-978681 PoCsheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting
• CVE-2026-978691 PoClangchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization
• CVE-2026-978711 PoCZhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection
• CVE-2026-978771 PoCzhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password
• CVE-2026-978781 PoCzhistaredu StarTraining Druid Console index.html anonymous missing authentication
• CVE-2026-978791 PoCzhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication
• CVE-2026-978821 PoCmathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection
• CVE-2026-978841 PoCmathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection
• CVE-2026-978851 PoCmathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection
• CVE-2026-978861 PoCmathurvishal CloudClassroom-PHP-Project managevideos2.php sql injection
• CVE-2026-978951 PoCkrayin laravel-crm User Management UserController.php privileges management
• CVE-2026-978961 PoCkrayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting