CVE-2026-104356-pictshare-weak-delete-code

CVE-2026-104356 — Predictable deletecode via rand in PictShare Authorized security research. PoC for defensive and educational use only. PictShare generates the deletecode authorization token with getRandomString, which draws every character from PHP's non-cryptographic rand. Because rand is not ...

CVE-2026-104051-pictshare-info-disclosure

CVE-2026-104051 — Sensitive Information Disclosure via info API in PictShare Authorized security research. PoC for defensive and educational use only. The /api/info/ endpoint of PictShare returns the complete raw metadata object for any uploaded file — including the secret deletecode that...

CVE-2026-116263

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The...

CVE-2026-116263 HaschekSolutions PictShare File Upload core.php architect race condition

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The...

CVE-2026-116263

HaschekSolutions PictShare versions up to 3.7.1 are vulnerable to a race condition in the File Upload component. The flaw is located in the function architect of the src/inc/core.php file. This vulnerability can be triggered remotely, though the attack complexity is rated as high and exploitabili...

EUVD-2026-109784

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The...

CVE-2026-116263 HaschekSolutions PictShare File Upload core.php architect race condition

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The...

Exploit for CVE-2026-104356

CVE-2026-104356 — Predictable deletecode via rand in Pi...

Exploit for CVE-2026-104051

CVE-2026-104051 — Sensitive Information Disclosure via info...

EUVD-2026-91065

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

EUVD-2026-91072

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104051

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356

PictShare, a self-hosted image and media host, is vulnerable to a weak randomness issue in versions prior to 3.7.1 . The getRandomString() function in src/inc/core.php utilizes the non-cryptographic rand() PRNG to generate the delete_code authorization token. Because the same generator produces t...

CVE-2026-104051 PictShare < 3.7.1 Sensitive Information Disclosure via info API

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104051 PictShare < 3.7.1 Sensitive Information Disclosure via info API

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104051 PictShare < 3.7.1 Sensitive Information Disclosure via info API

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...