CVE-2026-104356-pictshare-weak-delete-code

CVE-2026-104356 — Predictable deletecode via rand in PictShare Authorized security research. PoC for defensive and educational use only. PictShare generates the deletecode authorization token with getRandomString, which draws every character from PHP's non-cryptographic rand. Because rand is not ...

CVE-2026-104051-pictshare-info-disclosure

CVE-2026-104051 — Sensitive Information Disclosure via info API in PictShare Authorized security research. PoC for defensive and educational use only. The /api/info/ endpoint of PictShare returns the complete raw metadata object for any uploaded file — including the secret deletecode that...

Exploit for CVE-2026-104356

CVE-2026-104356 — Predictable deletecode via rand in Pi...

Exploit for CVE-2026-104051

CVE-2026-104051 — Sensitive Information Disclosure via info...

EUVD-2026-91065

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

EUVD-2026-91072

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104051

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104356

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356

PictShare, a self-hosted image and media host, is vulnerable to a weak randomness issue in versions prior to 3.7.1 . The getRandomString() function in src/inc/core.php utilizes the non-cryptographic rand() PRNG to generate the delete_code authorization token. Because the same generator produces t...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104051 PictShare < 3.7.1 Sensitive Information Disclosure via info API

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104051 PictShare < 3.7.1 Sensitive Information Disclosure via info API

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104051

PictShare versions prior to 3.7.1 are vulnerable to an information disclosure vulnerability via the API::info() endpoint. The root cause is the lack of a field whitelist, allowing unauthenticated attackers to retrieve complete raw metadata objects. By using a publicly visible file hash, an attack...

CVE-2026-104051 PictShare < 3.7.1 Sensitive Information Disclosure via info API

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

PT-2026-104028

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the delete code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete code values and...

PT-2026-104019

Name of the Vulnerable Software and Affected Versions PictShare versions prior to 3.7.1 Description An information disclosure issue exists where unauthenticated attackers can obtain the secret delete code and uploader metadata. This occurs when calling the 'API::info' endpoint, which returns the...

EUVD-2021-30590

Malicious code in bioql PyPI...

CVE-2021-43683

pictshare v1.5 is affected by a Cross Site Scripting XSS vulnerability in api/info.php. The exit function will terminate the script and print the message which has $REQUEST'hash'...

CVE-2021-43683

pictshare v1.5 is affected by a Cross Site Scripting XSS vulnerability in api/info.php. The exit function will terminate the script and print the message which has $REQUEST'hash'...