Exploit for CVE-2026-104356

CVE-2026-104356 — Predictable deletecode via rand in Pi...

Exploit for CVE-2026-104051

CVE-2026-104051 — Sensitive Information Disclosure via info...

EUVD-2026-91072

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104051

PictShare versions prior to 3.7.1 are vulnerable to an information disclosure vulnerability via the API::info() endpoint. The root cause is the lack of a field whitelist, allowing unauthenticated attackers to retrieve complete raw metadata objects. By using a publicly visible file hash, an attack...