CVE-2026-104356-pictshare-weak-delete-code

CVE-2026-104356 — PictShare의 rand를 통한 예측 가능한 deletecode 허가된 보안 연구. 방어 및 교육 목적으로만 사용되는 PoC입니다. PictShare는 deletecode 인가 토큰을 getRandomString으로 생성하는데, 이 함수는 모든 문자를 PHP의 비암호학적 rand에서 가져옵니다. rand는 CSPRNG가 아니며 — 동일한 생성기 가 모든 공유 URL에 표시되는 공개 파일 해시도 생성하기 때문에 — deletecode는 비밀이 아니라 예측 가능하며, info 엔드포인트에서 코드...

passgen

🔐 passgen — 터미널에서 비밀번호 생성 유연한 문자 세트와 제외 기능을 갖춘 안전한 랜덤 비밀번호를 생성하는 작은 Go CLI입니다. crypto/rand를 사용하여 암호학적으로 안전한 무작위성을 제공합니다. 문자셋 플래그가 제공되지 않으면 기본적으로 모든 세트가 활성화됩니다. 설치 Go latest go install github.com/bilalbaraz/passgen@latest specific version go install github.com/bilalbaraz/passgen@ Homebrew brew tap...

CVE-2026-104356

PictShare, a self-hosted image and media host, is vulnerable to a weak randomness issue in versions prior to 3.7.1 . The getRandomString() function in src/inc/core.php utilizes the non-cryptographic rand() PRNG to generate the delete_code authorization token. Because the same generator produces t...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-104356 PictShare < 3.7.1 Predictable Delete Code via rand()

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString function uses the non-cryptographic rand PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and...

CVE-2026-53953

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

CVE-2026-53953

In GetSimple CMS CE version 3.3.22 , the password reset endpoint is accessible without authentication. When a reset request is submitted for an existing user, the application generates a temporary password using PHP rand() seeded with microtime() . Because this seed is time-based and has a limite...

CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

CVE-2026-53953: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

CVE-2026-92749

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-92749 SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

EUVD-2026-81021

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-92749 SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-92298

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...

CVE-2026-92298

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. The tokens are roughly 31-bit , allowing remote unauthenticated attackers to guess them and confirm opt-ins, accept or...

CVE-2026-92298 EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event...