{"uuid": "ba5afb7c-0e01-4458-af46-8e6336a9c43b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81648", "type": "seen", "source": "https://gist.github.com/KhoaPhan8I/b7899621299193d7b7079d85f4806beb", "content": "# CVE Intel Feed \u2014 Offer (2026-09-15)\n\n## Product\n\nDaily JSON feed: 20 hot CVEs with local-lab PoC + fix note each.\nEvidence-first: every item ran green in an isolated fixture.\n\n**NEW \u2014 Live-Proof Premium pack (3 items, REAL vendor-source audits):**\n\n| CVE | Finding | Proof |\n|---|---|---|\n| CVE-2026-81648 (CVSS 10.0) | CryptoPayment WP unauth AJAX \u2192 file-delete + settings overwrite + wallet cleartext | 3 live vectors on Stable 1.2.2 |\n| CVE-2026-57139 (CVSS 9.8) | PraisonAI MCPServer optional-auth default-open | DEFAULT_OPEN_PROVEN on v4.7.8 source |\n| CVE-2026-87911 (CVSS 9.6) | postgres-mcp-server COPY\u2026TO PROGRAM bypass (fixed 1.1.7, confirmed 1.2.1) | FIX_CONFIRMED on vendor source |\n\nPack manifest: `data/live-proof-pack.json` (regenerate: `python scripts/live_pack.py`).\n\n## Sample (redacted, free)\n\n`data/feed-sample.json` \u2014 3 items, PoC stripped. Full feed holds\n20 items with working PoC code + REPORT text.\n\n## Tiers\n\n- **Sample:** free, redacted, shareable.\n- **Full feed:** 20 items + PoC + REPORT. Price on request.\n- **Live-Proof Premium:** 3 REAL vendor-source audits with evidence logs. Price on request.\n- **Custom watch:** vendor/product filter + same-day PoC. Price on request.\n\n## Proof of work (today)\n\n- 255 labs in repo, each PoC executed live (rc=0).\n- Feed packed from real artifacts: `python scripts/feed.py`.\n- Sample packed redacted: `python scripts/feed_sample.py`.\n\n## Contact\n\nReply with target vendor/product list + desired tier.\nDelivery: JSON file + PoC scripts, daily refresh via farm cron.\n\n## Honest limits\n\n- Lab PoCs are synthetic fixtures modeling NVD patterns, not\n  zero-days against live products.\n- No live-scope testing included; buyer confirms own scope.\n- Bounty submission service requires buyer's HackerOne token and\n  live-target evidence per report.\n\n\n{\n  \"date\": \"2026-09-15\",\n  \"count\": 3,\n  \"redacted\": true,\n  \"items\": [\n    {\n      \"cve\": \"CVE-2026-81648\",\n      \"cvss\": 10.0,\n      \"published\": \"2026-09-13T21:17:01.930\",\n      \"summary\": \"The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated user\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    },\n    {\n      \"cve\": \"CVE-2026-90519\",\n      \"cvss\": 6.3,\n      \"published\": \"2026-09-13T13:16:27.697\",\n      \"summary\": \"A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. Th\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    },\n    {\n      \"cve\": \"CVE-2026-90520\",\n      \"cvss\": 6.3,\n      \"published\": \"2026-09-13T13:16:28.760\",\n      \"summary\": \"A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown co\",\n      \"poc\": \"[redacted \\u2014 full PoC in paid feed]\",\n      \"has_report\": true\n    }\n  ]\n}", "creation_timestamp": "2026-09-15T16:01:41.261926Z"}