CVE-2026-103442
MergeAccount PHP object injection via session-key substitution
CVSS score
7.2
EPSS probability
%0.3
Risk score
0.0
Published
15 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
Sanitized report summary and local PoC for CVE-2026-103442
Makefile Go / Python
Similar Vulnerabilities
9.8
CVE-2026-103044
EasyTimeline should not serve image maps as application/xml
TW
Patch verifiedEPSS %0
7.4
CVE-2026-103446
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
TW
Patch status unknownEPSS %0
7.2
CVE-2026-103441
Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
TW
Patch status unknownEPSS %0
6.9
CVE-2026-96878
Cargo Exhibit field alias allows stored XSS
TW
Patch status unknownEPSS %0
6.9
CVE-2026-96877
Reflected XSS through Cargo Drilldown full-text search
TW
Patch status unknownEPSS %0
6.9
CVE-2026-96876
Anonymous reflected XSS in CargoExport invalid-alias errors
TW
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-103442"