CVE-2026-104356

Published: Ott 02, 2026 Last Modified: Ott 02, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,2
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.

338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
https://github.com/HaschekSolutions/pictshare/commit/ce5fc4…
https://github.com/HaschekSolutions/pictshare/commit/ce5fc474e89769efeae25fee76…
https://github.com/HaschekSolutions/pictshare/releases/tag/…
https://github.com/HaschekSolutions/pictshare/releases/tag/v3.7.1
https://www.vulncheck.com/advisories/pictshare-predictable-…
https://www.vulncheck.com/advisories/pictshare-predictable-delete-code-via-rand