Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

PoC: CVE-2026-21155-SVE-2026-3546

Writeup CVE-2026-21155

PoC: CVE-2026-112611

CVE-2026-112611: OOB Write in CoreGraphics (PDF ShadingType 5) via /N and /C0 array mismatch. Causes heap overflow (DoS). The Python PoC generates the malicious PDF, while the C-code uses a SIGSEGV handler to map the faulting memory and confirm the write primitive.

PoC: CVE-2026-119977

Read-only local WordPress version assessment for CVE-2026-119977.

PoC: CVE-2026-123488-CraftCMS-Lab

PoC for CVE-2026-123488: unauthenticated SQLi in the element search endpoint (CWE-89) escalating to admin via stacked UPDATE;

PoC: m6-shell

M6 Shell：荣耀 Magic6 Pro (BVL-AN16) 一键临时 root。Shizuku 拿 shell + CVE-2026-98260 UAF + 装载匹配内核的 KernelSU 模块，源码与构建产物都在这。

PoC: meizu20pro-temp-root

MEIZU 20 Pro 临时 Root 指南（锁定 BL）：DirtyFrag (CVE-2026-43284) 与 GhostLock (CVE-2026-43499)

PoC: CVE-2026-86777-AlchemyCMS-Navigation-Disclosure

Technical research and proof of concept for CVE-2026-86777 affecting AlchemyCMS.

PoC: CVE-2026-94113-ERPNext-Timesheet

Technical analysis and proof of concept for CVE-2026-94113 — Missing Authorization in ERPNext Timesheet endpoints.

PoC: CVE-2026-123158

sshole (CVE-2026-123158): OpenSSH password bypass on alpine Linux

PoC: Tryhackme-PHP2Shell

Documentación técnica del laboratorio PHP2Shell de TryHackMe, centrado en el análisis y explotación de la vulnerabilidad CVE-2026-109619.

PoC: cve-2026-111967

WordPress Plugin MP3 Audio Player by Sonaar <= 5.14 - Stored XSS to Admin Account Creation

PoC: TryHackMe-PHP2Shell-CVE-2026

Análisis de vulnerabilidades PHP2Shell (CVE-2026-109618 y CVE-2026-109619) — TryHackMe

PoC: iqoo-neo5-temp-root

iQOO Neo5 (PD2055) temporary root research: CVE-2026-43499 exploit port, kernel kallsyms extraction (109,641 symbols), vivo OTA protocol crack, boot.img for community analysis

PoC: CVE-2026-63030

CVE-2026-63030 — WordPress Core Pre-Auth RCE (WP2Shell). PoC by NOXCRYPT (noxcrypt-x).

PoC: cve-2026-123158-defender-toolkit

CVE-2026-123158 (SSHole) defender toolkit: exposure audit, log hunts and a safe password switch-off for OpenSSH on Alpine and other musl systems

PoC: coruna-lab

Coruna / CVE-2024-23222 reproduction lab on GitHub-hosted ARM64 runners

PoC: ShellSpectre

⚡ Modern, multi-threaded CLI framework for detecting PHP core multipart vulnerabilities (CVE-2026-109618/19) with zero-false-positive calibration and auto-venv management.

PoC: CVE-2026-83844_POC

Signed Microsoft Paint A/B research lab; CVE trigger not yet confirmed

PoC: pd2301-dirtyfrag-root

iQOO Neo8 (PD2301/V2301A) DirtyFrag 临时 root 完整记录 — CVE-2026-43284 页缓存写 + vivo_coredump shim 劫持 umh

PoC: CVE-2026-13684

CVE-2026-13684 — Synology DSM Arbitrary File Read/Write + DoS

PoC: CVE-2020-13405-MicroWeber-PoC

Proof of Concept and vulnerability research for CVE-2020-13405 affecting Microweber CMS.

PoC: CVE-2026-99273

PoC and containerized lab for CVE-2026-99273 — Linux ksmbd writes a UTF-16 terminator 2 bytes past a 448-byte response buffer in get_file_stream_info() (SMB2 QUERY_INFO FileStreamInformation): exact-fill stream entry and trailing ::$DATA path, guest-reachable. Validated end-to-end on Linux 7.3.0 ef85bad3 (vulnerable, KASAN) vs patched.

PoC: CVE-2019-2215-ForMIpad4

使用CVE-2019-2215 对miui10的小米平板4的临时root获取软件。

PoC: acw3-tls-lab

Local CVE-2026-19553 TLS lab with a guarded Ubuntu 24.04 setup and seven demonstration tests.

PoC: cve-2026-98260-bvl-an16

CVE-2026-98260（exec 非主线程 + POSIX CPU timer UAF）在荣耀 Magic6 Pro（BVL-AN16，内核 6.1.157）上的移植与利用实现：源码、构建脚本、偏移与 slab 参数记录。

PoC: CVE-2026-121265

PoC for CVE-2026-121265 (SQL::Abstract < 2.000003 arrayref SQL injection, CWE-89): INSERT/UPDATE exfiltration, privilege escalation and generate()/AUTOLOAD vectors, validated in a containerized version matrix incl. the array_datatypes=0 bypass of the final patch

PoC: DFRoot-DirtyFrag

Fork de mitschud/DirtyFrag (CVE-2026-43284 page-cache exploit) con port G998U — ko dfroot-android15-5.4.ko embebido para SM-G998U/HZB1 (kernel 5.4.274-qgki). Flujo de app oficial diabl0w/DFRoot; manager KSU oficial me.weishu.kernelsu.

PoC: sonicwall-sonicos-scanner

Detection-only triage for CVE-2026-19868 (SonicWall SonicOS SSL-VPN SAML MFA bypass, CISA KEV 2026-11-06): grade Gen7/Gen8 firmware against the 7.3.4-7013 / 8.2.3-8015 fixes. No traffic, no probes.

PoC: cve-2023-6931-hitv205n

CVE-2023-6931 temporary-root port for Hisense HITV205N (TOUCH Lite), kernel 4.19.157-perf

PoC: CVE-2026-42016_CVE-2026-42018

CVE-2026-42018 / CVE-2026-42016 — JFrog Artifactory Token Chain (Scoped PoC)

PoC: php2shell-deep-dive

A deep technical walkthrough of PHP2Shell from memory visualization of a real exploit against PHP 8.4.26's Steal My Bitcoin challenge, to PHP's source code internals and engine, to the exploit code itself. How two CVEs in PHP's core (CVE-2026-109618 & CVE-2026-109619) chain an out-of-memory crash into remote code execution

PoC: MaSSHole

MaSSHole v1.3.0: detection-only checker for *sshole (CVE-2026-123158), with Docker test lab

PoC: check-sshole

Read-only exposure and compromise check for CVE-2026-123158, the musl-only OpenSSH password-auth bypass

PoC: CVE-2026-83844

Technical Exploitation Analysis of Paint2Shell CVE-2026-83844

PoC: CVE-2023-34468-Apache-NiFi-RCE

CVE-2023-34468: Apache NiFi 1.21.0 Remote Code Execution (ExecuteProcess Variant) - Security Research & Analysis by Mohammed Moshii

PoC: cve-2026-98432-mitigation

Temporary nftables mitigation for CVE-2026-98432 (critical TCP/IPv4 handshake use-after-free in the Linux kernel)

PoC: salt-cve-2020-11651-poc

Dependency-free PoC for SaltStack CVE-2020-11651/11652 that runs on modern Python (pyzmq + msgpack, no salt library)

PoC: GhostKey

Ephemeral root through CVE-2026-98260 vulnerability (GhostKey).

PoC: 360-kidwatch-11X-W370-Ghostroot

A stealthy, file-based Local Privilege Escalation (LPE) PoC for 360 11X W370 (Unisoc SC8541E, Android 8.1) exploiting CVE-2025-31710. No PC required. For research only.

PoC: CVE-2026-96838

CVE-2026-96838: Cross Site Request Forgery (CSRF) in Blacklist Manager for WooCommerce WordPress Plugin. PoC by Mor Golan.

PoC: CVE-2026-95597

CVE-2026-95597: Unauthenticated Settings Change in PGALL for WooCommerce (????? ?? ????) WordPress Plugin. PoC by Mor Golan.

PoC: cve_2026_98432_livepatch

Reference livepatch for CVE-2026-98432 on Ubuntu 22 5.15.0-71-generic

PoC: CVE-2026-94641

CVE-2026-94641: Unauthenticated Cross Site Scripting (XSS) in UsersWP WordPress Plugin. PoC by Mor Golan.

PoC: CVE-2026-94074

CVE-2026-94074: Unauthenticated Broken Access Control in Simply Schedule Appointments WordPress Plugin. PoC by Mor Golan.

PoC: CVE-2026-61989

CVE-2026-61989: Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings WordPress Plugin. PoC by Mor Golan.

PoC: CVE-2026-39732

CVE-2026-39732: Unauthenticated SQL Injection in Transliterator WordPress Plugin. PoC by Mor Golan.

PoC: CVE-2026-122675

CVE-2026-122675: Cross Site Request Forgery (CSRF) in Wp Social WordPress Plugin. PoC by Mor Golan.

PoC: CVE-2026-115596

CVE-2026-115596: Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog WordPress Plugin. PoC by Mor Golan.

PoC: CVE-2026-112869

CVE-2026-112869: Unauthenticated Cross Site Scripting (XSS) in We're Open! WordPress Plugin. PoC by Mor Golan.

PoC: CVE-2026-112222

CVE-2026-112222: Broken Access Control in Surfer WordPress Plugin. PoC by Mor Golan.

PoC: SOC-wordpress-compromise-report

Incident report: WordPress compromise via Simple File List RCE (CVE-2020-35489)

PoC: CVE-2026-19868

SonicWall SonicOS SSLVPN SAML / MFA bypass (Gen7 / Gen8)

PoC: w25-cve-2026-43499-notes

Field notes: CVE-2026-43499 on Samsung Galaxy W25 (SM-W9025, CHC) - offsets, failed routes, repro

PoC: module-sessionreaper-patch

Free security patch for Magento Open Source and Mage-OS by Big Cart Energy: closes CVE-2025-54236 (SessionReaper) on the Magento 2.3 and 2.4 releases that have no official fix, as one plugin on the Web API input processor that applies the allow-list of Adobe's fix. No core file is modified.

PoC: module-cosmicsting-patch

Free security patch for Magento Open Source and Mage-OS by Big Cart Energy: closes CVE-2024-34102 (CosmicSting) on the Magento 2.3 and 2.4 releases that have no official fix, as one plugin on the Web API input processor that applies the rule of Adobe's fix. No core file is modified.

PoC: MiTV-MFTP0-GhostLock

GhostLock (CVE-2026-43499) port for Xiaomi MiTV-MFTP0 (alita / L65R8-X), MediaTek MT9652, Android 9, kernel 4.9.118 - futex PI UAF LPE, full partition map, TvService backdoor analysis.

PoC: CVE-2026-109618

Test the CVE-2026-109618 in a safe environment (VMware, VirtualBox,...)

PoC: redmi-k50-temp-root

Redmi K50 (rubens) 临时 Root 教程 — 基于 DirtyFrag (CVE-2026-43284) + libbase fallback

PoC: keycloak-saml-scanner

Detection-only triage for CVE-2026-117691 (CVSS 9.1): Keycloak SAML HTTP-Redirect binding signature bypass, fixed in 26.8.2

PoC: Solarium

An object-oriented Swift implementation of CVE-2023-41974

PoC: CVE-2026-123014---iTerm2-Terminal

PoC and research for CVE-2026-123014: iTerm2 x-man-page NUL-byte argument injection.

PoC: sshole

A simple reproducer for CVE-2026-123158

PoC: CVE-2026-83844-Detection

Detection and remediation scripts for CVE-2026-83844, Windows Paint remote code execution (CVSS 8.1)

PoC: cve-2026-123158-openssh-musl-lab

Automated Terraform lab environment for OpenSSH on Linux with musl libc without PAM (CVE-2026-123158 research)

PoC: CVE-2026-123488-POC

POC exploit for CVE-2026-123488 - unauthenticated SQL injection vulnerability in Craft CMS (MySQL/MariaDB backend). Admin takeover.

PoC: cve-2026-48356-magento-file-upload-rce

CVE-2026-48356 - Adobe Commerce/Magento Unrestricted File Upload RCE | CVSS 9.3 | By Gh0st-Bx1

PoC: cve-2025-32433-erlang-ssh-preauth-rce

CVE-2025-32433 - Erlang/OTP SSH Pre-Authentication RCE | CVSS 10.0 | By Gh0st-Bx1

PoC: cve-2026-97229-gitlab-ci-rce

CVE-2026-97229 - GitLab CE/EE CI/CD Integer Overflow RCE | CVSS 10.0 | By Gh0st-Bx1

PoC: CVE-2026-118423-WP-Libre-Form

Sable Research — Analysis of CVE-2026-118423: Unauthenticated Arbitrary File Upload to RCE in WP Libre Form (≤ 1.5.0.1)

PoC: mysql-connector-j-cve-2026-101678-repro

Reproducer for CVE-2026-101678 (MySQL Connector/J <= 26.7.0) - malicious server reporting huge result-set column count

PoC: php2shell-lab

PHP session.upload_progress CVE-2026-109618 lab PoC and research notes

PoC: CVE-2026-123158_SSHRole_PoC

Prova de conceito para exploração da vulnerabilidade CVE-2026-123158.

PoC: cve-2026-113615-poc

CVE-2026-113615 - GS JWT <= 1.0.0 unauthenticated SQLi to administrator JWT (PoC + exploit by thiscitze)

PoC: openssh-musl-enterprise--hardening-cve-2026-123158

openssh-musl-enterprise-hardening (CVE-2026-123158)

PoC: CVE-2015-1201-wordpress-Reflex-Gallery-plugin-RCE-PoC

PoC exploit for CVE-2015-1201 (EDB-36374) — Unauthenticated Arbitrary File Upload to Remote Code Execution in WordPress Reflex Gallery Plugin ≤ 3.1.3. Features interactive webshell, reverse shell mode, and multi-path upload fallback.

PoC: logsign-rce

Logsign Unified SecOps Platform: Pre-Auth Authentication Bypass (CVE-2024-5716) & RCE (CVE-2024-5717) Exploit Chain & Detection Suite

PoC: CVE-2026-118423

CVE-2026-118423 — WP Libre Form <= 1.5.0.1 unauthenticated file upload to RCE (PoC, lab-verified)

PoC: CVE-2026-83844-PoC-MS-paint-v-11.2609.401.0

A proof of concept for CVE-2026-83844. Microsoft paint version 11.2609.401.0

PoC: sshole_scanner-CVE-2026-123158

A scanner for *sshole SSH vulnerability (CVE-2026-123158)

PoC: cortex9-openssl-asn1-string-nul-scanner

Lexical scanner for ASN1_STRING uses that assume NUL termination (CVE-2021-3712). Labels are NUL_SINK_WARNING, BOUNDED_PATTERN or UNKNOWN; heuristic, not a flow analysis.

PoC: cortex9-rust-regex-empty-repetition-size-limit-model

Offline model of the regex 1.5.4 compile-size accounting for empty repetitions (CVE-2022-24713), checked against regex-syntax HIR and real compile results. Bounded cases are labelled MODEL_LIMIT.

PoC: cortex9-node-tar-path-sanitization-model

Offline Python port of node-tar path sanitization (CVE-2021-32804, CVE-2021-37713) with a differential check against the original CHECKPATH logic. No archives are extracted.

PoC: cve-2026-100109-poc

CVE-2026-100109 - Security For WooCommerce 1.0.10-1.0.16 unauthenticated admin creation (PoC by thiscitze)

PoC: cve-2026-114630-poc

CVE-2026-114630 - ELEX HelpDesk <= 3.3.8 unauthenticated arbitrary file deletion (PoC by thiscitze)

PoC: cve-2026-118423-poc

CVE-2026-118423 - WP Libre Form <= 1.5.0.1 unauthenticated upload to RCE (PoC by thiscitze)

PoC: cortex9-heartbleed-heartbeat-bounds-model

Offline model of the OpenSSL heartbeat bounds check (CVE-2014-0160) over an in-memory record and a labelled simulated region. No TLS, no real memory.

PoC: cortex9-rust-str-repeat-capacity-overflow-model

Abstract execution of Rust [T]::repeat capacity arithmetic in 1.29.0 vs 1.29.1 (CVE-2018-1000810) for 16/32/64-bit usize. Allocates nothing.

PoC: cortex9-expat-utf8-name-validation-model

Offline Python model of expat's UTF-8 name checks before/after the CVE-2022-25235 fix, with an independent RFC 3629 decoder. No XML parsing of untrusted input.

PoC: cortex9-dirtycow-gup-cow-state-model

Finite state/interleaving model of the GUP FOLL_WRITE/COW race vs MADV_DONTNEED (CVE-2016-5195). Abstract states only, no syscalls.

PoC: cortex9-expat-namespace-separator-model

Offline Python model of expat addBinding/namespace-separator handling in 2.4.4, 2.4.5 and 2.4.7 (CVE-2022-25236). String-level only.

PoC: cortex9-tmpfiles-hardlink-chown-race-model

Limited educational in-memory FS model of systemd-tmpfiles path_set_perms vs hardlinks (CVE-2017-18078). Not a finding; no real files.

PoC: vsftpd-2.3.4-backdoor-vulnerability_analysis

Hands-on vulnerability assessment of the vsftpd 2.3.4 backdoor (CVE-2011-2523) in an isolated lab.

PoC: cortex9-time-crate-env-race-interleaving-model

Finite interleaving model of time 0.2.22 tzset/getenv vs setenv realloc (CVE-2020-26235). No threads, libc or real environment.

PoC: vsftpd-2.3.4-backdoor-vulnerability-analysis

Hands-on vulnerability assessment of the vsftpd 2.3.4 backdoor (CVE-2011-2523) using Kali Linux, Nmap, Metasploit and an isolated Metasploitable 2 lab.

PoC: CVE-2026-83844

CVE-2026-83844

PoC: check-sshole

Find Dockerfiles that ship an sshd exposed to *sshole (CVE-2026-123158). CLI, pre-commit hook and GitHub Action.

PoC: CVE-2026-123025

OS command injection as root via Google Cloud DNS challenge key

PoC: ansible-sshole-remediate

Ansible playbook that upgrades OpenSSH to 10.6p2 on Alpine Linux to remediate CVE-2026-123158

PoC: CVE-2026-98260-pkt110-kernelsu

CVE-2026-98260 (posix-cpu-timers UAF) to KernelSU on a bootloader-locked OPPO PKT110: exploit core, on-device app, and the research write-up.

PoC: cortex9-openssl-bn-mod-sqrt-loop-model

Pure-Python port of OpenSSL BN_mod_sqrt before/after the CVE-2022-0778 fix, with a step budget on the loops that can grow. Offline.