### Summary Pinning a CA certificate via `pinnedPeerCertSha256` can lead to the success of MITM attacks in some cases. ### Details https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347 If `r.Config.ServerName` is empty, `DNSName` will be empty and `certs[0].Verify(opts)` will not verify against dNSName or iPAddress. If a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate through the Root CA (using the attacker's own domain name or IP address) and hijack the connections. In Go crypto/tls, either ServerName or InsecureSkipVerify must be specified in the `tls.Config`. If the user specifies `pinnedPeerCertSha256`, InsecureSkipVerify will always be true so ServerName can be empty. In most cases, if the user does not specify the `serverName`, Xray-core will use the server address as the `r.Config.ServerName`. Thanks to `GetTLSConfig(tls.WithDestination(dest))`, ServerName will usually not be empty. However, there are some leftovers: - https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/hysteria/dialer.go#L348 `GetTLSConfig()` without `tls.WithDestination(dest)`. - https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/grpc/dial.go#L139-L142 `GetTLSConfig()` without `tls.WithDestination(dest)`. Although ServerName will not be empty if `address` is a domain name, ServerName will be left empty if `address` is an IP address. ServerName is not equivalent to SNI. > ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client's handshake to support virtual hosting unless it is an IP address. In these cases, if the user does not specify the `serverName`, Xray will not use the server address as the `r.Config.ServerName` and `r.Config.ServerName` will be left empty. ### PoC <details> client.json ```json { "log": { "loglevel": "debug" }, "inbounds": [ { "listen": "127.0.0.1", "port": 1080, "protocol": "socks" } ], "outbounds": [ { "protocol": "hysteria", "settings": { "address": "127.0.0.1", "port": 443, "version": 2 }, "streamSettings": { "security": "tls", "network": "hysteria", "tlsSettings": { "pinnedPeerCertSha256": "e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f" }, "hysteriaSettings": { "version": 2, "auth": "auth" } } } ] } ``` server.json ```json { "log": { "loglevel": "debug" }, "inbounds": [ { "listen": "127.0.0.1", "port": 443, "protocol": "hysteria", "settings": { "version": 2 }, "streamSettings": { "security": "tls", "network": "hysteria", "tlsSettings": { "certificates": [ { "certificateFile": "server2.crt", "keyFile": "server2.key" } ] }, "hysteriaSettings": { "version": 2, "auth": "auth" } } } ], "outbounds": [ { "protocol": "freedom" } ] } ``` Both `server1.crt` and `server2.crt` are issued by the same CA. `server1.crt` is subjected to 127.0.0.1. `server2.crt` is subjected to 127.0.0.2. ``` xray tls hash --cert server1.crt Leaf SHA256: 7f0f1a28f96b7d74e60bbbc263a108ac1243345110f77c45e5bc2fe02851551d CA <Root> SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f xray tls hash --cert server2.crt Leaf SHA256: 32a842063280252bc746a913dce8e38b526021bfc7a2d784632d413dbee0c69c CA <Root> SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f ``` server1.crt ``` -----BEGIN CERTIFICATE----- MIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ70wwDQYJKoZIhvcNAQEL BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE0MzZaFw0zNjA2MzAxMDE0 MzZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAIbLr7M4oU6JPvjnSfkks6oyBl6+j2Ykl32uJX953n/rd1+AO+60 6zzx32eLh0EFGO7SvAsXEsklcGmrwduxCgv7RPjJyMK4pcZ8d3OF5ZxhBJH5i83K cZkTBNu/oKgAJ75BmjVh5LP3rnMASWTLntpK3sfRcXAaZpvvyCSeKQTsoxmRNSzB S3JPvtbbpQ7Q2RgH/ZOcRTNp7jjxCdXut1oTWM3R/MX2YSYf7+lIL0T7g04dp0oI y344uIZISNYFq6LSK2ZLbVqhqC45Zg+TQmqnC3fvhAUPIOxUeJKtf+E2F1qjuXWb y/dk5885n95ooZ2PqXi6mkfluNzt5CcoqU0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw CwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A AAEwHQYDVR0OBBYEFLKSHMaY2Q/VrQYf+dnPctzkYeX9MB8GA1UdIwQYMBaAFAaO Ih36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQCvWejnbhNuGrFR L3FSeFcLXSyNEMl43E0ClUmQ6bZz1wC3C5nPwYijpUatf2s4pCTt6yBPLR4+AgdD e6IR8qJqU1HC6uKtr4beVLx1900K+7AM9nMIW9reOHVvSmiUb7zbw/xfBBbU/ssw M30/bM2KaI6d7av7Co1M4PoQfSop9PIN8TNAJSywCstmUara72/qt0I0QDJ433Cy U5tjtOLDBPszzeS4f7wbTb5V3KULebc6KkjUidrW8E3qFeXaQ/o34huNmYT9HXCS /v/eWrmUSsroYk+tyBARW2dXZ1CQgdOXd9cxKNaRTUm3glprCWQdNN8Gtu5yyWRQ 29bSzHij -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL BQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw MTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7 dTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n W7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT ZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN 3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru 6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36 y0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb h3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN /l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg T9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir kXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7 6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs 6+IZCAM= -----END CERTIFICATE----- ``` server2.crt ``` -----BEGIN CERTIFICATE----- MIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ700wDQYJKoZIhvcNAQEL BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE1MjZaFw0zNjA2MzAxMDE1 MjZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAJjuTx6SOgwTqubOWTGzTf5iQ3nKRyYCHypmcyDLKASaV9n6+oDz WL9Lp9iR4uOrOyOr26eu8bud/yBnFiRz8pAP74ixjFIP8tgDZeSe4rr/4jAKi/Al 1OhQSjvKyaIpSz4uM4H39dQwDyL2hJnKDYmUa7J582b2EgYU7vro6ZvifCIh/i0q ZIgVOJdWkjT+x8xAxfqW3/hC0cA03Ajc3XBPEBGOTASZca8IT10sdgUiBGMHMeBW HLLzz887EdpPn864sy5cQj509ekEP7jc3EBxnxwpqyqktr+Q+h8ExWM7CVIy9Z+H ORT2TxzxefoYFY28a6P7VJ2NNnRJFgIpPf0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw CwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A AAIwHQYDVR0OBBYEFKsSvs+FuZ6lJawi4f7IjAUpfOOBMB8GA1UdIwQYMBaAFAaO Ih36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQBW6Vj7cwNkD6Mm z7kmAl8Xhqste0KcafJzFXaJLHJLfH2ICQ5MtvtyRv+fFbfI2TqfYrQOZWybLJ1I L/MpsccRqMGVvhpe3PNyQKgGnflGpLgN8DsswzrYqFUiWAamJ2GLEz/0DHwGqiy5 Vn4ATcx53Mm4tbWF+87Ul7AlfKaj7YgFq3t1UJWUWBt4GVcQJzSn2Yl2J7vnek4u t7kYrnhw44IBt8Oz2StRH89gulbplVCwJRimmkJQyhK73M2PfRwTOaDSjHqE0FA7 t5JXK1zts2WyP6tZWtyUIDq6hSdvYjyxGffZ5kt810sjcyrk/TnOhFXRuiC5eoXX DfQWbk1o -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL BQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw MTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7 dTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n W7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT ZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN 3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru 6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36 y0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb h3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN /l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg T9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir kXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7 6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs 6+IZCAM= -----END CERTIFICATE----- ``` server2.key ``` -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCY7k8ekjoME6rm zlkxs03+YkN5ykcmAh8qZnMgyygEmlfZ+vqA81i/S6fYkeLjqzsjq9unrvG7nf8g ZxYkc/KQD++IsYxSD/LYA2XknuK6/+IwCovwJdToUEo7ysmiKUs+LjOB9/XUMA8i 9oSZyg2JlGuyefNm9hIGFO766Omb4nwiIf4tKmSIFTiXVpI0/sfMQMX6lt/4QtHA NNwI3N1wTxARjkwEmXGvCE9dLHYFIgRjBzHgVhyy88/POxHaT5/OuLMuXEI+dPXp BD+43NxAcZ8cKasqpLa/kPofBMVjOwlSMvWfhzkU9k8c8Xn6GBWNvGuj+1SdjTZ0 SRYCKT39AgMBAAECggEABa+oq/GSbHQHwPSvrtAkqH51VVAu1Iw0JfKwuamsF324 of95tHU32ccBmuUTu1TYylL/xAyWatwtSgJjOaBBBte814eIeN2kcSExNu6sbfkJ KzGdMeTqNWgU1oPL+vZPmKSFoEG8t3LBAVMKq6AuYCzvUy/DG9Mu6OB64UPrObND neXZT8YZ2Ux0vEV9BAc0z+9tdWVjBy+l5ei6wpjhP69GZiVOsLmKTg/MDT4FN+Pi WJbyHcL1IKTRxxNxDPInBKhEMrxKKAABeXlp5nwnz0gkgUoxK3YHZmxAPr6yCcHP ffeMjpE5BaRKzhimKrOJB4LUES24ltjo+5v5GmZzYQKBgQDSbhiNQpmhOk4ICzwJ 8DMCAigaDm2cD/qC66OFrHhQfr7EC9MRKKC/8WlZYgNepxZ1ZM95+GJu5aTsh7d2 HknwJkxkbTadfRcch9HQun68Y814G0LBDuDRRc9OnBQW6Gr4jTFDP+uqQl6gAfu4 QOjATymrRa5S/21MkQ3Ryb5H4QKBgQC6DI1ETmfvXCOVpEUM9IjeEbiAjVYbUjBL GEOhE0izOv8mjSEgifMSEXJMn58F4nW/UoxtDobTAhQ/WO5BUVCEeQnOAXhV57jU /t/fBbdC7nrVnfFl9KmsOV3LcxUo0yE/x7UiHd1QlwtOTl1KPFQa9WpSehxjjQAS mHYM5PhJnQKBgQCIGHCEm/hkkCL7jNiNzO4QdHifMYmuj58DoYcm4z8FQJP8k3E0 /cPJoEb0ajGnvAUIc+TEC+MNujSKTdRX7or/aKWrpf7WqJqT9zu59YQWL64p6eeo mQjKEI5dVxCfKD5W9mpQBj1S5o3wipfUuRZPmmNmxDBUuaJlDMOVVRddwQKBgCUl bmst8GiFEAHHq5W7mTwlc54PGhsYXNYRgSc+72wBooHy+aNCh8qauyR7VkfZgELz 21/G37pvltVTDzbxYk8gz4lXF8ynGGtGfDJONNnjPZk7EMCXiez+AzEkyBu/k8rl N9AZAGAf2D0JPm0dAHnleBYBlXt24oXT9PX8HWqtAoGBALRX6V1U+bKwMih3N21b 1w/ELI7L1BBAPqJxiQPSOa7kshamZgFenbH1wFLIXz6YwaEOOmYiId6lFjcJaBbF +R4HfxBhOuY6cvD0vEROIRntaqsj4zJXahlZZ9uG1EAYrY2tGKkCUMKN2IBE+WWS 3YTH4WIOsCZriuaHIAyjsCcv -----END PRIVATE KEY----- ``` </details> Expected behavior: The client will fail to establish the connection. Actual behavior: The client succeeds in establishing the connection. ### Impact Xray-core from v26.1.13 to the latest version
PoC: CVE-2026-112445
CVE-2026-112445: The Simplest macOS Local Privilege Escalation to Date
PoC: CVE-2026-43664
AirPods Bluetooth MAC Address Disclosure via NSUserDefaults
PoC: OtherActivityToken
Exploit for CVE-2025-0098, Activity token leak due to pid-only check and then use of that token for arbitrary startActivity()
PoC: CVE-2026-112706-CoreMedia-fd-leak
Independent discovery & coordinated disclosure: CoreMedia bytestream XPC (mediaplaybackd) vended live file descriptors for protected paths to any sandboxed app on iOS 26.5–27.0.1. Fixed in iOS 27.2 as CVE-2026-112706. PoC + evidence.
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: CVE-2026-98260-vivo-x-fold6-poc
CVE 2026 98260 vivo x fold6 poc
PoC: CVE-2026-98260-PMX110-Root618-Jailbreak
CVE-2026-98260 (exec: posix timer UAF) LKM jailbreak for OPPO Find X10 Pro Max (PMX110) and OnePlus 16 (PYB110): one-command root via shell uid 2000, with KernelSU / FinaSU / SukiSU / KernelSU-Next handover. Release build Root618 1.5.12 (R8-obfuscated).
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: brotli-node2shell-check
Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder
PoC: php2shell-lab
Lab reproduction, exposure probe and detection content for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell). Defensive research; no exploit.
PoC: php2shell
🐘 Ansible CVE-2026-109618, CVE-2026-109619 scanner
PoC: CVE-2026-26026-GLPI
Minimal source comparison and local lab files for CVE-2026-26026 in GLPI 11.0.5 and 11.0.6
PoC: CVE-2026-98432
Linux kernel IPv4 SYN IP-options use-after-free CVE-2026-98432 Mitigation work (Ansible Role)
PoC: cve-2026-98432-mitigation
Temporary mitigation for CVE-2026-98432 (Linux IPv4 TCP ireq_opt use-after-free): drop IPv4 TCP with IP options, disable MPTCP. Tested scripts + verification. EN/KO.
PoC: kpatch-cve-2026-98432
kpatch livepatch for CVE-2026-98432 (and CVE-2026-99999) on AlmaLinux and Rocky Linux 8, 9 and 10
PoC: phishing-analysis-thm
SOC-style investigation of a Netflix phishing email, CVE-2017-11882 exploitation, IOC extraction, and detection engineering mapping.
PoC: CVE-2026-33439
Pre-auth RCE exploit for OpenIdentityPlatform OpenAM <=16.0.5 via Java deserialization of the jato.clientSession parameter (CVE-2026-33439, CVSS 9.8). Comparator-based gadget chain with in-band command output through Tomcat ApplicationFilterChain thread-locals.
PoC: FBI-Tor-Exploit-CVE-2013-1690
Academic cybersecurity research project analyzing and restoring the FBI's 2013 Tor Browser deanonymization exploit, focusing on CVE-2013-1690, Firefox use-after-free vulnerabilities, exploit mechanisms, and historical forensic analysis.
PoC: Bootjack
CVE-2026-97631 C
PoC: CVE-2026-48907
Adapted PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5
PoC: cve-2026-98432-audit
cve-2026-98432 audit script (ipv4 TCP inet_opt/ireq_opt use-after-free)
PoC: php2shell-poc
CLI scanner and PoC for CVE-2026-109618 / CVE-2026-109619 (PHP OOM heap corruption and session upload-progress injection, CVSS 9.2). Affects PHP 5.4.0-8.5.11; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12. No external dependencies.
PoC: CVE-2026-88804
PoC CVE-2026-88804 (Rancher)
PoC: php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
PoC: CVE-2026-98260-dada-android
Verified CVE-2026-98260 Android port for Xiaomi 15 dada OS4.0.0.22.XOCCNXM
PoC: CVE-2025-4960
Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer
PoC: ghostlock-kirkwood
CVE-2026-43499 (GhostLock) port for the Google TV Streamer (kirkwood / MT8696): single-file, per-boot temporary root + interactive root shell, with a build-matching case study and adaptation guide.
PoC: node2shell
Node2Shell (CVE-2026-111497) detection-only scanner + lab — RedSide Security
PoC: CVE-2026-97555
CVE-2026-97555: heap overflow in the Linux SMB client DACL rewrite (cifs.ko) — analysis, POC, and an arm64 exploit chain ending in a uid-0 credential overwrite on the reference build
PoC: cve-2026-110311-gitea-lab
Local Gitea CVE-2026-110311 reproduction: vulnerable vs patched comparison, Python verifier, recorded evidence, and Turkish report.
PoC: nginx-rift-cve-2026-42945-lab
Interactive NGINX CVE-2026-42945 educational simulation built with HTML, CSS, and JavaScript. Features vulnerable and patched modes, synthetic request inspection, memory visualization, event logging, and security recommendations. No real exploit execution.
PoC: CVE-2026-12118-POC-
POC for CVE-2026-12118
PoC: CVE-2026-104286
Exploit for CVE-2026-104286 — FortiMail: Unauthenticated Arbitrary File Write → Code Execution
PoC: node2shell
Scanner to checking (CVE-2026-111497) vulnerability
PoC: PHP2Shell
CVE-2026-109618 & CVE-2026-109619 — Pre-Auth RCE in PHP Core (session.upload_progress). Scanner, exploit verifier, and full technical analysis.
PoC: CVE-2026-50053
Offline Python detector for CVE-2026-50053 version exposure in Zimbra Collaboration Suite.
PoC: CVE-2026-115889
Offline Python detector for CVE-2026-115889 version exposure in Wasmtime.
PoC: CVE-2026-53921
Offline Python source-pattern auditor for CVE-2026-53921 in odhcpd.
PoC: gitlab-rce-toolkit
CVE-2026-97229 + CVE-2026-110264 — GitLab Onigmo RCE Exploit Toolkit (CVSS 10.0)
PoC: CVE-2026-101259
Reproducer for CVE-2026-101259 — Apache Camel camel-coap consumer sent the exception message to the CoAP client as a 5.00 payload (CWE-209). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-71569
Reproducer for CVE-2026-71569 — Apache Camel camel-a2a push-notification webhook guard accepted an IPv6 unique local address (fc00::/7) reached through a host name (CWE-918). Camel Spring Boot + Camel Quarkus.
PoC: RDPBleed
CVE-2026-56190 - Windows RDP Server Uninitialized Resource leads to RCE
PoC: CVE-2026-94386
Reproducer for CVE-2026-94386 — Apache Camel camel-oauth cross-scope token reuse via a JVM-global token cache keyed only on endpoint+clientId (CWE-524). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-95629
Reproducer for CVE-2026-95629 — Apache Camel camel-docling passed the CamelDoclingOutputFilePath header to docling's --output verbatim (CWE-22). Camel Spring Boot + Camel Quarkus.
PoC: php2shell-advisory-response
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) advisory response: inventory, patch, Wazuh hunt mapping, attestation outline.
PoC: CVE-2026-95628
Reproducer for CVE-2026-95628 — Apache Camel camel-docling custom-argument path validation did not reject absolute paths, an incomplete fix of CVE-2026-40047 (CWE-22). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-95663
Reproducer for CVE-2026-95663 — Apache Camel camel-keycloak served a cached token introspection result past the token's expiry (CWE-613). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-97798_LPE_Windows
CVE-2026-97798 PoC — WER Time Travel Debugging argument injection to SYSTEM (Windows 11 LPE), with an adaptive faultrep.dll resolver.
PoC: CVE-2026-95664
Reproducer for CVE-2026-95664 — Apache Camel camel-aws2-s3 evaluated a header-supplied object key as a Simple expression (CWE-917). Camel Spring Boot + Camel Quarkus.
PoC: woff2shell
poc of CVE-2026-111497 delivered as a WOFF2 file
PoC: wiz-bulb-tool
WiZ smart bulb LAN security tool - auto-discovery, CVE-tagged audit, intel recon & device control. Extends CVE-2019-18980 to new hardware. No credentials required.
PoC: CVE-2026-90885
Reproducer for CVE-2026-90885 — Apache Camel camel-saxon XQuery XML External Entity via an already-built javax.xml.transform.Source (CWE-611, HIGH). Camel Spring Boot + Camel Quarkus.
PoC: cve-2026-109618-cve-2026-109619-poc
pHp2Shell CVE 2016 109618 - 109619
PoC: php2shell
Realistic multi-version lab + toolkit for the PHP php2shell pre-auth RCE (CVE-2026-109618/109619): detect, blindly prove, and understand it. No shared mounts, no planted files, no LFI.
PoC: secure-api-cve-2024-23897
Work 1 — secure Flask REST API, three-stage CI, and CVE-2024-23897 (Jenkins CLI) analysis
PoC: charla-php2shell
PHP2Shell (CVE-2026-109618/109619): demos reproducibles y guia de parcheo paso a paso.
PoC: PHP2shell
CVE-2026-109618_CVE-2026-109619
PoC: waffers
The layer that protects you. Proactive defense-in-depth Web Application Firewall mitigating recent critical PHP engine vulnerabilities including PHP2Shell (CVE-2026-109618/9), PHP-CGI Argument Injection (CVE-2024-4577), iconv Filter Chains (CVE-2024-2961), and stream wrapper abuse.
PoC: node2shell-inventory-scanner
Local inventory triage for Node2Shell (CVE-2026-111497): grade every Node, Bun and Brotli copy on disk. Detection-only, no network probes, no payloads.
PoC: php2shell-check
A Claude Skill that passively checks whether a website (and optionally its subdomains) runs PHP, confirms the version where possible, and flags exposure to PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: CVE-2026-97631-PoC
An educational laboratory for studying a PXE network-boot vulnerability in EDK II / OVMF. It builds a pinned EDK II revision, boots a UEFI virtual machine in QEMU, and includes Python proof-of-concept scripts for investigating denial of service (DoS) and memory corruption.
PoC: practica-integradora-ciberseguridad
Práctica Integradora de Ciberseguridad (Comisión 1) - Investigación, análisis técnico y laboratorio práctico de CVE-2021-41773 (Apache HTTP Server)
PoC: node2shell-audit
Read-only audit for Node2Shell (CVE-2026-111497): Node.js/Bun Brotli decoder out-of-bounds write
PoC: cve-2026-111497-wordpress-poc
CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress
PoC: demo-zip-rce-sandbox
Live demo: the same vulnerable Rust zip crate (RUSTSEC-2026-0367 setuid + CVE-2026-115905 zip cloaking) contained by a deny-by-default Cosmonic WebAssembly sandbox.
PoC: php2leak
Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)
PoC: CVE-2026-101767-research
Research notes on CVE-2026-101767 — unauthenticated vulnerability in Oracle Application Object Library (E-Business Suite)
PoC: threat-intelligence-log4shell-analysis
Cybersecurity research project analyzing threat intelligence feeds, Log4Shell (CVE-2021-44228), attack progression, remediation, incident response, and threat hunting.
PoC: CVE-2026-15723
Offline Python detector for CVE-2026-15723 version exposure in self-managed GitLab CE/EE, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-105014
Offline Python applicability detector for CVE-2026-105014 in Azure Pipelines, with strict CSV/JSON inventories and auditable reports.
PoC: CVE-2026-114625
Offline Python detector for CVE-2026-114625 exposure in on-premises VeloCloud Orchestrator, with train-specific build checks and auditable reports.
PoC: CVE-2026-97785
Offline Python applicability detector for CVE-2026-97785 in Microsoft Entra application proxy, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-83938
Offline Python applicability detector for CVE-2026-83938 in Azure Kubernetes Configuration Service, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-110063
Offline Python applicability detector for CVE-2026-110063 in Azure VM Inspector, with strict CSV/JSON inventories and auditable reports.
PoC: php56-amzn1-security
Security-patched php56 RPMs for Amazon Linux 1 (AMI 2018.03): PHP2Shell (CVE-2026-109618, CVE-2026-109619) and post-5.6.40 fixes backported from deb.sury.org
PoC: CVE-2026-109618-exploit
[PHP2Shell] Golang exploit for CVE-2026-109618 / CVE-2026-109619: Unauthenticated RCE in PHP 5.4–8.5.11 via OOM corruption + session.upload_progress UAF
PoC: CVE-2026-93903
Security advisory for CVE-2026-93903 affecting LiteSpeed Web Server.
PoC: s25u-ghostlock-kernelsu-lkm
Galaxy S25 Ultra (SM-S9380): GhostLock/CVE-2026-43499 memory-only root + KernelSU LKM via kallsyms prelink; Zygisk findings
PoC: cve-2026-98260-uaf
CVE-2026-98260 (posix-cpu-timers exec UAF) exploit research: S9280 Android 14 GKI 6.1 — UAF trigger + zero-write primitive + SELinux Permissive. Handoff doc in HANDOFF.md
PoC: copy-fail-CVE-2026-31431-aarch64
Linux 4.19 aarch64 PoC for CVE-2026-31431 (Copy Fail) - AF_ALG/authencesn page-cache write
PoC: aia-pdfjs-poc
CVE-2024-4367 PDF.js FontMatrix PoC - authorized pentest artifact
PoC: CVE-2025-10035
CVE-2025-10035 is a critical vulnerability in Fortra GoAnywhere MFT that may allow attackers to execute commands remotely on a vulnerable server.
PoC: CVE-2026-35223-Joomla-Access-Control
Proof of Concept for CVE-2026-35223 – Joomla Improper Access Control
PoC: php2shell-audit
Non-intrusive detector for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) - scans codebases and live hosts for vulnerable PHP versions and risky config. Detection, not exploitation.
PoC: TimerRoot
Android front end for CVE-2026-98260: root shell + KernelSU late-load through Shizuku
PoC: php2shell-fixed-images
Reproducible RHITE fixed PHP runtime images for CVE-2026-109618 and CVE-2026-109619
PoC: php-worker-pin
Multi-worker exploitation of the PHP 8.5 OOM-to-RCE chain (CVE-2026-109618/109619): pool pinning, measured
PoC: PHP2SHELL-Lab
Laboratorio para detectar y explotar las vulnerabilidades CVE-2026-109618 y CVE-2026-109619
PoC: CVE-2026-79397-Authenticated-OS-Command-Injection-in-ONT-4GE-RFDW-Ping-Diagnostics
Authenticated OS command injection in ONT-4GE-RFDW’s Ping diagnostics exploitable via default credentials.
PoC: rw-salon
CVE-2024-4442
PoC: rw-tutor
CVE-2024-4223
PoC: CVE-2026-111497-DOS-
CVE-2026-111497 DOS
PoC: rw-stock
CVE-2024-36779
PoC: php2shell-nse-scanner
Advanced Nmap Scripting Engine (NSE) script designed to identify PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619). Features multi-layer Black-Box analysis resilient against WAF, proxies, and header stripping.
PoC: rw-web-directory-free
CVE-2024-3552
PoC: cve-2025-27740
Proof-of-concept exploit for CVE-2025-27740 Subject Key Identifier injection in Active Directory Certificate Services
PoC: rw-country-state-city-auto-dropdown
cve-2024-3495
PoC: rw-fluentform
CVE-2024-2771
PoC: CVE-2023-42824
PoC / exploit archive for CVE-2023-42824
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free