## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x6m4-chr9-cg97. This link is maintained to preserve external references. ## Original Description vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for example by calling eval with malformed source) and then read the error's .stack property; the bridge forwards the .stack read to the host-realm formatter, bypassing the sandbox-side host-path redaction introduced for GHSA-v27g-jcqj-v8rw. The returned stack string discloses absolute paths from vm2, Node.js internals, and the embedding application's own source tree, along with host function names. Default new VM() and new NodeVM() configurations are affected without any special options, and the issue persists when string eval is disabled because the host-side transformer throws before eval is handled. The impact is information disclosure only; no code execution results. Fixed in vm2 3.11.7.
PoC: Hikvision-CCTV-POC
This project is a single-target proof of concept (PoC) for assessing exposure to CVE-2017-7921, an authentication-bypass vulnerability affecting certain Hikvision IP camera and NVR firmware. The script attempts to retrieve a device configuration file and, when the returned data matches the format implemented in this PoC, decrypts and parses it to
PoC: CVE-2026-98260-Xiaomi-17-Pro-Max
CVE-2026-98260 在小米 17 Pro Max 的工程化利用一键 root
PoC: CVE-2026-86596
CVE-2026-86596 - s2Member <= 260927 Weaponized RCE
PoC: cve-2026-109518-apt-patch-proxmox-and-generic
Silly little patch for cve-2026-109518 for apt targeting generic linux and Proxmox host, VM's, containers. CVE happily fixed now by post package maintainers but could be of use. This is how I fixed it while an actual fix was being developed. Tested to work and vibe coded with Claude Opus 5.5.
PoC: CVE-2026-10795_POC
AI amended PoC for CVE-2026-10795 - for educational purposes only - use at your own risk on labs you own ;)
PoC: libtar-CVE-2021-33644-followup
libtar: incomplete fix for CVE-2021-33643/CVE-2021-33644 (heap OOB read in GNU long-name handling)
PoC: php2shell
php2shell (CVE-2026-109618 / CVE-2026-109619) — deliberately vulnerable PHP 8.4.26 lab with a patched 8.4.27 control and a working proof-of-concept that lands a shell as www-data.
PoC: CVE-2026-33439_poc
Proof of Concept for CVE-2026-33439 RCE in OpenAM
PoC: cve-2026-62911-poc
CVE-2026-62911 — Exchange MRSProxy Pre-Auth RCE PoC | Scanner + Exploit | NTLM Relay → Webshell → SYSTEM
PoC: scanner-syno
This is a scanner designed for security researchers to safely detect (using a read-only approach, without executing any exploits) two Synology vulnerabilities discussed in the SVRForum post: [Synology Ransomware Vulnerability CVE-2024-10441 / Synology-SA-24:20](https://svrforum.com/nas/3232929).
PoC: php-legacy-ubuntu
Signed apt repository with patched PHP 5.6-8.2 rebuilds (PHP2Shell CVE-2026-109618/109619) for Ubuntu 18.04 bionic and 20.04 focal
PoC: cve-2026-98432-mitigation
CVE-2026-98432 firewall mitigation for unpatched Linux OS.
PoC: CVE-2026-98432-update
This is the script to update
PoC: domino-emudhra-cert-mitigation
HCL Domino / Notes eMudhra 憑證事件 (CVE-2026-91403) 的最小化清查與移除 SOP，純 keytool，不需大型工具
PoC: RootMyZ9Turbo
Root iQOO Z9 Turbo using CVE-2026-98260
PoC: php2shell-web
Školní projekt: web o kritických zranitelnostech PHP2Shell (CVE-2026-109618/109619)
PoC: infinitycore-x200pro
CVE-2026-98260 temporary-root runner
PoC: ghostlock-z3q
GhostLock (CVE-2026-43499) port kit for the Samsung Galaxy S20 Ultra SM-G988U (z3q, kernel 4.19.113, non-BTF) — binary-first offsets, Samsung hardening map, KernelSnitch negative result, vmemmap roadmap
PoC: CVE-2026-109619-ZendPipelineLab
PHP CVE-2026-109619 stale session state: calibrated mod_php lab reproduction, evidence, and solver
PoC: CVE-2017-18349-fastjson1.2.24-vul
CVE-2017-18349漏洞环境与PoC
PoC: ubuntu-26.04-kernel-cve-2026-98432-patch-build-docker
Docker config that patches/builds kernel w/ CVE_2026_98432 fix
PoC: CVE-2026-122051
PoC and firmware emulation recipe for CVE-2026-122051 — unauthenticated command injection in the Edimax BR-6208AC /goform/mp handler (firmware ≤ 1.32)
PoC: CVE-2026-114550
CVE-2026-114550 / ZDI-CAN-31039: libwebsockets MQTT PUBACK OOB write PoC lab (podman)
PoC: CVE-2026-98432-Wazuh-
CVE-2026-98432 UAF Detection for Wazuh
PoC: CVE-2026-115290
PoC for CVE-2026-115290 (Elasticsearch unauthenticated DoS via the remote cluster server port, CWE-674, ESA-2026-201): validated node kill in a containerized A/B lab (8.19.23 vs 8.19.24)
PoC: zyxel-gs1900-scanner
Detection-only local triage for Zyxel GS1900 CVE-2026-107441 (exploited zero-day): grades model + firmware against Zyxel's .3 fix table and catches the .2 trap
PoC: CVE-2026-98260-GT7Pro-RMX5010
真我 GT7 Pro (RMX5010) 免解BL临时Root · CVE-2026-98260 机型适配 · KernelSU 晚加载 · Temporary root for realme GT7 Pro without bootloader unlock
PoC: php2sherlloktakparani
Exposure scanner and local repro harness for CVE-2026-109618 / CVE-2026-109619 (PHP 8.2-8.5 state corruption on bailout). Stdlib-only Python, offline-capable.
PoC: node2shell-check
Read-only scanner for Node2Shell / CVE-2026-111497
PoC: cve-2026-109518-audit
Read-only audit for CVE-2026-109518: APT HTTP backend hard-link reuse lets an on-path attacker swap a verified package (Debian/Ubuntu)
PoC: cve-2026-98432-mitigation
Script that applies the Ubuntu-published nftables mitigation for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free).
PoC: Mitigation_CVE-2026-98432
This nftables configuration ruleset can help mitigate attacks on your hosts that are vulnerable to CVE-2026-98432. The rule can help block incoming IPv4 TCP connections that contain IP options. Regular TCP connections without IP options can still go through. This is a temporary solution until the Linux Kernels are fully patched.
PoC: cve-2017-7921-hikvision-poc
Single-host PoC for authorized testing of CVE-2017-7921 on Hikvision cameras and NVRs.
PoC: broccoli2shell-gis
Säkerhetsvägledning för GIS-miljöer om Broccoli2Shell (CVE-2026-111497).
PoC: CVE-2026-118306
CVE-2026-118306: Chromium FileSystemAccessManagerImpl Use-After-Free (CVSS 9.6) - PoC, checker, detection rules
PoC: cloudflare-php-ctf-research
Research writeup: php2shell (CVE-2026-109618/109619) vs the Cloudflare PHP CTF — complete local chain, WAF lock analysis, original findings
PoC: CVE-2023-26360
Adobe ColdFusion - CVE-2023-26360
PoC: chromium-audit
Finds every Chromium engine on your PC, checks each against CVE-2026-118306/118331/118348/118344, and updates what it can. | 내 PC의 모든 Chromium 엔진을 찾아 위 CVE 영향권인지 점검하고, 가능한 것은 공식 경로로 업데이트합니다.
PoC: cve-2026-98260-adb
CVE-2026-98260 adb runner with Termux one-tap root
PoC: CVE-2026-44267
CVE-2026-44267 (GHSA-33r5-xmm8-v6x5) - Remote Code Execution vulnerability in @enspirit/elo
PoC: php2shell-analysis
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) 분석과 패치 기준 확인 예제
PoC: mi11-venus-temproot
Temporary root research for Xiaomi Mi 11 (venus / M2011K2C), HyperOS 2.0.6.0, kernel 5.4.274-qgki. Port of the CVE-2026-43499 futex-PI-UAF chain retargeted to this kernel.
PoC: php2shell-lab
Lingkungan laboratorium berbasis Docker Compose serta isolasi toolchain mise + uv untuk materi kuliah dan pembuatan video pembelajaran Keamanan Komputer mengenai CVE-2026-109618 dan CVE-2026-109619 (PHP2Shell).
PoC: CVE-2026-109618
High-level notes for CVE-2026-109618 in PHP mod_php. Exploit code is not included.
PoC: iqooNeo8-V2301A-DirtyFrag
iQOO Neo8 (PD2301/V2301A) 一键越狱 — DirtyFrag (CVE-2026-43284) port on the pyb110 UI
PoC: CVE-2021-42013
vulnerable Apache 2.4.50
PoC: CVE-2026-78818-cyberpanel-phpselection-rce
CVE-2026-78818 - CyberPanel <= 2.4.7 authenticated root RCE via phpSelection command injection + cloudAPI WAF bypass
PoC: php2shell-php-fpm-rce
Unauthenticated RCE exploit for PHP-FPM 8.4.26 via php2shell (CVE-2026-109618 / CVE-2026-109619) - phpMyAdmin 5.2.3, pure-HTTP PoC, defeats ASLR in-band.
PoC: ghostlock-pd2118c-4.19.152
CVE-2026-43499 futex PI UAF on a 4.19.152 ARM64 vendor kernel (iQOO Neo5 / PD2118C, Android 14). L1–L3 reproduced; L4 blocked by the SELinux capability class. Field notes on primitive design, offset derivation and criterion discipline.
PoC: xz-utils-case-study
Cybersecurity Analyst project examining the XZ Utils Backdoor (CVE-2024-3094) and lessons learned from a major software supply chain attack.
PoC: CVE-2026-98432_poc
Python-based PoC for CVE-2026-98432, probing anomalous IPv4 TCP option behavior associated with a Linux kernel use-after-free race condition.
PoC: CVE-2026-97798
CVE-2026-97798
PoC: imaging
Maintained fork of disintegration/imaging: no TIFF/BMP decoders (CVE-2023-36308 gone), GIF palette panic fixed, WebP decode. Pure Go.
PoC: php-7.2.11-cve-2026-109618-fix
Unofficial backport
PoC: CVE-2026-110186
CVE-2026-110186: Langflow OSS code injection via pydoc scanner bypass (CVSS 9.8, pre-auth RCE)
PoC: CVE-2026-21440-adonisjs-bodyparser
Docker-based reproduction lab for CVE-2026-21440. A path traversal / arbitrary file write vulnerability in @adonisjs/bodyparser ≤10.1.1.
PoC: CVE-2022-21675
Demo of CVE-2022-21675 in class
PoC: CVE-2026-58115
CVE-2026-58115: Siemens SIMATIC IoT2050 Node-RED unauthenticated root RCE. PoC, scanner, PCAP, detection rules.
PoC: CVE-2025-32463
PoC From CVE-2025-32463
PoC: wordpress-core-scanner
Detection-only local triage scanner for CVE-2026-119977 (CISA KEV 2026-11-03) in WordPress Core: grades versions 4.7-7.1.3 against per-branch fixes (7.1.4 and backports) and flags wp-content/upgrade exposure. No payloads, no remote probing.
PoC: CVE-2022-23943
CVE-2022-23943 exploit
PoC: CVE-2026-56190-Full-RCE-Chainn
Full unauthenticated RCE chain for Windows Server 2022 by chaining CVE-2026-56190 (RCE) and CVE-2026-42908 (Info Leak). Bypasses ASLR, CFG, XFG, and DEP.
PoC: HTB-Cohort
HTB Cohort writeup -- SSRF, Marimo CVE-2026-39987, PackageKit CVE-2026-41651
PoC: CVE-2026-92183_GIMP_RCE_Proof-of-Concept
GIMP 3.2.2 contains a stack-based buffer overflow in its APNG loader (load_apng_image) when processing the tRNS (transparency) chunk. This writeup demonstrates a proof of concept for remote code execution leveraging this vulnerability.
PoC: the-php2shell-recipe
One recipe, any unpatched build → RCE in ~30 minutes | CVE-2026-109618 research lab: 4-stage chain gdb-verified, 3 RCE builds (8.3.35/8.4.26/8.5.11), adaptation pipeline + profile DB
PoC: cve-2026-98432-mitigation
Temporary nftables mitigation for CVE-2026-98432 (Linux IPv4 TCP IP-options use-after-free)
PoC: cve-2026-80587-check
Temporary: check a Linux host for CVE-2026-80587 (MPTCP)
PoC: CVE-2021-4034
я разобрал уязвимость называемую в простонародии Pwnkit в учебных целях и написал к нему PoC. использовать строго в учебных целях
PoC: CVE-2026-112689-poc
Crash-only reproducer for CVE-2026-112689 in Apple's H.264 hardware decoder
PoC: cve_2026_98432_guard
Temporary eBPF/XDP mitigation for CVE-2026-98432 Linux TCP IPv4 header-options vulnerability. Helps protect unpatched systems and custom kernels until an official kernel fix can be deployed.
PoC: CVE-2026-31431
Research PoC for Linux Kernel LPE (CVE-2026-31431 - Copy Fail). Educational and security research purposes only.
PoC: cve-2026-97229-lab
CVE-2026-97229 lab — Onigmo repeat integer overflow RCE (GitLab CE 19.2–19.4)
PoC: CVE-2019-11478
scripts for vuln versions
PoC: ghostlock-ares
CVE-2026-43499 (rtmutex UAF) port for Redmi K40 Gaming / MediaTek MT6893 / kernel 4.14.186 — work-in-progress, blocked on payload landing
PoC: ansible-ezcve
Ansible role to audit Linux hosts for CVE-2026-98432 (critical IPv4 TCP use-after-free). Checks running kernel against known fixed versions, MPTCP status, and active MPTCP listeners across RHEL, Fedora, Debian, and Ubuntu. Produces clear per-host risk reports (high/medium/fixed). Read-only by default; ideal for fleet-wide inventory before patching.
PoC: CVE-2024-25600-FOR-PYTHON-3.8-AND-ABOVE
The exploit code currently available on internet works perfectly on python >3.10 so i converted exploit code to perfectly run in python 3.8
PoC: tester-linux-cve-2026-98432
Vulnerability/mitigation tester for Linux-kernel CVE-2026-98432
PoC: pardus21-cve-2026-98432
Pardus 21.5 (amd64) için CVE-2026-98432 düzeltmesini Linux 5.10.262 tabanına taşıyan gayriresmî topluluk yaması. Proje, yamalı kaynak kodu, test edilen .deb paketini ve derleme, kurulum ve geri dönüş adımlarını içerir.
PoC: acb-giturl-cve2024-windows
Authorized MSRC ACR Tasks Windows research fixture for CVE-2024-32002; benign one-shot listener marker; do not clone recursively outside the owned test.
PoC: acb-giturl-cve2025
Authorized MSRC ACR Tasks research fixture for CVE-2025-48384 path handling; benign one-shot listener marker; do not clone recursively outside the owned test.
PoC: php2shell-finder
Non-destructive, probabilistic finder for hosts exposed to php2shell (CVE-2026-109618/109619). Blue-team triage; sends no exploit traffic. Authorised use only.
PoC: K80Pro-miro-CVE-2026-98260
Device-bound CVE-2026-98260 adaptation for RedMi K80pro miro OS 3.0.305.0
PoC: node-red-scanner
Detection-only local triage scanner for CVE-2026-58115 (CVSS 10.0) in Siemens SIMATIC IoT2050 Node-RED: grades Industrial OS versions against V4.3.4.1 and settings.js for adminAuth. No payloads, no remote probing.
PoC: cve-2026-98432-mitigation
Interim mitigation for CVE-2026-98432 (Linux IPv4 TCP handshake use-after-free) on Ubuntu, until a fixed kernel ships
PoC: CVE-2025-32433-Erlang-OTP-SSH
Practical vulnerability research and penetration testing report for CVE-2025-32433.
PoC: cve-2026-98260-harmonyos-applicability
锁定设备上的内核 CVE 适用性判定：一个有意保持未定论的适用性结论，以及得到该结论的方法。A vulnerability-applicability study on a locked-down HarmonyOS device: a deliberately unresolved verdict, and the methodology to reach it.
PoC: cve-2026-86596-poc
CVE-2026-86596 s2Member <= 260927 template-injection PoC (lab; IPN verification required)
PoC: cve-2026-98432-defender-toolkit
Exposure audits, hunt queries and a validated interim mitigation for CVE-2026-98432, the use-after-free in the Linux IPv4 TCP handshake. Read-only scripts with a self-test. From GarphenGate Security Research.
PoC: cve-2026-98432-mitigation
cve-2026-98432-mitigation
PoC: CVE-2025-41450-Fromagegate
Technical post-mortem, vulnerability analysis, and OT defense blueprint for CVE-2025-41450 & the October 2026 Fromagegate retail cold-chain sabotage incident.
PoC: cve-2026-98432-mitigation
Interim mitigation for CVE-2026-98432 on Ubuntu
PoC: salesforce-cve-remediation-demo
Unofficial demo built with Devin - synthetic data: CVE-2026-117561 command-injection remediation walkthrough
PoC: CVE-2026-98432
CVE-2026-98432
PoC: cve-2026-98432-linux
Checklist para proteger Linux (desktop e VPS) da CVE-2026-98432
PoC: php_vulnerability_scanner
A Python-based security scanner designed to identify potential exposure to critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which may lead to Out-of-Memory (OOM) conditions and Remote Code Execution (RCE).
PoC: CVE-2026-98432-Checker-v-1.0-
El script hace una revisión de tu Linux frente a esa vulnerabilidad, sin tocar nada por defecto: osea mira tu kernel — lee tu versión real de Linux (uname -r) y la compara con la lista de versiones donde ya está arreglado el fallo.
PoC: infinitylock-app
Android app that checks a supported Vivo X200 Ultra, then uses Shizuku to attempt temporary root with CVE-2026-98260 and load KernelSU. Optional boot auto-root; one attempt per boot.
PoC: CVE-2026-105863
just a poc
PoC: kernel98scan
Is your Linux host exposed to CVE-2026-98432?
PoC: cve-2026-98432-dkms
DKMS mitigation for CVE-2026-98432
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free