## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9cqf-hhrq-7v45. This link is maintained to preserve external references. ## Original Description SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.
PoC: plz110-6.12.69-cve-2026-64560-ksu
一加 15T（PLZ110）临时 root + KernelSU per-boot 接管：CVE-2026-64560 移植，不写分区、重启即失效。内核 6.12.69-android16-6-g242e1a07f878。
PoC: CVE-2026-96889-nextjs-rce
Lab PoC for CVE-2026-96889: Next.js Image Optimization SVG typed as AVIF reaches librsvg UAF (RUSTSEC-2026-0305). Unauthenticated RCE on glibc Linux.
PoC: CVE-2026-89079
CVE-2026-89079 — WordPress Theme My Login multisite unauth password overwrite PoC (check, verify, exploit). Not version-only: requires MS + tml_user_passwords.
PoC: Gitlab-RCE-CVE-2026-97229
CVE-2026-97229: GitLab RCE Unauthenticated via CI Lint
PoC: vivo-dirtyfrag-root
Temporary root on locked-bootloader vivo devices (tested: S17 Pro / PD2284 / MT6896Z / 5.10.233) without wiping data. Root cause: vivo prepends "vivo " to MODULE_ARCH_VERMAGIC, so every prebuilt arm64 kernel module is rejected by insmod. Includes a patch script + a quantified refutation of GhostLock (CVE-2026-43499).
PoC: CVE-2026-110912
CVE-2026-110912
PoC: CVE-2020-25213-exploit
Exploit para explotar la vulnerabilidad CVE-2020-25213 en WPFileManager < 6.9
PoC: AhsayCBS-Auth-Bypass-RCE
A proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS
PoC: CVE-2026-97657
CVE-2026-97657 – Authentication Bypass & Account Takeover | Pocbit
PoC: CVE-2026-89282
CVE-2026-89282: Apache Lounge Windows DLL Search Order Hijack → SYSTEM LPE PoC
PoC: CVE-2026-27280
Write up and PoC for CVE-2026-27280
PoC: cve-2025-54068-vuln-intel
Inteligencia de vulnerabilidade sobre o RCE no Laravel Livewire: CVSS v4 do zero e priorizacao com EPSS/KEV.
PoC: hlk-al00-kernel-build
HLK-AL00 (4.14.116 / Kirin 810) 内核云编译 — CVE-2026-43499 授权安全研究
PoC: cybersecurity
Projet de Cybersécurité (TP1 à TP9) Recherche réseau (Nmap, Scapy) • Attaques DDoS (hping3) • Force brute (Hydra, LaZagne) • Ingénierie sociale (Zphisher, Gophish) • Sécurité Wi-Fi (Airgeddon, Aircrack-ng) • Malwares (msfvenom) • Injection de code (Shellter) • MITM (Ettercap, Yersinia) • Vulnérabilités (CVE-2026-96889).
PoC: CVE-2026-107084
CSRF in SLiMS 9.8.0 loan history maintenance allowing unauthorized data loss (TRUNCATE). CVE-2026-107084.
PoC: CVE-2026-107083
SQL Injection via unquoted numeric concatenation in SLiMS 9.8.0 admin modules (subscription.php & dl_detail.php). CVE-2026-107083.
PoC: qemu-xhci-complete-uaf
QEMU 11.1.2 - High - Local - UAF - xhci_complete leftover of CVE-2026-17588 doorbell DMA
PoC: CVE-2026-107082
SQL Injection via opac_hide / promoted GET parameters in SLiMS 9.8.0 admin bibliography module. CVE-2026-107082.
PoC: qemu-nvme-sgl-bar
QEMU 11.1.2 - High - Local - UAF - NVMe SGL span into BAR0 incomplete CVE-2021-3929
PoC: cve-2026-111283-bmc-helix-network-management-local-administrator-any-password
CVE-2026-111283 - BMC Helix Network Management Local Administrator Account Accepts Any Password
PoC: CVE-2026-59970-poc
PoC for CVE-2026-59970 Blind SSRF in Tandoor Recipes, CWE-918
PoC: CVE-2026-31431-Copy-Fail
CVE-2026-31431 Exploit | by infrar3d
PoC: CVE-2014-6271-Shellshock
CVE-2014-6271 Exploit | by infrar3d
PoC: CVE-2025-55182-React2Shell
CVE-2025-55182 Exploit | by infrar3d
PoC: CVE-2026-38526-KrayinCRM-RCE
CVE-2026-38526 Exploit | by infrar3d
PoC: CVE-2026-33017-Langflow-RCE
CVE-2026-33017 Exploit | by infrar3d
PoC: CVE-2026-39987-Marimo-RCE
CVE-2026-39987 Exploit | by infrar3d
PoC: infosec-audit-tools
Ferramentas de auditoria em segurança da informação, reconhecimento de superfície com RDAP/DNS e análise defensiva web (CVE-2024-10924).
PoC: CVE-2026-102764-Proof-of-concept
CVE-2026-102764 BeyondTrust Remote Support unauthenticated file write / RCE proof of concept
PoC: sharepoint-zero-day-cs50-cybersecurity
CS50 Cybersecurity Final Project - Analysis of CVE-2025-53770 SharePoint Zero-Day Attacks
PoC: csumguard
Restricted eBPF TC ingress guard, CO-RE detector, verified loader, and C11 VMM launch supervisor for CVE-2026-99999
PoC: plex2shell
CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
PoC: CVE-2026-92209_NoMachine_LPE
CVE-2026-92209
PoC: CVE-2026-92208_remote_mDNS_overflow
CVE-2026-92208
PoC: POC-CVE-2026-94134
Exploitation POC for CVE-2026-94134
PoC: CVE-2026-79986
Reproducer for CVE-2026-79986 (Apache Camel camel-azure-files): the consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus
PoC: redcap_cve_2026_90817_scan
A read-only, passive scanner that checks a REDCap host for exposure to and compromise by **CVE-2026-90817** — the unauthenticated survey-endpoint remote-code-execution flaw abused by the XMRig cryptomining campaign documented by Palo Alto Unit 42
PoC: CVE-2026-79985
Reproducer for CVE-2026-79985 (Apache Camel camel-smb): the SMB consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-79984
Reproducer for CVE-2026-79984 (Apache Camel camel-mina-sftp): the consumer builds the remote path from the server's SFTP directory listing without containment, escaping the polled directory — Camel Spring Boot + Camel Quarkus
PoC: exiftool-7.44-12.23-exploit-CVE-2021-22204-
ExifToolExploit CVE-2021-22204 \\ Arbitrary Code Execution
PoC: CVE-2026-79983
Reproducer for CVE-2026-79983 (Apache Camel camel-ftp): the consumer builds the remote path from the server's directory listing without containment, escaping the polled directory — Camel Spring Boot + Camel Quarkus
PoC: GhostLock-HonorFne
Honor 70 (FNE-AN00) privilege escalation PoC: GhostLock (CVE-2026-43499) + custom KernelSU module loading
PoC: CVE-2026-78165
Reproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads with no ObjectInputFilter (RCE) — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-78164
Reproducer for CVE-2026-78164 (Apache Camel HTTP producers): property placeholders resolved on the message-supplied CamelHttpUri/CamelRestHttpUri headers leak secrets into the outbound request — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-51367-Insecure-Direct-Object-Reference-IDOR
Security advisory — Insecure Direct Object Reference (IDOR / BOLA) in Vedo Suite (Bottinelli Informatica). Responsible disclosure.
PoC: CVE-2026-51366-SQL-Injection-leading-to-Remote-Code-Execution
Security advisory — SQL Injection leading to RCE in Vedo Suite (Bottinelli Informatica). Responsible disclosure.
PoC: CVE-2026-78163
Reproducer for CVE-2026-78163 (Apache Camel camel-docling): unvalidated String body input source enables SSRF and local file disclosure in DoclingProducer — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-78162
Reproducer for CVE-2026-78162 (Apache Camel camel-hazelcast): ReplicatedHazelcastAggregationRepository starts a Hazelcast member with no Java deserialization filter — Camel Spring Boot + Camel Quarkus
PoC: magicpad3-root-research
荣耀 MagicPad3 (CGA-W00) 运行时 KernelSU Root 研究 —— 全自动提权循环 · 二进制补丁增强 · 社区方案深度逆向 | Runtime KernelSU root research (CVE-2026-43499)
PoC: CVE-2026-104745
CVE-2026-104745 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0.
PoC: CVE-2026-111444
Wheels SQL injection on MySQL/MariaDB with backslash escaping enabled
PoC: CVE-2026-111389
Frappe HRMS missing input validation SQL injection vulnerability
PoC: GlyphGuard
🔥 GlyphGuard — Lightweight Unicode Homoglyph & Invisible-Character Security Audit Engine | 轻量级 Unicode 同形字与不可见字符安全审计引擎 — Zero Dependencies, Trojan Source (CVE-2021-42574) Detection, Skeleton Mapping, CI Gate, Cross-Platform.
PoC: VsockDrop-Adapted-CVE-2026-53365
A slightly more robust version of MaherAzzouzi's POC, created by my agent on the fly during testing.
PoC: CVE-2026-64507
CVE-2026-64507 — PoC: IBPB flush on BPF JIT allocation
PoC: CVE-2026-104715
CVE-2026-104715: cifs-utils credentials-file option injection (local root)
PoC: CVE-2026-18963-PoC
Proof of concept and vulnerability checker for CVE-2026-18963, an unauthenticated account takeover in the Keycloak reset-credentials flow. Single-file Python, optional Playwright browser component.
PoC: wp2shell-PoC
CVE-2026-63030 + CVE-2026-60137 exploit RCE chain.
PoC: Driftnet
CTF writeup: rooting a Linux box via CVE-2024-23334 (directory traversal) and CVE-2025-32463 (sudo privilege escalation)
PoC: CVE-2026-108578
Neterbit NW-431F unauthenticated SMS disclosure
PoC: CVE-2026-108097
Defensive, non-exploit detector for CVE-2026-108097 (SA-CORE-2026-014) — Drupal core Field UI RCE
PoC: cve-2026-110447-checker
Free CLI: check a Nextcloud instance for CVE-2026-110447 exposure. Stdlib only, honest verdicts. By Ingenious AI.
PoC: CVE-2026-85097
CVE-2026-85097 — Bricksforge <= 3.1.8.9 unauth file upload to RCE. GIF/PHP polyglot + temporaryFileUploads.url mismatch. python3 exploit.py --url http://TARGET
PoC: cve-2026-77521-lab
Benign, self-contained reproduction of CVE-2026-77521 (MaxKB prompt-injectable command execution)
PoC: CVE-2026-18963-PoC
Proof of concept and vulnerability checker for CVE-2026-18963, the Keycloak reset-credentials flow bypass
PoC: Lenovo_Qcom_RPMB_Tool
Educational proof-of-concept (PoC) research tool demonstrating CVE-2026-24090 ABL verification bypass to inspect and test Qualcomm Keymaster RPMB state on Lenovo devices.
PoC: ghostlock-brt-w09
⚠️ NOT SUCCESSFUL - GhostLock (CVE-2026-43499) adaptation attempt for Honor Pad V8 (BRT-W09 / MediaTek MT8797 / kernel 4.14.186+). Verified offsets + why KernelSnitch fails on 4.14.
PoC: cve-2025-66645
NiceGUI Path Traversal CTF Challenge
PoC: CVE-2026-20896-Gitea-CTF
CVE-2026-20896 Gitea Docker CTF Challenge
PoC: CVE-2026-12118-POC-
CVE-2026-12118 POC
PoC: CVE-2026-110912
A PoC for CVE-2026-110912 'arpbleed'
PoC: CVE-2026-104711-POC-NEW-VARIANT
POC for the CVE-2026-104711 - New Variant
PoC: CVE-2026-47644
CVE-2026-47644 ($12,000): Edge Copilot Prompt Injection Leads to Cross-Tab Data Exfiltration - PoC & full writeup
PoC: CVE-2026-108598
Unauthenticated RCE via Velocity Template Language (VTL) injection in Floci API Gateway mapping templates (versions 1.1.0–2.2.0). CVSS 9.8 Critical.
PoC: MOcha
CVE-2023-41991 vulnerability exploitation
PoC: CVE-vulnerability
CVE-2026-0322
PoC: ivanti-cve-2026-104935-check
Detection-only check for the Ivanti Connect Secure authentication bypass (CVE-2026-104935)
PoC: microsoft-security-advisory-cv
Autonomous submission for "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability" (MSRC / GitHub Security Advisory)
PoC: CVE-2026-107081
SQL Injection via identifier injection in SLiMS 9.8.0 admin AJAX endpoints (tableName/tableFields). Any authenticated staff can dump password hashes.
PoC: CVE-2021-4034
CVE-2021-4034 (PwnKit) - Python PoC
PoC: CVE-2026-76519-POC
Unauthenticated remote code execution on Cisco Secure Email Gateway via crafted email attachment. Path traversal in AMP File Reputation handling allows arbitrary file write as root when the service is enabled on a mail policy.
PoC: CVE-2026-109506
Technical writeup of CVE-2026-109506, a vulnerability I found in multiple TP-Link Wi-Fi Range Extenders
PoC: CVE-2026-104748
CVE-2026-104748 POC
PoC: DirtyFrag
DirtyFrag (CVE-2026-43284) pro Galaxy A57 5G (SM-A576B, A576BXXS6AZI2): gatilho libbase pro One UI 8.5 + dfroot.ko compilado exato pro 6.12.38-android16-5 do aparelho
PoC: CVE-2024-36057
CVE-2024-36057 - Authenticated OS Command Injection in Koha Library Software < 23.05.10 (upload-cover-image.pl). Advisory + PoC by Hacklantic.
PoC: CVE-2024-36058
CVE-2024-36058 - Authenticated Time-Based Blind SQL Injection in Koha Library Software < 23.05.10 (opac-sendbasket.pl). Advisory + PoC by Hacklantic.
PoC: cve-2025-24801-glpi
Reproducible local lab and source analysis for CVE-2025-24801 in GLPI 10.0.16
PoC: CVE-2017-7921
A Python-based tool for security assessment of Hikvision devices affected by CVE-2017-7921.
PoC: DC1-Penetration-Testing-Report
Penetration test report for the DC-1 VulnHub machine: Drupalgeddon2 (CVE-2018-7600) RCE, credential discovery, and SUID privilege escalation to root. Includes CVSS-rated findings and a remediation roadmap.
PoC: CVE-2026-92392
Defensive exposure checker and poc for cURL CVE-2026-92392
PoC: wazuh-unauth-chain
Wazuh PoC chaining CVE-2026-74034 file read and CVE-2026-74041 command execution; fixed in 4.14.8. Python standard library only.
PoC: Heartbleed-CSP-project
Heartbleed (CVE-2014-0160) reproduction and analysis —CSP Application Security project
PoC: linux-kernel-cve-2026-74580-vghost
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
PoC: merkle-lab
针对比特币 Merkle 根算法（含 CVE-2012-2459 变异检测机制）设计并实施自动化测试方案，覆盖功能正确性、边界场景与安全回归。
PoC: CVE-2026-85046
V8 inlined Array.prototype.sort elements-kind confusion - PoC + addrof (N-day research)
PoC: CVE-2025-13224
V8 super receiver confusion - PoC + unreachability research
PoC: CVE-2025-12433
V8 hole-check elision merge bug - PoC + exploit
PoC: CVE-2024-5274
V8 parser x bytecode-flush NativeContext leak - PoC
PoC: CVE-2024-2887
V8 Wasm GC type confusion - two PoCs (kExtern / kNone paths)
PoC: CVE-2024-23222
JSC DFG TOCTOU stale JSCell - deterministic UAF PoCs + race harness
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free