### Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit `9b8e8956f` on 2026-07-27 and is present on the current development head. No released stable version is affected. ### Summary `/api/av/getAttributeViewSearchTarget` is registered with `CheckAuth` only and performs no authorization of any kind. Given a database identifier and a keyword, it searches that database's rows and returns matching content, regardless of whether the caller may see the database, the rows, or the notebook holding them. Commit `64c26e74b` on 2026-07-26 closed a reader-reachable gap on `getAttributeViewFieldViews` by adding `CheckReadonly` at router line 536. `9b8e8956f`, the following day, registered this endpoint at line 535 without it. The new route returns more than the one that was just closed: row content rather than field-visibility metadata. ### Details **Route.** `kernel/api/router.go:535` on the development branch: ```go ginServer.Handle("POST", "/api/av/getAttributeViewSearchTarget", model.CheckAuth, getAttributeViewSearchTarget) ``` No `CheckReadonly`, no `CheckAdminRole`. **Handler.** `kernel/api/av.go` parses its arguments and calls `model.GetAttributeViewSearchTarget(id, keywords)`. `IsReadOnlyRoleContext`, `publishAccess` and any encrypted-notebook check are all absent. The sink is `kernel/model/attribute_view_render.go:69`. **The adjacent routes make the omission stark.** Lines 533 to 541 all handle the same data class: | Line | Route | Guard | |---|---|---| | 534 | `getAttributeViewKeys` | `CheckAuth`, filters in-body for readers | | 535 | `getAttributeViewSearchTarget` | `CheckAuth`, nothing | | 536 | `getAttributeViewFieldViews` | `CheckAuth`, `CheckReadonly` | | 540 | `searchAttributeView` | `CheckAuth`, `CheckReadonly` | | 541 | `getAttributeView` | `CheckAuth`, `CheckReadonly` | The guard at 536 is the one added by `64c26e74b`. The new route sits directly above it without one. **Why this is not bounded by identifier guessing.** The closest functional sibling, `renderAttributeView`, applies two distinct reader protections: 1. A containing-document gate, `CheckAttributeViewBlockAccessableByPublishAccess`, which is the full gate including `CheckPublishAuthCookie`. 2. Per-item filtering, `FilterAttributeViewByPublishAccess`, using the `itemAccess` and `attributeAccess` maps. This strips rows bound to restricted blocks out of views the reader is otherwise entitled to see. The second layer is what makes this exploitable without guesswork. A reader takes a database block identifier from the published DOM of a page they are allowed to view, then queries this endpoint against that same database and receives precisely the rows `renderAttributeView` removed from the view they were served. `GetAttributeViewSearchTarget` reaches the same internal render function; it simply bypasses the API-layer gate. **Two aggravating properties.** `getAttributeViewSearchMatches` runs `strings.Contains` across every value of every key, and the response carries `MatchedKeyID` alongside the title. That is a substring oracle over every column, so a caller can test for content without needing to retrieve it wholesale. The path also branches on `IsEncryptedBox(tree.Box)` into `ParseAttributeViewInBox`, so it reads encrypted notebooks while they are unlocked. `isEncryptedNotebookDeniedForPublish` appears seventeen times across the block, ref, outline, search and filetree paths, and does not appear in `av.go` at all. **Extraction is iterative.** Each request returns a single row. Systematic recovery of a database therefore requires many requests rather than one bulk response. There is no rate limiting on the path, and the substring oracle narrows the search considerably, but I mention it so the effort is not overstated. ### Proof of Concept Precondition: a development-branch build, publish mode enabled (default port 6808), anonymous when `Publish.Auth.Enable` is `false`. A published page embedding a database whose view contains rows bound to blocks the reader cannot access. Step 1, take the database block identifier from the published page's DOM. It is present in the served markup. Step 2, confirm what the reader is supposed to see: ``` POST http://127.0.0.1:6808/api/av/renderAttributeView {"id":"<database block id>"} → 200, rows bound to restricted blocks are absent ``` Step 3, retrieve them anyway: ``` POST http://127.0.0.1:6808/api/av/getAttributeViewSearchTarget {"id":"<same database block id>","keywords":"<term>"} → 200, matching rows including those step 2 withheld, with MatchedKeyID identifying the column that matched ``` The differential between steps 2 and 3, on one session against one database, is the finding. ### Impact An anonymous reader in publish mode, or any publish `RoleReader`, reads the content of database rows that the publish filters deliberately withhold, including rows in documents that are hidden, password-protected or forbidden, and rows in encrypted notebooks while those notebooks are unlocked. The database identifier required is published in the DOM of pages the reader is entitled to view, so no enumeration or guessing is involved. The substring matching across all columns lets a caller confirm specific content without retrieving whole rows. Confidentiality only, with no integrity or availability impact. ### Suggested fix Add `CheckReadonly` at router line 535, matching lines 536, 540 and 541. If read-only roles are meant to use this endpoint, apply `CheckAttributeViewBlockAccessableByPublishAccess` and `FilterAttributeViewByPublishAccess` inside the handler as `renderAttributeView` does, and add the `isEncryptedNotebookDeniedForPublish` check that the block, ref, outline, search and filetree paths already carry. More generally, the attribute-view routes now split between middleware-gated and in-body-gated, and a new route defaults to neither. A registration-time convention, where any new `/api/av/` route is `CheckReadonly` unless it deliberately implements in-body filtering, would prevent this recurring.
PoC: CVE-2026-112445
CVE-2026-112445: The Simplest macOS Local Privilege Escalation to Date
PoC: OtherActivityToken
Exploit for CVE-2025-0098, Activity token leak due to pid-only check and then use of that token for arbitrary startActivity()
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: CVE-2026-98260-vivo-x-fold6-poc
CVE 2026 98260 vivo x fold6 poc
PoC: CVE-2026-98260-PMX110-Root618-Jailbreak
CVE-2026-98260 (exec: posix timer UAF) LKM jailbreak for OPPO Find X10 Pro Max (PMX110) and OnePlus 16 (PYB110): one-command root via shell uid 2000, with KernelSU / FinaSU / SukiSU / KernelSU-Next handover. Release build Root618 1.5.12 (R8-obfuscated).
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: brotli-node2shell-check
Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder
PoC: CVE-2026-112705-poc
Crash-only public-API reproducer for CVE-2026-112705 in AVEVideoEncoder
PoC: CVE-2026-98260-vivo-s60-poc
CVE 2026 98260 vivo s60 poc
PoC: node2shell-two-stage
CVE-2026-111497 two-stage Brotli harness: local trigger/error-semantics verification, no exploitation
PoC: ArchonX-PHP2Shell
Pre-auth PHP RCE framework for CVE-2026-109618/619 — ArchonX_DeadLock_Security
PoC: Paranoid-CVE-2026-98432
Drop incoming IPv4 TCP packets whose IP header contains options.
PoC: cve-2026-98432-checker
Check a Linux server for CVE-2026-98432 (IPv4 TCP use-after-free, CVSS 9.8): root cause explained, read-only check script and mitigations.
PoC: gitlab-onigmo-scanner
Detection-only triage for GitLab CVE-2026-97229 (and CVE-2026-110264): grade a self-managed GitLab version plus its Ruby, catch the Oct-12-patch and custom-Ruby traps. No payloads, no network probes.
PoC: panos-php2shell-defense
Open-source hotfix for PAN-OS firewall chain attack PHP2Shell and Fragnesia CVE-2026-109618 and CVE-2026-46300
PoC: oauth-sink-check
Trace untrusted OAuth endpoint URLs from source to shell sink — the CVE-2026-119025 attack class, checked in your code, lockfile and MCP configs.
PoC: PHP2SHELL-Research
Academic research harness and memory corruption analysis framework for PHP core engine vulnerabilities (CVE-2026-109618 / CVE-2026-109619).
PoC: netviser-linux-security-auditor
Read-only, agentless Linux kernel security configuration auditor (local & SSH). Initial focus: TCP migration / MPTCP checks for CVE-2026-98432.
PoC: vulnpocalypse-2026-10-response
Diagnosis and remediation prompt for PHP2Shell (CVE-2026-109618/109619), the Node.js Oct 2026 security release and Brotli CVE-2026-111497. EN + PT-BR. Facts as of 29 Oct 2026.
PoC: CVE-2026-98432
CVE-2026-98432 (Linux IPv4 TCP use-after-free): how to check your server, apply a stopgap, and clean up after the fix
PoC: CVE-2026-98432
Race trigger, heap-reuse oracle, pcap analysis, detection and mitigation tooling for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free).
PoC: pillow-uaf-research
Weaponized CVE-2026-112396 (Pillow heap use-after-free): deterministic heap grooming, file-triggered chain, attacker-chosen post-free writes - verified PoCs, evidence, CI. Plus pypdf CVE-2026-113792 DoS and a fileless macOS memory-injection demo.
PoC: ubuntu-tcp-guide
우분투 커널 TCP 구멍(CVE-2026-98432) 쉽게 보기 · 벨로키 보안 공부
PoC: cve-disclosures
Public security vulnerability disclosures — CVE-2026-78829 / 78830 / 78831 / 78832
PoC: log4shell-audit-13
Log4Shell (CVE-2021-44228) security briefing research: remediation checklist and write-up
PoC: log4shell-audit-12
Quarterly security briefing notes and Log4Shell (CVE-2021-44228) remediation tracking
PoC: log4shell-audit-11
Log4Shell (CVE-2021-44228) remediation tracking and security research notes
PoC: log4shell-audit-10
Tracking repo for our quarterly Log4Shell (CVE-2021-44228) security briefing.
PoC: log4shell-audit-9
Tracking repo for our quarterly Log4Shell (CVE-2021-44228) security briefing.
PoC: log4shell-audit-8
Tracking repo for our quarterly Log4Shell (CVE-2021-44228) security briefing.
PoC: log4shell-audit-7
Tracking repo for our quarterly Log4Shell (CVE-2021-44228) security briefing.
PoC: log4shell-audit-6
Quarterly security briefing tracking — Log4Shell (CVE-2021-44228) remediation
PoC: log4shell-audit-5
Log4Shell (CVE-2021-44228) remediation tracking notes and checklist
PoC: secbyte-cve-exploitation-real-world-vulnerabilities-red-teaming-ctf-labs
A practical collection of cybersecurity CTF labs covering real-world CVE exploitation, zero-day/N-day vulnerability analysis (Citrix Bleed, FortiGate SSL VPN, Apache Superset CVE-2023-27524, Ivanti VPN, ColdFusion WDDX, Veeam, HTTP/2 Rapid Reset), and Red Team fundamentals.
PoC: php2shell
🐘 Ansible CVE-2026-109618, CVE-2026-109619 scanner
PoC: CVE-2026-26026-GLPI
Minimal source comparison and local lab files for CVE-2026-26026 in GLPI 11.0.5 and 11.0.6
PoC: CVE-2026-98432
Linux kernel IPv4 SYN IP-options use-after-free CVE-2026-98432 Mitigation work (Ansible Role)
PoC: cve-2026-98432-mitigation
Temporary mitigation for CVE-2026-98432 (Linux IPv4 TCP ireq_opt use-after-free): drop IPv4 TCP with IP options, disable MPTCP. Tested scripts + verification. EN/KO.
PoC: kpatch-cve-2026-98432
kpatch livepatch for CVE-2026-98432 (and CVE-2026-99999) on AlmaLinux and Rocky Linux 8, 9 and 10
PoC: phishing-analysis-thm
SOC-style investigation of a Netflix phishing email, CVE-2017-11882 exploitation, IOC extraction, and detection engineering mapping.
PoC: ebs-cve-2026-101767-check
Detect Oracle E-Business Suite exposure to CVE-2026-101767 (Application Object Library, CVSS 9.8): read-only DB patch check and network exposure probe
PoC: CVE-2026-33439
Pre-auth RCE exploit for OpenIdentityPlatform OpenAM <=16.0.5 via Java deserialization of the jato.clientSession parameter (CVE-2026-33439, CVSS 9.8). Comparator-based gadget chain with in-band command output through Tomcat ApplicationFilterChain thread-locals.
PoC: FBI-Tor-Exploit-CVE-2013-1690
Academic cybersecurity research project analyzing and restoring the FBI's 2013 Tor Browser deanonymization exploit, focusing on CVE-2013-1690, Firefox use-after-free vulnerabilities, exploit mechanisms, and historical forensic analysis.
PoC: Bootjack
CVE-2026-97631 C
PoC: CVE-2026-48907
Adapted PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5
PoC: cve-2026-98432-audit
cve-2026-98432 audit script (ipv4 TCP inet_opt/ireq_opt use-after-free)
PoC: php2shell-poc
CLI scanner and PoC for CVE-2026-109618 / CVE-2026-109619 (PHP OOM heap corruption and session upload-progress injection, CVSS 9.2). Affects PHP 5.4.0-8.5.11; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12. No external dependencies.
PoC: CVE-2026-88804
PoC CVE-2026-88804 (Rancher)
PoC: php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
PoC: CVE-2026-98260-dada-android
Verified CVE-2026-98260 Android port for Xiaomi 15 dada OS4.0.0.22.XOCCNXM
PoC: CVE-2025-4960
Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer
PoC: ghostlock-kirkwood
CVE-2026-43499 (GhostLock) port for the Google TV Streamer (kirkwood / MT8696): single-file, per-boot temporary root + interactive root shell, with a build-matching case study and adaptation guide.
PoC: node2shell
Node2Shell (CVE-2026-111497) detection-only scanner + lab — RedSide Security
PoC: CVE-2026-97555
CVE-2026-97555: heap overflow in the Linux SMB client DACL rewrite (cifs.ko) — analysis, POC, and an arm64 exploit chain ending in a uid-0 credential overwrite on the reference build
PoC: cve-2026-110311-gitea-lab
Local Gitea CVE-2026-110311 reproduction: vulnerable vs patched comparison, Python verifier, recorded evidence, and Turkish report.
PoC: nginx-rift-cve-2026-42945-lab
Interactive NGINX CVE-2026-42945 educational simulation built with HTML, CSS, and JavaScript. Features vulnerable and patched modes, synthetic request inspection, memory visualization, event logging, and security recommendations. No real exploit execution.
PoC: CVE-2026-12118-POC-
POC for CVE-2026-12118
PoC: CVE-2026-104286
Exploit for CVE-2026-104286 — FortiMail: Unauthenticated Arbitrary File Write → Code Execution
PoC: node2shell
Scanner to checking (CVE-2026-111497) vulnerability
PoC: PHP2Shell
CVE-2026-109618 & CVE-2026-109619 — Pre-Auth RCE in PHP Core (session.upload_progress). Scanner, exploit verifier, and full technical analysis.
PoC: CVE-2026-50053
Offline Python detector for CVE-2026-50053 version exposure in Zimbra Collaboration Suite.
PoC: CVE-2026-115889
Offline Python detector for CVE-2026-115889 version exposure in Wasmtime.
PoC: CVE-2026-53921
Offline Python source-pattern auditor for CVE-2026-53921 in odhcpd.
PoC: gitlab-rce-toolkit
CVE-2026-97229 + CVE-2026-110264 — GitLab Onigmo RCE Exploit Toolkit (CVSS 10.0)
PoC: CVE-2026-101259
Reproducer for CVE-2026-101259 — Apache Camel camel-coap consumer sent the exception message to the CoAP client as a 5.00 payload (CWE-209). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-71569
Reproducer for CVE-2026-71569 — Apache Camel camel-a2a push-notification webhook guard accepted an IPv6 unique local address (fc00::/7) reached through a host name (CWE-918). Camel Spring Boot + Camel Quarkus.
PoC: RDPBleed
CVE-2026-56190 - Windows RDP Server Uninitialized Resource leads to RCE
PoC: CVE-2026-94386
Reproducer for CVE-2026-94386 — Apache Camel camel-oauth cross-scope token reuse via a JVM-global token cache keyed only on endpoint+clientId (CWE-524). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-95629
Reproducer for CVE-2026-95629 — Apache Camel camel-docling passed the CamelDoclingOutputFilePath header to docling's --output verbatim (CWE-22). Camel Spring Boot + Camel Quarkus.
PoC: php2shell-advisory-response
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) advisory response: inventory, patch, Wazuh hunt mapping, attestation outline.
PoC: CVE-2026-95628
Reproducer for CVE-2026-95628 — Apache Camel camel-docling custom-argument path validation did not reject absolute paths, an incomplete fix of CVE-2026-40047 (CWE-22). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-95663
Reproducer for CVE-2026-95663 — Apache Camel camel-keycloak served a cached token introspection result past the token's expiry (CWE-613). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-97798_LPE_Windows
CVE-2026-97798 PoC — WER Time Travel Debugging argument injection to SYSTEM (Windows 11 LPE), with an adaptive faultrep.dll resolver.
PoC: CVE-2026-95664
Reproducer for CVE-2026-95664 — Apache Camel camel-aws2-s3 evaluated a header-supplied object key as a Simple expression (CWE-917). Camel Spring Boot + Camel Quarkus.
PoC: woff2shell
poc of CVE-2026-111497 delivered as a WOFF2 file
PoC: wiz-bulb-tool
WiZ smart bulb LAN security tool - auto-discovery, CVE-tagged audit, intel recon & device control. Extends CVE-2019-18980 to new hardware. No credentials required.
PoC: CVE-2026-90885
Reproducer for CVE-2026-90885 — Apache Camel camel-saxon XQuery XML External Entity via an already-built javax.xml.transform.Source (CWE-611, HIGH). Camel Spring Boot + Camel Quarkus.
PoC: cve-2026-109618-cve-2026-109619-poc
pHp2Shell CVE 2016 109618 - 109619
PoC: php2shell
Realistic multi-version lab + toolkit for the PHP php2shell pre-auth RCE (CVE-2026-109618/109619): detect, blindly prove, and understand it. No shared mounts, no planted files, no LFI.
PoC: secure-api-cve-2024-23897
Work 1 — secure Flask REST API, three-stage CI, and CVE-2024-23897 (Jenkins CLI) analysis
PoC: charla-php2shell
PHP2Shell (CVE-2026-109618/109619): demos reproducibles y guia de parcheo paso a paso.
PoC: PHP2shell
CVE-2026-109618_CVE-2026-109619
PoC: waffers
The layer that protects you. Proactive defense-in-depth Web Application Firewall mitigating recent critical PHP engine vulnerabilities including PHP2Shell (CVE-2026-109618/9), PHP-CGI Argument Injection (CVE-2024-4577), iconv Filter Chains (CVE-2024-2961), and stream wrapper abuse.
PoC: node2shell-inventory-scanner
Local inventory triage for Node2Shell (CVE-2026-111497): grade every Node, Bun and Brotli copy on disk. Detection-only, no network probes, no payloads.
PoC: php2shell-check
A Claude Skill that passively checks whether a website (and optionally its subdomains) runs PHP, confirms the version where possible, and flags exposure to PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: CVE-2026-97631-PoC
An educational laboratory for studying a PXE network-boot vulnerability in EDK II / OVMF. It builds a pinned EDK II revision, boots a UEFI virtual machine in QEMU, and includes Python proof-of-concept scripts for investigating denial of service (DoS) and memory corruption.
PoC: practica-integradora-ciberseguridad
Práctica Integradora de Ciberseguridad (Comisión 1) - Investigación, análisis técnico y laboratorio práctico de CVE-2021-41773 (Apache HTTP Server)
PoC: node2shell-audit
Read-only audit for Node2Shell (CVE-2026-111497): Node.js/Bun Brotli decoder out-of-bounds write
PoC: cve-2026-111497-wordpress-poc
CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress
PoC: demo-zip-rce-sandbox
Live demo: the same vulnerable Rust zip crate (RUSTSEC-2026-0367 setuid + CVE-2026-115905 zip cloaking) contained by a deny-by-default Cosmonic WebAssembly sandbox.
PoC: php2leak
Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)
PoC: php2shell
php2shell (CVE-2026-109618/109619) reproduction lab — lab only, targets the vulnerable php:8.5.11 images
PoC: CVE-2026-101767-research
Research notes on CVE-2026-101767 — unauthenticated vulnerability in Oracle Application Object Library (E-Business Suite)
PoC: threat-intelligence-log4shell-analysis
Cybersecurity research project analyzing threat intelligence feeds, Log4Shell (CVE-2021-44228), attack progression, remediation, incident response, and threat hunting.
PoC: CVE-2026-15723
Offline Python detector for CVE-2026-15723 version exposure in self-managed GitLab CE/EE, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-105014
Offline Python applicability detector for CVE-2026-105014 in Azure Pipelines, with strict CSV/JSON inventories and auditable reports.
PoC: CVE-2026-114625
Offline Python detector for CVE-2026-114625 exposure in on-premises VeloCloud Orchestrator, with train-specific build checks and auditable reports.
PoC: CVE-2026-97785
Offline Python applicability detector for CVE-2026-97785 in Microsoft Entra application proxy, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-83938
Offline Python applicability detector for CVE-2026-83938 in Azure Kubernetes Configuration Service, with CSV/JSON inventories and auditable reports.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free