Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

PoC: CVE-2026-2039819-PoC

CVE-2026-2039819 is a BYOVD PoC for HWiNFO (HWiNFO_x64_216.sys)

PoC: ExtractKit

Honor 内核标定 + CVE-2026-98260 提权链（Shizuku + KernelSU late-load），内置 74 条内核 profile

PoC: php2version-scanner

Non-intrusive patch-status checker for PHP2Shell (CVE-2026-109618 / 109619)

PoC: CVE-2026-70054

Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.

PoC: CVE-2009-2265

Unauthenticated RCE in Adobe ColdFusion 8 and 8.0.1 via the bundled FCKeditor connector, a null byte in CurrentFolder dropping a .jsp that JRun executes. Built-in JSP command and reverse-shell payloads with a listener, output returned inline, non-destructive check.

PoC: CVE-2026-19803

Printcart <= 2.13.2 Unauthenticated File Upload

PoC: barracuda-esg-zeroday-cve-2026-116606-analysis

🚨 Zero-Day Analysis: Unauthenticated RCE chain (CVE-2026-116606 + CVE-2026-111560) in Barracuda ESG — Sigma, Splunk & YARA detection rules + backup inspector tool for defenders. ⭐ Star & follow @ZeroHackOrg for threat intel!

PoC: twentysixify

An LSPosed module that brings Galaxy S26 Ultra AI and Camera features to Samsung Galaxy devices, supporting both locked and unlocked bootloaders via CVE-2026-43284 (DirtyFrag).

PoC: make-it-root

One-tap temporary root for the Amazon Fire TV Stick 3rd gen (sheldonp), wrapping the GhostLock exploit (CVE-2026-43499)

PoC: CVE-2026-66613

PoC — CVE-2026-66613: JetEngine (Crocoblock) Timber/Twig Views unauthenticated RCE (authorized security research)

PoC: CVE-2025-29927-Python

Python implementation and local lab diagnostic for CVE-2025-29927

PoC: CVE-2021-22205

Unauthenticated RCE in GitLab CE/EE from 11.9 (fixed in 13.8.8, 13.9.6, 13.10.3) via the bundled ExifTool (CVE-2021-22204). Pure-Python DjVu builder, no djvulibre. Unauth and authenticated vectors, non-destructive check.

PoC: CVE-2020-13671

Unrestricted file upload to RCE in Drupal core (<7.74, <8.8.11, <8.9.9, <9.0.8). Drupal never munges a bare dangerous extension, so shell.php survives as shell.php.txt. Anonymous registration and authenticated editor vectors.

PoC: CVE-2018-7602

Drupalgeddon 3: authenticated RCE in Drupal 7 < 7.59 via the destination parameter on any confirm form. User-cancel and node-delete vectors, credentials or a pasted session cookie, and a per-step trace of which request failed.

PoC: CVE-2026-125399

Zero-Click, Unauthenticated OS Command Injection via eval() on Attacker-Controlled ESSID in Fluxion

PoC: GHSA-673q-mjm6-r5xr

Dockerized remote RCE PoC for GHSA-673q-mjm6-r5xr (Next.js use cache / React Flight, CVE-2026-126187): one unauthenticated request -> code execution, with a patched victim that is immune.

PoC: CVE-2026-109619-Alpine-SessionLFI

CVE-2026-109619 session.upload_progress LFI exploit chain — Alpine/musl compatible PoC

PoC: s5e8835-sboot-probe

Static S-Boot/LK probe for Samsung Exynos 1380 (s5e8835): SVE-2026-3546 / CVE-2026-21155 resolver patch, four-device coverage, and safety notes.

PoC: CVE-2026-105016-RCE-PoC

CVE-2026-105016 - Blind RCE in msquic (QuicStreamSendWrite uint16 underflow) - CVSS 9.8

PoC: CVE-2026-33050

PoC for CVE-2026-33050 / GHSA-9fpx-fr6j-2vh6 - GeoNode OS command injection via uploaded vector layer name

PoC: CVE-2026-112174-Iperius-Backup-version-8.8.3-PoC

Privilege escalation in Enter’s Iperius Backup

PoC: CVE-2026-123158

PoC educativo para CVE-2026-123158 (sshole) - bypass de autenticación en OpenSSH sobre musl sin PAM

PoC: prestashop17-security-patches

Unofficial security backports for PrestaShop 1.7.8.11 (EOL). CVE-2026-44212, unauthenticated stored XSS to back-office takeover. Not affiliated with PrestaShop SA.

PoC: cve-2026-111760-git-submodule-symlink-rce

CVE-2026-111760 - Git Submodule Symlink RCE (CVSS 8.0)

PoC: cve-2026-119948-windows-ad-rce

CVE-2026-119948 - Windows Active Directory RCE (CVSS 7.5)

PoC: cve-2026-124194-outlook-ntlm-hash-leak

CVE-2026-124194 - Outlook NTLM Hash Leak (CVSS 6.5)

PoC: cve-2026-126170-fortimanager-jsonrpc-rce

CVE-2026-126170 - FortiManager JSON-RPC RCE (CVSS 9.8)

PoC: cve-2026-121529-forticlient-cors-rce

CVE-2026-121529 - FortiClient CORS RCE (CVSS 9.1)

PoC: CVE-2026-89324

CVE-2026-89324 — Basel Post Types ≤ 1.18 unauthenticated auth bypass (forged Opauth callback → admin takeover). PoC + self-contained Docker lab + full analysis.

PoC: PHP2P4IM0NSHELL

💥🐘 Extensión de navegador para auditar eticamente Lab propio con la clase **php2shell** (`CVE-2026-109618`, `CVE-2026-109619`, `CVE-2026-10961x`) desde Chrome/Edge. Con CMD_CENTER + RECON, terminal Alpine v86 embebida y generador de reverse shells.

PoC: CyberDefenders-OpenWire

Network Forensics Investigation – Apache ActiveMQ CVE-2023-46604

PoC: Fortinet2Shell

Fortinet2Shell — containerised PoC for CVE-2026-121529 (FG-IR-26-194): a FortiClient local API origin validation error (CWE-346) that lets a malicious web page drive the victim's own browser into code execution as the service account. Real-browser differential against four origin-validation models, plus a 0day sweep.

PoC: CVE-2026-121529

Containerised PoC for CVE-2026-121529 (FG-IR-26-194): a FortiClient local API origin validation error (CWE-346) that lets a malicious web page drive the victim's own browser into code execution as the service account. Real-browser differential against four origin-validation models, plus a 0day sweep.

PoC: wpdiscuz-cve-2020-24186

roof-of-concept exploit for CVE-2020-24186, an unauthenticated arbitrary file upload in the WordPress plugin Comments - wpDiscuz (slug wpdiscuz, vendor gVectors) versions 7.0.0 - 7.0.4, leading to remote code execution.

PoC: cve-2026-115252-wordpress-php-injection-rce

CVE-2026-115252 - WordPress Confection Plugin PHP Code Injection RCE

PoC: cve-2026-110264-gitlab-regex-rce

CVE-2026-110264 - GitLab CE/EE Regex Integer Overflow Unauthenticated RCE

PoC: cve-2026-68982-airflow-celery-rce

CVE-2026-68982 - Apache Airflow CeleryExecutor Unauthenticated RCE

PoC: CVE-2026-121529

CVE-2026-121529

PoC: cups-browse-exploit-detection

CUPS printer-discovery exploitation & detection (CVE-2024-47176/47076/47175) - Scapy attack/detector tools, lab evidence, and report

PoC: joomla-cve-2013-1453

CVE-2013-1453: Joomla 2.5.x PHP Object Injection — Complete Gadget Chain Analysis with Docker Lab and PoC Exploits

PoC: CVE-2026-125753

CVE-2026-125753 — path traversal out of the blob container in ABP Framework

PoC: CVE-2026-123618

CVE-2026-123618 — the external login path in ABP skips the pre-sign-in gate and the second factor

PoC: megumin.exe

PPL removal/lsass dump tool using CVE-2018-19320

PoC: CVE-2026-125350-PoC

Google Chrome XSLT pattern-cache Use-After-Free (CVE-2026-125350) crash PoC — affected < 157.0.8103.50

PoC: CVE-2026-124079

PoC for CVE-2026-124079 — unauthenticated RCE in rConfig Core <=8.2.18 / Pro <8.4.1 via Redis-backed Laravel Horizon queue poisoning (CWE-502). Includes a differential environment (8.2.17 vulnerable / 8.2.18 partially patched / 8.2.19 fixed) and the full exploit chain.

PoC: CVE-2026-118383

PoC for CVE-2026-118383 — MongoDB unauthenticated use-after-free in ReplicationCoordinatorImpl::CatchupState during primary catch-up via readConcern.afterOpTime waiter poisoning, with deterministic crash oracle and fixed-version control.

PoC: CVE-2025-32432

Proof of concept for CVE-2025-32432: Craft CMS RCE

PoC: CVE-2026-105437

PoC for CVE-2026-105437 — Git's three-way merge (xdiff/xmerge.c) sizes the merge output buffer in a 32-bit int, so a committed conflict-marker-size gitattribute plus many conflicts overflows it and the merge is written past an undersized heap allocation; git merge-tree is the primary vector. Validated on 2.56.0 (SIGSEGV) vs 2.56.1.

PoC: CVE-2026-123158_sshole_lab

Secure-coding laboratory: Docker reproduction of CVE-2026-123158 (sshole) — OpenSSH password-auth bypass on musl/no-PAM, why the default is safe, and the fix

PoC: sap-patchday-scanner

Detection-only triage for the SAP November 2026 Patch Day batch: CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017 (all CVSS 10.0, ICM2SHELL and PROXYGATE)

PoC: VULKAN-RCE-cve-2022-3653

VULKAN RCE cve-2022-3653 ICD CPU ATTACK FROM GPU

PoC: CVE-2026-124194-poc

CVE-2026-124194 PoC - Outlook spoofing/forced-authentication NTLM leak (patched 2026-11). Concept proof only, untested against vulnerable Outlook.

PoC: sound-of-system

Windows 11 standard-user to SYSTEM elevation-of-privilege chain write-up (CVE-2026-97799, CVE-2026-116714).

PoC: timertest

CVE-2026-98260 timer binary test repo

PoC: CVE-2026-125350-PoC

Technical analysis and skeleton PoC for CVE-2026-125350 (Chrome XML UAF)

PoC: cve-2026-76844-lab

One CVE ID, two packages: reproducing CVE-2026-76844 in Trivy with a pinned vulnerability DB

PoC: agentgate

Integrity layer for MCP tool surfaces: pre-install vetting, cryptographic pinning, drift detection (CVE-2025-54136 class). Local-first, zero-egress, Apache-2.0.

PoC: CVE-2026-125757

CVE-2026-125757 Exploit — mailcow domain-wide footer SSTI via rspamd's jinja/lupa engine, enabling cross-tenant RCE in the shared rspamd container.

PoC: CVE-2025-6020-upstream-fix

Upstream fix for CVE-2025-6020 - Linux-PAM pam_namespace privilege escalation

PoC: CVE-2026-125350

CVE-2026-125350

PoC: root-oplusace5

1+ACE5竞速版提权poc，基于CVE-2026-43499 GhostLock

PoC: CVE-2026-81963-TrustedDpx

PoC for CVE-2026-81963 — SYSTEM LPE via CBS OnePackage applicability dpx.dll sideload (Windows Update Stack)

PoC: CVE-2026-11800-POC

POC for CVE-2026-11800 - JWT algorithm confusion in Keycloak identity brokering: the IdP RSA public key DER bytes are accepted as an HMAC secret, minting tokens for federated users without any private key. Vulnerable 26.6.3 vs fixed 26.6.4, mitigation notes included.

PoC: CVE-2026-73373-POC

POC exploit for CVE-2026-73373 - unrestricted upload of shtml files in Joomla core leading to server-side include execution. Blocklist diff plus vulnerable vs fixed controls included.

PoC: CVE-2026-66738-POC

POC exploit for CVE-2026-66738 - authenticated code injection to OS command execution in SPIP via the navigation editor endpoint on SQLite installs. Vulnerable 4.4.16 vs fixed 4.4.18 control.

PoC: CVE-2026-73663-POC

POC exploit for CVE-2026-73663 - unauthenticated SQL injection in the FreePBX missedcall module via a crafted SIP From Caller-ID name, allowing admin account modification. Vulnerable 17.0.3 vs patched 17.0.4 control.

PoC: CVE-2026-73665-POC

POC exploit for CVE-2026-73665 - unauthenticated RCE in FreePBX UCP via Socket.IO namespace auth bypass feeding CRLF injection into the Asterisk Manager Interface. Vulnerable 17.0.7 lab vs patched UCP control.

PoC: CVE-2026-110468-110469-WIDZIALNI

CVE-2026-110468 / CVE-2026-110469 — WidzialniCMS < 2.5 unauthenticated arbitrary file upload → RCE. Tool, lab, research, verified FOFA dorks. Field note: vendor detection signature is a false positive in the wild (133 sig matches, 0 exploitable).

PoC: CVE-2026-105761

Technical write-up on an authorization bypass in Dify’s MCP server management API

PoC: samba-usermap-script-exploit

Exploitation of CVE-2007-2447 — Samba "username map script" command injection on Metasploitable2 using Metasploit

PoC: SamTimer

One-tap Android root for Samsung Galaxy devices, built around the CVE-2026-98260 timer exploit.

PoC: prestashop-security-advisories

Security advisories for third-party PrestaShop modules — responsible disclosure, lab-verified. Includes CVE-2026-117368 (Payrexx Payment Gateway).

PoC: CVE-2026-86829

Apache Airflow < 3.4.0: scheduler-side deserialization of task-controlled XCom (CVE-2026-86829) leading to code execution in the scheduler process. PoC, fixed-version control, and a triggerer classpath validation-order finding.

PoC: pd2232-dirtyfrag

iQOO Neo7 竞速版 (PD2232/V2232A) 临时 root — CVE-2026-43284 页缓存写 + KernelSU LKM late-load。实机验证通过。

PoC: php2shell-check

Ruby CLI that checks local PHP for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Reads package changelogs so distro-backported patches aren’t flagged as vulnerable.

PoC: CVE-2026-11800

PoC for CVE-2026-11800: Keycloak JWT algorithm confusion auth bypass (HS256 assertion signed with the IdP public RSA key). Fixed in Keycloak 26.6.4.

PoC: CVE-2026-119977

WordPress Core RCE via Predictable Staging Path (CVSS 8.1)

PoC: CVE-2026-125394

FreeRDP before 3.33.0 contains a heap UAF vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers.

PoC: CVE-2026-89052-archer-c6-aes

PoC + Metasploit module for CVE-2026-89052: hardcoded AES credential key in TP-Link Archer C6 V2. Discovered by Sérgio Silva (CYBERS3C).

PoC: CVE-2026-98432

Safe user-space ASan model of the CVE-2026-98432 Linux IPv4 TCP RCU use-after-free

PoC: sberportal-root

SberPortal (stargate, Amlogic A311D) — getting and keeping root: CVE-2022-38181, persistent root via u-boot env, device-side auto adb root, BL31 secure-boot path

PoC: cve-2026-98432-chain

CVE-2026-98432 exploitation notes and stage skeletons (all kernel offsets redacted)

PoC: PoC_CVE-2026-117017

POC for CVE-2026-117017

PoC: CVE-2026-92414-POC

POC for CVE-2026-92414 - Apache Jackrabbit WebDAV preauth session hijack via derivable lock tokens. Verified against 2.22.4, control on fixed 2.22.5.

PoC: CVE-2026-90436-POC

POC for CVE-2026-90436 - unauthenticated remote class instantiation in Apache Axis 1.x via SOAP fault exceptionName, bypassing configured auth handlers. EOL software, no fix exists.

PoC: CVE-2026-68524-POC

POC exploit for CVE-2026-68524 - preauth RCE in Apache OFBiz via request body shadowing the decorator location and file URI screen loading. Verified on 24.09.07, control on 24.09.08.

PoC: CVE-2026-114656-POC

POC for CVE-2026-114656 - Traefik mTLS client certificate bypass via negated Host matchers forcing default TLS options. Vulnerable vs fixed differential included.

PoC: CVE-2026-104711-POC

POC exploit for CVE-2026-104711 - OGNL injection RCE in Apache Struts legacy REST action mapper (S2-075). Vulnerable vs fixed verification included.

PoC: plex2shell-audit

Read-only audit tool for the actively-exploited Plex2Shell exploit chain (CVE-2026-96652/-96654/-96655/-96656, fixed in Plex Media Server 1.43.3.10861). Remote version check + local IoC scan. Stdlib-only Python.

PoC: CVE-2019-2215-vivo-Y66i

在AI辅助下完成的 vivo Y66i 提权路径

PoC: finder2fullsend-cve-1970-01

Fictional CMD to PowerShell CVE-2026-1210 interactive security demo

PoC: faspex-scanner

Detection-only triage for IBM Aspera Faspex CVE-2026-123218 (CVSS 9.8, CISA KEV): grades Faspex 5 installs against the 5.0.19 PL1 fix, catches the bare-5.0.19 trap.

PoC: cve-2026-65400-mac-check

Detect and clean the macOS Screen Sharing (CVE-2026-65400) → root → XMRig miner campaign

PoC: cmd2pshell-cve-2026-1210

Fictional CMD to PowerShell CVE-2026-1210 interactive security demo

PoC: tenda-ac6-cve-2026-4961-patch

Patched firmware + analysis for Tenda AC6 CVE-2026-4961 (/goform/QuickIndex). Version bumped to V15.03.05.17.

PoC: sshole-lab

A Docker lab that reproduces **"*sshole"** (CVE-2026-123158), an authentication bypass in OpenSSH `sshd` when it is built against **musl libc** and **without PAM**. An account whose `/etc/shadow` password field is `*` (for example, a key-only account) accepts any password between 257 and 1024 bytes.

PoC: CVE-2026-122056

A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted XCCDF document.

PoC: CVE-2023-33107-SO51A

Temporary root Xperia 1ii (SO-51A)

PoC: CVE-2026-83844-public

Out-of-bounds read in the legacy Microsoft Paint C2PA/JUMBF provenance parser (CVE-2026-83844): report, Paint reproducer, and reverse-engineering evidence.

PoC: pickle-sentry

Scan code and dataset files for unsafe pickle deserialization — including the Hugging Face datasets pandas builder RCE (CVE-2026-57845). Never executes the files it inspects.