## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5h3f-q97h-ccvc. This link is maintained to preserve external references. ## Original Description vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.
PoC: CVE-2026-97229-PoC
GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image
PoC: CVE-2026-109721
Write-up for CVE-2026-109721
PoC: CVE-2026-85097-Toolkit
CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.
PoC: CVE-2026-102489
CVE-2026-102489 exploit in golang
PoC: sqli-cve-2026-102428
PoC: OrdaSoft Joomla OS CCK (com_os_cck) 8.3.15 unauth SQLi —mass+exploit+dork
PoC: debian-on-s23-ultra
A Samsung Galaxy S23 Ultra running Debian 13 as a server. The bootloader is locked, so an app re-establishes root after every reboot: Shizuku, CVE-2026-43499, KernelSU Next late-load, then a Debian chroot with sshd. One APK, quickstart, chroot bootstrap, and notes on everything that did not work.
PoC: CVE-2026-88776
Write-up for CVE-2026-88776
PoC: CVE-2026-80428
ILIAS ≤ 9.21 / 10.9 / 11.2 — Unauthenticated PHP Object Injection (RCE)
PoC: CVE-2026-104711-POC---Brand-New
CVE-2026-104711 POC - Brand New
PoC: BLU_G35
A self-contained Linux kit for BLU G35 (Unisoc SC9863A): unlock the bootloader via the publicly documented CVE-2022-38694 BootROM method, insure first with three cross-verified backups, gate every write behind typed consent, and roll back to full box state. Security research — read the pinned issue before running anything.
PoC: CVE-2026-85097
For WordPress
PoC: CVE-2021-21413
CVE-2021-21413 isotaled-vm Sandbox Escape PoC
PoC: CVE-2026-110025
CVE-2026-110025: bilingual analysis and safe local PoC for phpwcms unrestricted upload to RCE
PoC: CVE-2026-108924
CVE-2026-108924: didactic PoC for Kirby dynamic option authorization bypass
PoC: factura-malware-analysis-lab
Malware analysis of a malicious RTF document exploiting CVE-2017-11882, done in a REMnux lab with static analysis and shellcode emulation.
PoC: Reflected-XSS-Bludit-CVE-2026-41456
Implementation of varios cross site scripting payloads to exploit CVE-2026-41456
PoC: tmog-rapl-gate
Let Task Manager TMOG read RAPL power on Linux only while it runs — no permanent udev grant (CVE-2020-8694)
PoC: CVE-2026-85884
CVE-85884 POC
PoC: CVE-2026-104935-Proof-of-concept
Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)
PoC: CVE-2026-82957
SSRF in Hyperledger FireFly Webhook Subscriptions (CVE-2026-82957)
PoC: CVE-2026-76268
CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268
PoC: CVE-2026-86086
Zephyr Project: under embargo until 2026-12-01
PoC: POC-for-CVE-2026-104711---New
POC for CVE-2026-104711 - New
PoC: CVE-2025-41450_poc
Code Of The Day
PoC: CVE-2026-102718
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length.
PoC: CVE-2026-102827
Command execution and patch bypass of CVE-2026-28291 in git-js.
PoC: telegram-account-takeover-poc
CVE-2026-107181 Proof Of Concept for telegram Desktop account take over in windows
PoC: CVE-2026-105950
Bilingual PoC and technical analysis for CVE-2026-105950 — Formwork formaction URI sanitizer bypass
PoC: POC-EXPLOIT-CVE-2026-104711
POC EXPLOIT CVE-2026-104711
PoC: CVE-2026-68582-PoC
PoC for CVE-2026-68582 / GHSA-rj9j-8772-4h6c — Vikunja link-share BOLA
PoC: dymo-id-cve-poc
PoCs for CVE-2026-102262 & CVE-2026-101893 — code execution and XXE in DYMO ID (reported & fixed)
PoC: CVE-2026-72898-metabase
CVE-2026-72898 Metabase Security Tools
PoC: CVE-2026-107159
MiniUPnPd <= 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
PoC: CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE
CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE
PoC: CVE-2026-104711-Advanced-Variant
POC for CVE-2026-104711-Advanced-Variant
PoC: KDSExtract
Exploits CVE-2026-58222 to recover Samba KDS root keys and derive gMSA credentials from a low-privilege domain account.
PoC: CVE-2026-104711-exploit-payload-4
POC for the CVE-2026-104711 new variants
PoC: CVE-2026-104711-POC-Variant3
POC for the CVE-2026-104711 which is a new variant
PoC: CVE-2026-104711
POC for the CVE-2026-104711
PoC: CVE-2026-85097
POC CVE-2026-85097
PoC: CVE-2026-41992-poc
POC for the CVE-2026-41992
PoC: fromagegate
FROMAGEGATE — PoC + detection toolkit for Danfoss AK-SM 8xxA CVE-2025-41450/-41451/-41452 (code-of-the-day auth bypass, alarm-to-mail RCE, nginx config injection). For detection-signature development.
PoC: rails-doubletap-py
Automated Ruby on Rails doubletap RCE (CVE-2019-5418 + CVE-2019-5420) in pure Python, using the ERB#def_module gadget for modern Ruby.
PoC: CVE-2026-3888-PoC
CVE-2026-3888 PoC; discovered by the Qualys Threat Research Unit (TRU).
PoC: CVE-2025-32432-craftcms-rce
Working PoC + debugging writeup for CVE-2025-32432 (Craft CMS pre-auth RCE)
PoC: CVE-2026-84411-reproduction
CVE-2026-84411 root cause notes and a non-destructive probe (RouterOS before 7.24)
PoC: sonicwall-sma-1000-cve-2026-102255
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
PoC: smartermail
CVE-2026-104082, CVE-2026-104083, CVE-2026-104084
PoC: CVE-2026-91737
CVE-2026-91737 Chrome renderer RCE PoC (PDFium)
PoC: CVE-2026-102255
CVE-2026-102255 - Draft or TODO
PoC: CraftCMS-CVE-2026-79987
Authenticated RCE exploit for Craft CMS 5.9.0–5.10.12 (CVE-2026-79987). Time-based save-action oracle + raw-TCP exfil. Verified on vanilla lab.
PoC: kgsl-1905-msm8953
Research notes & harnesses: KGSL SVM use-after-free (CVE-2021-1905) on Qualcomm MSM8953 / Adreno 506 / kernel 3.18 armv7. Credits upstream patches and prior art.
PoC: postgres-basebackup-symlink
PostgreSQL 18.6 - High - Remote - File write - pg_basebackup follows absolute tar symlink leftover of CVE-2026-6475
PoC: CVE-2026-103889
Proof of concept and isolated Docker lab for CVE-2026-103889, an unauthenticated RCE vulnerability in Expivi 3D Product Configurator for WooCommerce ≤ 2.16.2.
PoC: CVE-2026-9586_POC_EXPLOIT
For new CVEs without existing/working/non-mangled POCs
PoC: CVE-2026-91136
CVE-2026-91136 Divi Plus <= 2.4.0 unauthenticated arbitrary file read (mass scanner + exploit)
PoC: langflow-cve-2026-9198
Independent reconstruction, lab validation, and PoC for CVE-2026-9198, the Langflow unauthenticated RCE (fixed in 1.10.1)
PoC: metabase-cve-2026-72898
Independent reconstruction, lab validation, and PoC for CVE-2026-72898 — Metabase unauthenticated SQLi (patched in 0.63.5)
PoC: CVE-2026-15748
Unauthenticated RCE in WordPress Forminator Forms <= 1.56.1 (CVSS 9.8)
PoC: CVE-2026-104286-PoC
PoC CVE-2026-104286 FortiMail
PoC: ReactorWriteUp-HackTheBox
Reactor es una máquina Linux fácil vulnerable a CVE-2025-55182 (React2Shell), RCE sin autenticación en React Server Components. Accedemos como node, crackeamos un hash MD5 de una base de datos SQLite y pivotamos a engineer por SSH. La escalada abusa del flag --inspect de Node.js para ejecutar código como root vía depuración V8.
PoC: CVE-2026-105306
CVE-2026-105306: Token Introspection Audience Bypass via Dynamic Client Registration in Keycloak - Writeup by DungSoCool
PoC: GhostLock-Next
The next implementation of GhostLock CVE-2026-43499
PoC: ElasticRift
A vulnerable-by-design, secure-by-deployment NGINX pipeline centered around the aftermath of CVE-2026-42945 (NGINX Rift).
PoC: CVE-2026-27626
CVE-2026-27626 - OliveTin <3000.10.0 OS command injection via password-typed arguments, escalating to root when OliveTin runs as root.
PoC: Exploit-CVE-2026-40224
CVE-2026-40224: systemd-machined local privilege escalation
PoC: CVE-2026-41940-PoC
cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation
PoC: CVE-2025-57819
FreePBX unauthenticated SQLi (endpoint module)
PoC: CVE-2026-43805
Binary diff analysis and non-destructive PoC for CVE-2026-43805
PoC: diskcache-community
Community-maintained hard fork of grantjenks/python-diskcache: SQLite-backed persistent cache for Python, with a fix path for CVE-2025-69872
PoC: CVE-2026-108592-poc
CVE-2026-108592 — Environment Variable Exposure PoC in mini-swe-agent
PoC: odin-od105-devkit
CVE-2019-2215 temporary root toolkit for Smartisan Nut Pro (OD105)
PoC: CVE-2026-84568
Reproducible macOS automountd research and lab PoCs for CVE-2026-84568 and CVE-2026-84570: fstype path traversal, NFS payload delivery, Gatekeeper behavior, and root code execution.
PoC: cs50-cybersecurity-final-project
Technical analysis of Log4Shell (CVE-2021-44228) for CS50 Cybersecurity.
PoC: CVE-2026-84411
CVE-2026-84411 — MikroTik RouterOS WebFig Integer Underflow Exploit
PoC: CVE-2025-9548
CVE-2025-9548: Lenovo Power Management Driver null-pointer dereference research and gated PoC
PoC: CVE-2026-69414
**CVE-2026-69414** is an elevation of privilege vulnerability in the **Microsoft Malware Protection Engine** (part of Windows Defender / Microsoft Defender Antivirus), publicly referred to as **"RoguePlanet"**. It represents a **patch bypass** of the original vulnerability **CVE-2026-50656**.
PoC: CVE-2026-103690
SQL injection (CWE-89) in itsourcecode Leave Management System 1.0 - CVE-2026-103690 / VulDB VDB-412559
PoC: CVE-2026-102428
CVE-2026-102428 PoC: OrdaSoft Joomla OS CCK (com_os_cck) <=8.3.15 unauth SQLi — order_field/order_direction ORDER BY injection on public listings. Check + mass exploit, POCBIT-102428-OK marker, CVSS 9.3. https://pocbit.org/pocs/cve-2026-102428
PoC: CVE-2026-106445
CVE-2026-106445 — Handlebars 4.0.0–4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f). PoCbit PoC + Docker lab (4.7.9), check/exploit HTTP client, GHSA template chain. Fixed 4.7.10. https://pocbit.org/pocs/cve-2026-106445
PoC: CVE-2026-107806
CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET /api/backup, tamper app.ini, POST /api/restore, POST /api/nginx/test. check/exploit, batch url|JWT. Fixed 2.5.0. https://pocbit.org/pocs/cve-2026-107806
PoC: ModelSim-Decryptor
CVE-2021-42023
PoC: CVE-2026-94503
Zombify <= 1.7.7 Unauthenticated Arbitrary File Upload
PoC: CVE-2026-85097
Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload
PoC: Docker-Lab-CVE-2024-4367
Docker lab to test proof of concepts for CVE-2024-4367. A high-severity type confusion and remote code execution flaw in Firefox PDF.js font handling due to missing type checks (affecting Firefox < 126, Firefox ESR < 115.11, and PDF.js < 4.2.67).
PoC: braces-security-backport
MIT-licensed braces 3.0.3 with reviewed CVE-2026-93687 depth backport; pinned consumption only
PoC: fortimail-cve-2026-104286-response
FortiMail CVE-2026-104286 (CVSS 9.8) 점검·대응 도구 (버전 확인, IoC 점검, 완화·패치 체크리스트)
PoC: telegram-cve-2026-107181
Telegram CVE-2026-107181
PoC: CVE-2026-84520
AppleFDEKeyStore poc
PoC: larkspur-billing
Synthetic-data billing portal pinned to next@14.2.24 (CVE-2025-29927) — test customer for oopsie
PoC: apache-tomcat-security-audit
Penetration test of Apache Tomcat — Ghostcat, CVE-2017-12615 and Struts2/OGNL exploitation with MITRE ATT&CK mapping
PoC: CVE-2026-21589
Atlassian Arbitrary File Read
PoC: honor90-ghostlock
GhostLock (CVE-2026-43499) + KernelSU late-load port for Honor 90 REA-NX9, MagicOS 9.0.0.211 / Android 15 (pure-GKI 5.10.236). Fork of GhostLock-H80GT.
PoC: CVE-2025-34071
RCE in Kerio Control 9.4.5 via unsigned firmware update.
PoC: honor-90gt-mag-an00-root-research
荣耀 90 GT (MAG-AN00) 提权尝试全记录：CVE-2026-64560 移植、堆喷射原语穷举与漏洞判定方法论
PoC: CVE-2026-28775
CVE-2026-28775 SNMP RCE
PoC: CVE-2021-26828
Corrected python code for CVE-2021-26828
PoC: citrix-netscaler-rce-cve-2026-107406
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
PoC: CVE-2026-94597-poc
CVE-2026-94597
PoC: REDMI_Root
Redmi Pad Pro (dizi) 内核 Root 方案 — CVE-2026-43499 select_stack 适配，KernelSU 越狱模式
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free