## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jf8q-945g-9q4c. This link is maintained to preserve external references. ## Original Description vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omits nodejs.stream.disturbed and nodejs.stream.errored, which are exposed on host WebStream prototypes on newer Node.js releases (validated on Node.js v25.8.0). When the embedder exposes a host WebStream object and the host stream/web module to the sandbox, sandbox code can obtain the real host symbols via Object.getOwnPropertySymbols(streamWeb.ReadableStream.prototype) and use them as write keys on host stream objects, corrupting host-visible stream state — for example making stream.Readable.isDisturbed() return false for an already-consumed stream. This can bypass host logic that relies on Node's public stream-state helpers to enforce one-shot body consumption, reject errored streams, or decide whether a stream is safe to hand to another component. It is not a host code-execution primitive in the reported proof of vulnerability. This is an incomplete fix for the earlier nodejs.* symbol filtering issue. Fixed in vm2 3.11.7.
PoC: CVE-2026-83844
Microsoft Paint CVE-2026-83844 Verification Script
PoC: CVE-2026-86777-AlchemyCMS-Navigation-Disclosure
Technical research and proof of concept for CVE-2026-86777 affecting AlchemyCMS.
PoC: CVE-2026-94113-ERPNext-Timesheet
Technical analysis and proof of concept for CVE-2026-94113 — Missing Authorization in ERPNext Timesheet endpoints.
PoC: CVE-2026-123158
sshole (CVE-2026-123158): OpenSSH password bypass on alpine Linux
PoC: CVE-2026-123158
OpenSSH + musl password authentication bypass (sshole) checker: local precondition audit + remote verification; for authorized testing
PoC: CVE-2026-123158
Exploit para explotar la vulnerabilidad CVE-2026-123158 (conocida como sshole).
PoC: CVE-2026-116214
CVE-2026-116214: unauthenticated account takeover in MacCMS v10 via an unbound password-recovery code. Full technical writeup + self-contained Docker lab (maccms10 2021.1000.2000, PHP 7.4, MariaDB, Mailpit). For authorized testing only.
PoC: GhostKey
Ephemeral root through CVE-2026-98260 vulnerability (GhostKey).
PoC: 360-kidwatch-11X-W370-Ghostroot
A stealthy, file-based Local Privilege Escalation (LPE) PoC for 360 11X W370 (Unisoc SC8541E, Android 8.1) exploiting CVE-2025-31710. No PC required. For research only.
PoC: CVE-2026-96838
CVE-2026-96838: Cross Site Request Forgery (CSRF) in Blacklist Manager for WooCommerce WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-95597
CVE-2026-95597: Unauthenticated Settings Change in PGALL for WooCommerce (????? ?? ????) WordPress Plugin. PoC by Mor Golan.
PoC: cve_2026_98432_livepatch
Reference livepatch for CVE-2026-98432 on Ubuntu 22 5.15.0-71-generic
PoC: CVE-2026-94641
CVE-2026-94641: Unauthenticated Cross Site Scripting (XSS) in UsersWP WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-94074
CVE-2026-94074: Unauthenticated Broken Access Control in Simply Schedule Appointments WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-61989
CVE-2026-61989: Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-39732
CVE-2026-39732: Unauthenticated SQL Injection in Transliterator WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-122675
CVE-2026-122675: Cross Site Request Forgery (CSRF) in Wp Social WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-115596
CVE-2026-115596: Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-112869
CVE-2026-112869: Unauthenticated Cross Site Scripting (XSS) in We're Open! WordPress Plugin. PoC by Mor Golan.
PoC: CVE-2026-112222
CVE-2026-112222: Broken Access Control in Surfer WordPress Plugin. PoC by Mor Golan.
PoC: SOC-wordpress-compromise-report
Incident report: WordPress compromise via Simple File List RCE (CVE-2020-35489)
PoC: CVE-2026-19868
SonicWall SonicOS SSLVPN SAML / MFA bypass (Gen7 / Gen8)
PoC: w25-cve-2026-43499-notes
Field notes: CVE-2026-43499 on Samsung Galaxy W25 (SM-W9025, CHC) - offsets, failed routes, repro
PoC: module-sessionreaper-patch
Free security patch for Magento Open Source and Mage-OS by Big Cart Energy: closes CVE-2025-54236 (SessionReaper) on the Magento 2.3 and 2.4 releases that have no official fix, as one plugin on the Web API input processor that applies the allow-list of Adobe's fix. No core file is modified.
PoC: module-cosmicsting-patch
Free security patch for Magento Open Source and Mage-OS by Big Cart Energy: closes CVE-2024-34102 (CosmicSting) on the Magento 2.3 and 2.4 releases that have no official fix, as one plugin on the Web API input processor that applies the rule of Adobe's fix. No core file is modified.
PoC: MiTV-MFTP0-GhostLock
GhostLock (CVE-2026-43499) port for Xiaomi MiTV-MFTP0 (alita / L65R8-X), MediaTek MT9652, Android 9, kernel 4.9.118 - futex PI UAF LPE, full partition map, TvService backdoor analysis.
PoC: CVE-2026-109618
Test the CVE-2026-109618 in a safe environment (VMware, VirtualBox,...)
PoC: redmi-k50-temp-root
Redmi K50 (rubens) 临时 Root 教程 — 基于 DirtyFrag (CVE-2026-43284) + libbase fallback
PoC: keycloak-saml-scanner
Detection-only triage for CVE-2026-117691 (CVSS 9.1): Keycloak SAML HTTP-Redirect binding signature bypass, fixed in 26.8.2
PoC: CVE-2026-123014---iTerm2-Terminal
PoC and research for CVE-2026-123014: iTerm2 x-man-page NUL-byte argument injection.
PoC: sshole
A simple reproducer for CVE-2026-123158
PoC: CVE-2026-83844-Detection
Detection and remediation scripts for CVE-2026-83844, Windows Paint remote code execution (CVSS 8.1)
PoC: cve-2026-123158-openssh-musl-lab
Automated Terraform lab environment for OpenSSH on Linux with musl libc without PAM (CVE-2026-123158 research)
PoC: CVE-2026-123488-POC
POC exploit for CVE-2026-123488 - unauthenticated SQL injection vulnerability in Craft CMS (MySQL/MariaDB backend). Admin takeover.
PoC: cve-2026-48356-magento-file-upload-rce
CVE-2026-48356 - Adobe Commerce/Magento Unrestricted File Upload RCE | CVSS 9.3 | By Gh0st-Bx1
PoC: cve-2025-32433-erlang-ssh-preauth-rce
CVE-2025-32433 - Erlang/OTP SSH Pre-Authentication RCE | CVSS 10.0 | By Gh0st-Bx1
PoC: cve-2026-97229-gitlab-ci-rce
CVE-2026-97229 - GitLab CE/EE CI/CD Integer Overflow RCE | CVSS 10.0 | By Gh0st-Bx1
PoC: CVE-2026-118423-WP-Libre-Form
Sable Research — Analysis of CVE-2026-118423: Unauthenticated Arbitrary File Upload to RCE in WP Libre Form (≤ 1.5.0.1)
PoC: mysql-connector-j-cve-2026-101678-repro
Reproducer for CVE-2026-101678 (MySQL Connector/J <= 26.7.0) - malicious server reporting huge result-set column count
PoC: php2shell-lab
PHP session.upload_progress CVE-2026-109618 lab PoC and research notes
PoC: CVE-2026-123158_SSHRole_PoC
Prova de conceito para exploração da vulnerabilidade CVE-2026-123158.
PoC: cve-2026-113615-poc
CVE-2026-113615 - GS JWT <= 1.0.0 unauthenticated SQLi to administrator JWT (PoC + exploit by thiscitze)
PoC: openssh-musl-enterprise--hardening-cve-2026-123158
openssh-musl-enterprise-hardening (CVE-2026-123158)
PoC: CVE-2015-1201-wordpress-Reflex-Gallery-plugin-RCE-PoC
PoC exploit for CVE-2015-1201 (EDB-36374) — Unauthenticated Arbitrary File Upload to Remote Code Execution in WordPress Reflex Gallery Plugin ≤ 3.1.3. Features interactive webshell, reverse shell mode, and multi-path upload fallback.
PoC: logsign-rce
Logsign Unified SecOps Platform: Pre-Auth Authentication Bypass (CVE-2024-5716) & RCE (CVE-2024-5717) Exploit Chain & Detection Suite
PoC: CVE-2026-118423
CVE-2026-118423 — WP Libre Form <= 1.5.0.1 unauthenticated file upload to RCE (PoC, lab-verified)
PoC: CVE-2026-83844-PoC-MS-paint-v-11.2609.401.0
A proof of concept for CVE-2026-83844. Microsoft paint version 11.2609.401.0
PoC: sshole_scanner-CVE-2026-123158
A scanner for *sshole SSH vulnerability (CVE-2026-123158)
PoC: cortex9-openssl-asn1-string-nul-scanner
Lexical scanner for ASN1_STRING uses that assume NUL termination (CVE-2021-3712). Labels are NUL_SINK_WARNING, BOUNDED_PATTERN or UNKNOWN; heuristic, not a flow analysis.
PoC: cortex9-rust-regex-empty-repetition-size-limit-model
Offline model of the regex 1.5.4 compile-size accounting for empty repetitions (CVE-2022-24713), checked against regex-syntax HIR and real compile results. Bounded cases are labelled MODEL_LIMIT.
PoC: cortex9-node-tar-path-sanitization-model
Offline Python port of node-tar path sanitization (CVE-2021-32804, CVE-2021-37713) with a differential check against the original CHECKPATH logic. No archives are extracted.
PoC: cve-2026-100109-poc
CVE-2026-100109 - Security For WooCommerce 1.0.10-1.0.16 unauthenticated admin creation (PoC by thiscitze)
PoC: cve-2026-114630-poc
CVE-2026-114630 - ELEX HelpDesk <= 3.3.8 unauthenticated arbitrary file deletion (PoC by thiscitze)
PoC: cve-2026-118423-poc
CVE-2026-118423 - WP Libre Form <= 1.5.0.1 unauthenticated upload to RCE (PoC by thiscitze)
PoC: cortex9-heartbleed-heartbeat-bounds-model
Offline model of the OpenSSL heartbeat bounds check (CVE-2014-0160) over an in-memory record and a labelled simulated region. No TLS, no real memory.
PoC: cortex9-rust-str-repeat-capacity-overflow-model
Abstract execution of Rust [T]::repeat capacity arithmetic in 1.29.0 vs 1.29.1 (CVE-2018-1000810) for 16/32/64-bit usize. Allocates nothing.
PoC: cortex9-expat-utf8-name-validation-model
Offline Python model of expat's UTF-8 name checks before/after the CVE-2022-25235 fix, with an independent RFC 3629 decoder. No XML parsing of untrusted input.
PoC: cortex9-dirtycow-gup-cow-state-model
Finite state/interleaving model of the GUP FOLL_WRITE/COW race vs MADV_DONTNEED (CVE-2016-5195). Abstract states only, no syscalls.
PoC: cortex9-expat-namespace-separator-model
Offline Python model of expat addBinding/namespace-separator handling in 2.4.4, 2.4.5 and 2.4.7 (CVE-2022-25236). String-level only.
PoC: cortex9-tmpfiles-hardlink-chown-race-model
Limited educational in-memory FS model of systemd-tmpfiles path_set_perms vs hardlinks (CVE-2017-18078). Not a finding; no real files.
PoC: vsftpd-2.3.4-backdoor-vulnerability_analysis
Hands-on vulnerability assessment of the vsftpd 2.3.4 backdoor (CVE-2011-2523) in an isolated lab.
PoC: cortex9-time-crate-env-race-interleaving-model
Finite interleaving model of time 0.2.22 tzset/getenv vs setenv realloc (CVE-2020-26235). No threads, libc or real environment.
PoC: vsftpd-2.3.4-backdoor-vulnerability-analysis
Hands-on vulnerability assessment of the vsftpd 2.3.4 backdoor (CVE-2011-2523) using Kali Linux, Nmap, Metasploit and an isolated Metasploitable 2 lab.
PoC: CVE-2026-83844
CVE-2026-83844
PoC: check-sshole
Find Dockerfiles that ship an sshd exposed to *sshole (CVE-2026-123158). CLI, pre-commit hook and GitHub Action.
PoC: CVE-2026-123025
OS command injection as root via Google Cloud DNS challenge key
PoC: ansible-sshole-remediate
Ansible playbook that upgrades OpenSSH to 10.6p2 on Alpine Linux to remediate CVE-2026-123158
PoC: CVE-2026-98260-pkt110-kernelsu
CVE-2026-98260 (posix-cpu-timers UAF) to KernelSU on a bootloader-locked OPPO PKT110: exploit core, on-device app, and the research write-up.
PoC: cortex9-openssl-bn-mod-sqrt-loop-model
Pure-Python port of OpenSSL BN_mod_sqrt before/after the CVE-2022-0778 fix, with a step budget on the loops that can grow. Offline.
PoC: cortex9-lodash-defaultsdeep-prototype-pollution-model
Python model of lodash _.defaultsDeep 4.17.11 vs 4.17.12 (CVE-2019-10744) in a throwaway realm. No JS engine, no gadgets.
PoC: cortex9-git-case-insensitive-symlink-checkout-model
In-memory model of git's checkout lstat cache before/after 684dd4c2b414 (CVE-2021-21300). No git, no clone, nothing written to disk.
PoC: cortex9-rust-zip-size-hint-overflow-model
Safe-Rust model of core Zip TrustedRandomAccess before/after rust-lang/rust PR #82289 (CVE-2021-28879). Model indices only; not a reproduction.
PoC: cortex9-git-safe-directory-discovery-model
In-memory model of git repository discovery and the safe.directory ownership check (CVE-2022-24765). Never runs git or touches the real FS.
PoC: cortex9-http2-priority-churn-cost-model
Offline Rust model of the HTTP/2 priority tree with a work counter and nginx PRIORITY budget (CVE-2019-9513 study). No sockets; not a reproduction.
PoC: Shizuka
Post-root DirtyFrag (CVE-2026-43284) mitigation for Galaxy S25 — a build-gated KernelSU kernel module that privatizes ESP receive buffers. Verified on SM-S931Z / DZIF only.
PoC: CVE-2026-120209
Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation | RCE
PoC: sshole-bypass-openssh-password
sshole漏洞复现，CVE-2026-123158
PoC: cortex9-rust-batbadbut-args-model
Offline model of Rust std 1.77.1 vs 1.77.2 batch-file argument quoting (CVE-2024-24576). No processes, no cmd.exe; real cmd behaviour UNKNOWN.
PoC: cortex9-http2-rapid-reset-stream-accounting-model
Discrete-time Rust model of HTTP/2 stream accounting vs handler work for studying Rapid Reset (CVE-2023-44487). Not a reproduction, no sockets.
PoC: ghostlock-a55x
CVE-2026-43499 target port for Samsung Galaxy A55 5G (SM-A556, Exynos 1480, 6.1.157-android14-11) - offsets, P0 fingerprints, KernelSU pair
PoC: cortex9-terrapin-strict-kex-model
Abstract state model of SSH sequence numbers and OpenSSH strict KEX for studying Terrapin (CVE-2023-48795). Not a reproduction.
PoC: CVE-2026-98260-amg-an00
CVE-2026-98260 port for HONOR AMG-AN00 (SM8650 / 6.1.157-android14-11)
PoC: root-my-s24-on-oneui6.1
Using CVE-2026-43499 to root your Galaxy S24 Series on oneui 6.1(successful on 6.1.75-android14-11-29543898-abS9210ZHS4AYB3)
PoC: verification-gap-cve-2026-98432
A Patch Without Proof: the verification gap behind CVE-2026-98432
PoC: CVE-2026-118570
CVE-2026-118570 — CSRF on the Drupal fasttoggle toggle route
PoC: CVE-2026-109619-ZendPipelineLab
PHP CVE-2026-109619 stale session state: calibrated mod_php lab reproduction, evidence, and solver
PoC: CVE-2026-22765-poc
Unauthenticated RCE chain PoC for Dell Wyse Management Suite On-Prem < 5.5 (CVE-2026-22765 + CVE-2026-22766)
PoC: alpinegate
Find which images and containers run a vulnerable Alpine + OpenSSH combination (CVE-2026-123158) — five-condition check, zero network, first-hour playbook.
PoC: CVE-2026-118569
CVE-2026-118569 — any editor could publish every draft on a Drupal site
PoC: omada-advisory-check
Unofficial offline checker: Omada gateway firmware vs TP-Link bulletin 132084 (CVE-2026-19586). Not affiliated with TP-Link.
PoC: php2shell-coverage-check
Checks that Tenable scanning is set up to detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) on every PHP host: plugin feed, credentials, and scan settings. Lists the hosts to rescan and flags end-of-life PHP. Works with Tenable Vulnerability Management, Security Center, and .nessus files. Claude Code skill or standalone script.
PoC: sshole-guide
OpenSSH sshole(CVE-2026-123158) 알파인 sshd 점검을 벨로키와 쉽게 보기
PoC: ofbiz-scanner
Detection-only local triage for Apache OFBiz CVE-2026-83542 (CVSS 9.8) and the 24.09.08 batch — grades installs against the fixed release. No probing, no payloads.
PoC: alpine-openssh-sshole-auth-bypass
Vulnerability research, PoC reproduction lab, and technical analysis for Alpine Linux OpenSSH authentication bypass (CVE-2026-123158 / sshole)
PoC: CVE-2026-33439-PoC
pre-authentication remote code execution vulnerability affecting OpenIdentityPlatform OpenAM in versions equal to or earlier than 16.0.5
PoC: CVE-2026-122158
CVE-2026-122158: InvoiceShelf cross-tenant privilege escalation analysis and safe local-lab PoC
PoC: cve-2026-41651-poc
CVE-2026-41651 - PackageKit 1.0.2-1.3.4 TOCTOU local privilege escalation, independent C implementation (PoC + exploit by thiscitze)
PoC: CVE-2026-76142
CVE-2026-76142 — Genian NAC/ZTNA pre-auth internal IPC routing flaw (gnrpcsvc), CVSS 9.3, fixed in build 148665+
PoC: CVE-2026-123158_SSHole
CVE-2026-123158 SSHole — OpenSSH authentication bypass via musl crypt() overflow on Alpine Linux (Exploit PoC)
PoC: sshole-check
Audit & interim mitigation for CVE-2026-123158 (*SSHole) — OpenSSH password bypass on musl/Alpine — across Docker containers, images and host
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free