Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth

PoC: Hikvision-CCTV-POC

This project is a single-target proof of concept (PoC) for assessing exposure to CVE-2017-7921, an authentication-bypass vulnerability affecting certain Hikvision IP camera and NVR firmware. The script attempts to retrieve a device configuration file and, when the returned data matches the format implemented in this PoC, decrypts and parses it to

PoC: CVE-2026-98260-Xiaomi-17-Pro-Max

CVE-2026-98260 在小米 17 Pro Max 的工程化利用一键 root

PoC: CVE-2026-86596

CVE-2026-86596 - s2Member <= 260927 Weaponized RCE

PoC: CVE-2026-119977-Toolkit

CVE-2026-119977 – WordPress Core Upgrade-Window RCE (CVSS 8.1) | Red/Blue Team Toolkit. Predictable staging dir takeover, wp-config.php promotion, Bait MySQL proof, WAF origin discovery, rate-limited race oracle, admin shell deploy, version triage. Async, CI-tested. Only ethical & authorized use, stay legal.

PoC: CVE-Disclosures

30 CVE disclosures (CVE-2026-117226 to CVE-2026-117255) — SQL Injection, Broken Access Control, File Upload RCE, Information Disclosure across 11 open-source applications. Discovered by Mohamed Aziz Tounsi.

PoC: CVE-2026-116214

CVE-2026-116214: unauthenticated account takeover in MacCMS v10 via an unbound password-recovery code. Full technical writeup + self-contained Docker lab (maccms10 2021.1000.2000, PHP 7.4, MariaDB, Mailpit). For authorized testing only.

PoC: cve-2026-123158-sshole

Scanner CVE-2026-123158 *SSHHole

PoC: CVE-2025-50579-CORS-Misconfiguration-Exploit

nginx CVE-2025-50579 CORS Exploit

PoC: CVE-2026-102334-exploit

CVE-2026-102334 nginx proxy manager Exploit

PoC: CVE-2026-123158

CVE-2026-123158

PoC: cve-2026-109518-apt-patch-proxmox-and-generic

Silly little patch for cve-2026-109518 for apt targeting generic linux and Proxmox host, VM's, containers. CVE happily fixed now by post package maintainers but could be of use. This is how I fixed it while an actual fix was being developed. Tested to work and vibe coded with Claude Opus 5.5.

PoC: CVE-2026-10795_POC

AI amended PoC for CVE-2026-10795 - for educational purposes only - use at your own risk on labs you own ;)

PoC: libtar-CVE-2021-33644-followup

libtar: incomplete fix for CVE-2021-33643/CVE-2021-33644 (heap OOB read in GNU long-name handling)

PoC: php2shell

php2shell (CVE-2026-109618 / CVE-2026-109619) — deliberately vulnerable PHP 8.4.26 lab with a patched 8.4.27 control and a working proof-of-concept that lands a shell as www-data.

PoC: CVE-2026-109619-ZendPipelineLab

PHP CVE-2026-109619 stale session state: calibrated mod_php lab reproduction, evidence, and solver

PoC: CVE-2026-22765-poc

Unauthenticated RCE chain PoC for Dell Wyse Management Suite On-Prem < 5.5 (CVE-2026-22765 + CVE-2026-22766)

PoC: CVE-2026-118569

CVE-2026-118569 — any editor could publish every draft on a Drupal site

PoC: omada-advisory-check

Unofficial offline checker: Omada gateway firmware vs TP-Link bulletin 132084 (CVE-2026-19586). Not affiliated with TP-Link.

PoC: php2shell-coverage-check

Checks that Tenable scanning is set up to detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) on every PHP host: plugin feed, credentials, and scan settings. Lists the hosts to rescan and flags end-of-life PHP. Works with Tenable Vulnerability Management, Security Center, and .nessus files. Claude Code skill or standalone script.

PoC: sshole-guide

OpenSSH sshole(CVE-2026-123158) 알파인 sshd 점검을 벨로키와 쉽게 보기

PoC: ofbiz-scanner

Detection-only local triage for Apache OFBiz CVE-2026-83542 (CVSS 9.8) and the 24.09.08 batch — grades installs against the fixed release. No probing, no payloads.

PoC: alpine-openssh-sshole-auth-bypass

Vulnerability research, PoC reproduction lab, and technical analysis for Alpine Linux OpenSSH authentication bypass (CVE-2026-123158 / sshole)

PoC: CVE-2026-33439-PoC

pre-authentication remote code execution vulnerability affecting OpenIdentityPlatform OpenAM in versions equal to or earlier than 16.0.5

PoC: CVE-2026-122158

CVE-2026-122158: InvoiceShelf cross-tenant privilege escalation analysis and safe local-lab PoC

PoC: CVE-2026-76142

CVE-2026-76142 — Genian NAC/ZTNA pre-auth internal IPC routing flaw (gnrpcsvc), CVSS 9.3, fixed in build 148665+

PoC: CVE-2026-123158_SSHole

CVE-2026-123158 SSHole — OpenSSH authentication bypass via musl crypt() overflow on Alpine Linux (Exploit PoC)

PoC: sshole-check

Audit & interim mitigation for CVE-2026-123158 (*SSHole) — OpenSSH password bypass on musl/Alpine — across Docker containers, images and host

PoC: react--v19.2.1

Mirror of react/react at v19.2.1 (React2Shell / CVE-2025-55182 fix)

PoC: alpine-sshd-check

Read-only check for CVE-2026-123158: is your Alpine sshd affected by the password authentication bypass, fixed, or still running the old daemon? Tested on Alpine 3.21 to 3.24 and edge.

PoC: AGM3-W09HN-TempRoot

在 AGM3-W09HN 上通过 CVE-2022-38181 取得临时Root

PoC: cve-2024-26229-bof

Beacon Object File that exploits the Windows CSC (Client-Side Caching) driver for local privilege escalation.

PoC: cve-2026-98432

Temporary nftables mitigation + installer for CVE-2026-98432 (Ubuntu)

PoC: rgpd-cookie-legal

Fork de mantenimiento de 'Protección de Datos RGPD' (click-datos-lopd) con CVE-2023-46071 corregido. GPLv2.

PoC: root-key1

Temporary root for the BlackBerry KEYone BBB100-2 (ABS154, kernel 3.18.71) via GhostLock/CVE-2026-43499. No bootloader unlock, no EDL, no flashing.

PoC: php2shell-lean-plain

PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Lean 4 model, without a bug-specific property

PoC: php2shell-lean-chase

PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Lean 4 model, with the property that catches it

PoC: CVE-2026-98432-Ubuntu-Temporary-Mitigation

Temporary iptables mitigation for CVE-2026-98432 (CVSS 9.8) on Ubuntu Linux. Filters inbound IPv4 TCP packets containing IP options while awaiting kernel security updates. Not a kernel patch.

PoC: php2shell-plain

PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Rust/Verus model, without a bug-specific property

PoC: php2shell-chase

PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Rust/Verus model, with the property that catches it

PoC: CVEs

Lab, privilege-escalation check and detection for LiteLLM CVE-2026-114612 (internal user to proxy admin).

PoC: php-legacy-ubuntu

Signed apt repository with patched PHP 5.6-8.2 rebuilds (PHP2Shell CVE-2026-109618/109619) for Ubuntu 18.04 bionic and 20.04 focal

PoC: cve-2026-98432-mitigation

CVE-2026-98432 firewall mitigation for unpatched Linux OS.

PoC: CVE-2026-98432-update

This is the script to update

PoC: domino-emudhra-cert-mitigation

HCL Domino / Notes eMudhra 憑證事件 (CVE-2026-91403) 的最小化清查與移除 SOP，純 keytool，不需大型工具

PoC: RootMyZ9Turbo

Root iQOO Z9 Turbo using CVE-2026-98260

PoC: php2shell-web

Školní projekt: web o kritických zranitelnostech PHP2Shell (CVE-2026-109618/109619)

PoC: infinitycore-x200pro

CVE-2026-98260 temporary-root runner

PoC: ghostlock-z3q

GhostLock (CVE-2026-43499) port kit for the Samsung Galaxy S20 Ultra SM-G988U (z3q, kernel 4.19.113, non-BTF) — binary-first offsets, Samsung hardening map, KernelSnitch negative result, vmemmap roadmap

PoC: CVE-2026-109619-ZendPipelineLab

PHP CVE-2026-109619 stale session state: calibrated mod_php lab reproduction, evidence, and solver

PoC: CVE-2017-18349-fastjson1.2.24-vul

CVE-2017-18349漏洞环境与PoC

PoC: ubuntu-26.04-kernel-cve-2026-98432-patch-build-docker

Docker config that patches/builds kernel w/ CVE_2026_98432 fix

PoC: CVE-2026-122051

PoC and firmware emulation recipe for CVE-2026-122051 — unauthenticated command injection in the Edimax BR-6208AC /goform/mp handler (firmware ≤ 1.32)

PoC: CVE-2026-114550

CVE-2026-114550 / ZDI-CAN-31039: libwebsockets MQTT PUBACK OOB write PoC lab (podman)

PoC: CVE-2026-98432-Wazuh-

CVE-2026-98432 UAF Detection for Wazuh

PoC: CVE-2026-115290

PoC for CVE-2026-115290 (Elasticsearch unauthenticated DoS via the remote cluster server port, CWE-674, ESA-2026-201): validated node kill in a containerized A/B lab (8.19.23 vs 8.19.24)

PoC: zyxel-gs1900-scanner

Detection-only local triage for Zyxel GS1900 CVE-2026-107441 (exploited zero-day): grades model + firmware against Zyxel's .3 fix table and catches the .2 trap

PoC: CVE-2026-98260-GT7Pro-RMX5010

真我 GT7 Pro (RMX5010) 免解BL临时Root · CVE-2026-98260 机型适配 · KernelSU 晚加载 · Temporary root for realme GT7 Pro without bootloader unlock

PoC: php2sherlloktakparani

Exposure scanner and local repro harness for CVE-2026-109618 / CVE-2026-109619 (PHP 8.2-8.5 state corruption on bailout). Stdlib-only Python, offline-capable.

PoC: node2shell-check

Read-only scanner for Node2Shell / CVE-2026-111497

PoC: cve-2026-109518-audit

Read-only audit for CVE-2026-109518: APT HTTP backend hard-link reuse lets an on-path attacker swap a verified package (Debian/Ubuntu)

PoC: cve-2026-98432-mitigation

Script that applies the Ubuntu-published nftables mitigation for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free).

PoC: Mitigation_CVE-2026-98432

This nftables configuration ruleset can help mitigate attacks on your hosts that are vulnerable to CVE-2026-98432. The rule can help block incoming IPv4 TCP connections that contain IP options. Regular TCP connections without IP options can still go through. This is a temporary solution until the Linux Kernels are fully patched.

PoC: cve-2017-7921-hikvision-poc

Single-host PoC for authorized testing of CVE-2017-7921 on Hikvision cameras and NVRs.

PoC: broccoli2shell-gis

Säkerhetsvägledning för GIS-miljöer om Broccoli2Shell (CVE-2026-111497).

PoC: CVE-2026-118306

CVE-2026-118306: Chromium FileSystemAccessManagerImpl Use-After-Free (CVSS 9.6) - PoC, checker, detection rules

PoC: cloudflare-php-ctf-research

Research writeup: php2shell (CVE-2026-109618/109619) vs the Cloudflare PHP CTF — complete local chain, WAF lock analysis, original findings

PoC: CVE-2023-26360

Adobe ColdFusion - CVE-2023-26360

PoC: chromium-audit

Finds every Chromium engine on your PC, checks each against CVE-2026-118306/118331/118348/118344, and updates what it can. | 내 PC의 모든 Chromium 엔진을 찾아 위 CVE 영향권인지 점검하고, 가능한 것은 공식 경로로 업데이트합니다.

PoC: cve-2026-98260-adb

CVE-2026-98260 adb runner with Termux one-tap root

PoC: CVE-2026-44267

CVE-2026-44267 (GHSA-33r5-xmm8-v6x5) - Remote Code Execution vulnerability in @enspirit/elo

PoC: php2shell-analysis

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) 분석과 패치 기준 확인 예제

PoC: mi11-venus-temproot

Temporary root research for Xiaomi Mi 11 (venus / M2011K2C), HyperOS 2.0.6.0, kernel 5.4.274-qgki. Port of the CVE-2026-43499 futex-PI-UAF chain retargeted to this kernel.

PoC: php2shell-lab

Lingkungan laboratorium berbasis Docker Compose serta isolasi toolchain mise + uv untuk materi kuliah dan pembuatan video pembelajaran Keamanan Komputer mengenai CVE-2026-109618 dan CVE-2026-109619 (PHP2Shell).

PoC: CVE-2026-109618

High-level notes for CVE-2026-109618 in PHP mod_php. Exploit code is not included.

PoC: iqooNeo8-V2301A-DirtyFrag

iQOO Neo8 (PD2301/V2301A) 一键越狱 — DirtyFrag (CVE-2026-43284) port on the pyb110 UI

PoC: CVE-2021-42013

vulnerable Apache 2.4.50

PoC: CVE-2026-78818-cyberpanel-phpselection-rce

CVE-2026-78818 - CyberPanel <= 2.4.7 authenticated root RCE via phpSelection command injection + cloudAPI WAF bypass

PoC: php2shell-php-fpm-rce

Unauthenticated RCE exploit for PHP-FPM 8.4.26 via php2shell (CVE-2026-109618 / CVE-2026-109619) - phpMyAdmin 5.2.3, pure-HTTP PoC, defeats ASLR in-band.

PoC: ghostlock-pd2118c-4.19.152

CVE-2026-43499 futex PI UAF on a 4.19.152 ARM64 vendor kernel (iQOO Neo5 / PD2118C, Android 14). L1–L3 reproduced; L4 blocked by the SELinux capability class. Field notes on primitive design, offset derivation and criterion discipline.

PoC: xz-utils-case-study

Cybersecurity Analyst project examining the XZ Utils Backdoor (CVE-2024-3094) and lessons learned from a major software supply chain attack.

PoC: CVE-2026-98432_poc

Python-based PoC for CVE-2026-98432, probing anomalous IPv4 TCP option behavior associated with a Linux kernel use-after-free race condition.

PoC: CVE-2026-97798

CVE-2026-97798

PoC: imaging

Maintained fork of disintegration/imaging: no TIFF/BMP decoders (CVE-2023-36308 gone), GIF palette panic fixed, WebP decode. Pure Go.

PoC: php-7.2.11-cve-2026-109618-fix

Unofficial backport

PoC: CVE-2026-110186

CVE-2026-110186: Langflow OSS code injection via pydoc scanner bypass (CVSS 9.8, pre-auth RCE)

PoC: CVE-2026-21440-adonisjs-bodyparser

Docker-based reproduction lab for CVE-2026-21440. A path traversal / arbitrary file write vulnerability in @adonisjs/bodyparser ≤10.1.1.

PoC: CVE-2022-21675

Demo of CVE-2022-21675 in class

PoC: CVE-2026-58115

CVE-2026-58115: Siemens SIMATIC IoT2050 Node-RED unauthenticated root RCE. PoC, scanner, PCAP, detection rules.

PoC: CVE-2025-32463

PoC From CVE-2025-32463

PoC: wordpress-core-scanner

Detection-only local triage scanner for CVE-2026-119977 (CISA KEV 2026-11-03) in WordPress Core: grades versions 4.7-7.1.3 against per-branch fixes (7.1.4 and backports) and flags wp-content/upgrade exposure. No payloads, no remote probing.

PoC: CVE-2022-23943

CVE-2022-23943 exploit

PoC: CVE-2026-56190-Full-RCE-Chainn

Full unauthenticated RCE chain for Windows Server 2022 by chaining CVE-2026-56190 (RCE) and CVE-2026-42908 (Info Leak). Bypasses ASLR, CFG, XFG, and DEP.

PoC: HTB-Cohort

HTB Cohort writeup -- SSRF, Marimo CVE-2026-39987, PackageKit CVE-2026-41651

PoC: CVE-2026-92183_GIMP_RCE_Proof-of-Concept

GIMP 3.2.2 contains a stack-based buffer overflow in its APNG loader (load_apng_image) when processing the tRNS (transparency) chunk. This writeup demonstrates a proof of concept for remote code execution leveraging this vulnerability.

PoC: the-php2shell-recipe

One recipe, any unpatched build → RCE in ~30 minutes | CVE-2026-109618 research lab: 4-stage chain gdb-verified, 3 RCE builds (8.3.35/8.4.26/8.5.11), adaptation pipeline + profile DB

PoC: cve-2026-98432-mitigation

Temporary nftables mitigation for CVE-2026-98432 (Linux IPv4 TCP IP-options use-after-free)

PoC: cve-2026-80587-check

Temporary: check a Linux host for CVE-2026-80587 (MPTCP)

PoC: CVE-2021-4034

я разобрал уязвимость называемую в простонародии Pwnkit в учебных целях и написал к нему PoC. использовать строго в учебных целях

PoC: CVE-2026-112689-poc

Crash-only reproducer for CVE-2026-112689 in Apple's H.264 hardware decoder

PoC: cve_2026_98432_guard

Temporary eBPF/XDP mitigation for CVE-2026-98432 Linux TCP IPv4 header-options vulnerability. Helps protect unpatched systems and custom kernels until an official kernel fix can be deployed.