### Summary The dashboard replay action authorizes the source run (it must belong to the caller's org), but the target environment for the replayed run is taken verbatim from the request body and is never checked for org or project membership. The environment lookup used by the replay path filters by id only. As a result, an authenticated user can replay one of their own runs into another organization's or project's environment, creating a task run there that consumes the victim tenant's queue and compute and pollutes their run history. ### Details The replay action member-scopes the source run correctly (apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts, the findFirst on taskRun filtered by `project.organization.members.some.userId`), but passes the target environment straight from the submitted form, resources.taskruns.$runParam.replay.ts:344-346: ```js const replayRunService = new ReplayTaskRunService(); const newRun = await replayRunService.call(taskRun, { environmentId: submission.value.environment, // attacker-controlled, unvalidated payload: submission.value.payload, ... }); ``` `submission.value.environment` comes from ReplayRunData (apps/webapp/app/v3/replayTask.ts: `environment: z.string().optional()`), so it is fully client-controlled. ReplayTaskRunService resolves it with no ownership check, apps/webapp/app/v3/services/replayTaskRun.server.ts:26-28: ```js const authenticatedEnvironment = await findEnvironmentById( overrideOptions.environmentId ?? existingTaskRun.runtimeEnvironmentId ); ``` findEnvironmentById, apps/webapp/app/models/runtimeEnvironment.server.ts:197-211: ```js export async function findEnvironmentById(id) { const environment = await $replica.runtimeEnvironment.findFirst({ where: { id }, // no membership / org / project filter include: authIncludeWithParent, }); if (!environment || environment.project.deletedAt !== null) return null; return toAuthenticated(environment); } ``` The resolved environment is then handed to TriggerTaskService.call (apps/webapp/app/v3/services/triggerTask.server.ts), which trusts the passed authenticatedEnvironment and performs no further authorization. The replay loader does constrain the environment picker to the run's own project (replay.ts around 178-184), but the action does not re-impose that constraint, so the server-side control is missing (UI-gated only). ### PoC As an authenticated user who owns a run in their own org (run param runParam), and who knows a target environment id belonging to another org or project (a CUID, obtained or guessed): ```http POST /resources/taskruns/<own runParam>/replay Content-Type: application/x-www-form-urlencoded environment=<environment id of the victim org/project>&failedRedirect=/... ``` The replay resolves the victim environment with no membership check and calls TriggerTaskService against it, creating a run in the victim tenant. Live-validated: a Postgres database was seeded with two tenants (orgA with env_A, orgB with env_B_victim) and the verbatim findEnvironmentById lookup (findFirst joining the environment to its project, `WHERE id = $1`, the exact query the replay path runs) was executed with the victim env id as an orgA attacker. Captured: ``` [002 replay findEnvironmentById] attacker(orgA) supplied env_B_victim -> {"id":"env_B_victim","organization_id":"orgB","project_id":"proj_B","deleted_at":null} CROSS-TENANT: CONFIRMED (resolved another org's env with no membership check -> replay would run there) ``` The lookup returned another organization's environment with no membership filter. That the replay action passes the client-supplied environmentId straight into this lookup (and TriggerTaskService trusts the returned env) is verified at source. ### Impact An authenticated user can create task runs in another tenant's environment (including production), consuming that tenant's queue concurrency and compute and inserting entries into their run history. Practical exploitation requires knowing a target environment id (not enumerable) and, for the injected run to actually execute rather than error, a task identifier that exists in the target environment; this bounds reliability but not the unauthorized cross-tenant write itself. ### Remediation In the replay action (or in ReplayTaskRunService), require the resolved target environment to belong to the source run's project/organization, for example assert `environment.projectId === existingTaskRun.projectId`, or re-validate the supplied environment id against the caller's membership (findEnvironmentBySlug with the validated projectId, or a members.some.userId filter), mirroring the constraint the loader already applies to the picker.
PoC: CVE-2026-112445
CVE-2026-112445: The Simplest macOS Local Privilege Escalation to Date
PoC: CVE-2026-43664
AirPods Bluetooth MAC Address Disclosure via NSUserDefaults
PoC: OtherActivityToken
Exploit for CVE-2025-0098, Activity token leak due to pid-only check and then use of that token for arbitrary startActivity()
PoC: CVE-2026-112706-CoreMedia-fd-leak
Independent discovery & coordinated disclosure: CoreMedia bytestream XPC (mediaplaybackd) vended live file descriptors for protected paths to any sandboxed app on iOS 26.5–27.0.1. Fixed in iOS 27.2 as CVE-2026-112706. PoC + evidence.
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: CVE-2026-98260-vivo-x-fold6-poc
CVE 2026 98260 vivo x fold6 poc
PoC: CVE-2026-98260-PMX110-Root618-Jailbreak
CVE-2026-98260 (exec: posix timer UAF) LKM jailbreak for OPPO Find X10 Pro Max (PMX110) and OnePlus 16 (PYB110): one-command root via shell uid 2000, with KernelSU / FinaSU / SukiSU / KernelSU-Next handover. Release build Root618 1.5.12 (R8-obfuscated).
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: brotli-node2shell-check
Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder
PoC: php2shell-lab
Lab reproduction, exposure probe and detection content for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell). Defensive research; no exploit.
PoC: php2shell
🐘 Ansible CVE-2026-109618, CVE-2026-109619 scanner
PoC: CVE-2026-26026-GLPI
Minimal source comparison and local lab files for CVE-2026-26026 in GLPI 11.0.5 and 11.0.6
PoC: CVE-2026-98432
Linux kernel IPv4 SYN IP-options use-after-free CVE-2026-98432 Mitigation work (Ansible Role)
PoC: cve-2026-98432-mitigation
Temporary mitigation for CVE-2026-98432 (Linux IPv4 TCP ireq_opt use-after-free): drop IPv4 TCP with IP options, disable MPTCP. Tested scripts + verification. EN/KO.
PoC: kpatch-cve-2026-98432
kpatch livepatch for CVE-2026-98432 (and CVE-2026-99999) on AlmaLinux and Rocky Linux 8, 9 and 10
PoC: phishing-analysis-thm
SOC-style investigation of a Netflix phishing email, CVE-2017-11882 exploitation, IOC extraction, and detection engineering mapping.
PoC: CVE-2026-33439
Pre-auth RCE exploit for OpenIdentityPlatform OpenAM <=16.0.5 via Java deserialization of the jato.clientSession parameter (CVE-2026-33439, CVSS 9.8). Comparator-based gadget chain with in-band command output through Tomcat ApplicationFilterChain thread-locals.
PoC: FBI-Tor-Exploit-CVE-2013-1690
Academic cybersecurity research project analyzing and restoring the FBI's 2013 Tor Browser deanonymization exploit, focusing on CVE-2013-1690, Firefox use-after-free vulnerabilities, exploit mechanisms, and historical forensic analysis.
PoC: Bootjack
CVE-2026-97631 C
PoC: CVE-2026-48907
Adapted PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5
PoC: cve-2026-98432-audit
cve-2026-98432 audit script (ipv4 TCP inet_opt/ireq_opt use-after-free)
PoC: php2shell-poc
CLI scanner and PoC for CVE-2026-109618 / CVE-2026-109619 (PHP OOM heap corruption and session upload-progress injection, CVSS 9.2). Affects PHP 5.4.0-8.5.11; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12. No external dependencies.
PoC: CVE-2026-88804
PoC CVE-2026-88804 (Rancher)
PoC: php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
PoC: CVE-2026-98260-dada-android
Verified CVE-2026-98260 Android port for Xiaomi 15 dada OS4.0.0.22.XOCCNXM
PoC: CVE-2025-4960
Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer
PoC: ghostlock-kirkwood
CVE-2026-43499 (GhostLock) port for the Google TV Streamer (kirkwood / MT8696): single-file, per-boot temporary root + interactive root shell, with a build-matching case study and adaptation guide.
PoC: node2shell
Node2Shell (CVE-2026-111497) detection-only scanner + lab — RedSide Security
PoC: CVE-2026-97555
CVE-2026-97555: heap overflow in the Linux SMB client DACL rewrite (cifs.ko) — analysis, POC, and an arm64 exploit chain ending in a uid-0 credential overwrite on the reference build
PoC: cve-2026-110311-gitea-lab
Local Gitea CVE-2026-110311 reproduction: vulnerable vs patched comparison, Python verifier, recorded evidence, and Turkish report.
PoC: nginx-rift-cve-2026-42945-lab
Interactive NGINX CVE-2026-42945 educational simulation built with HTML, CSS, and JavaScript. Features vulnerable and patched modes, synthetic request inspection, memory visualization, event logging, and security recommendations. No real exploit execution.
PoC: CVE-2026-12118-POC-
POC for CVE-2026-12118
PoC: CVE-2026-104286
Exploit for CVE-2026-104286 — FortiMail: Unauthenticated Arbitrary File Write → Code Execution
PoC: node2shell
Scanner to checking (CVE-2026-111497) vulnerability
PoC: PHP2Shell
CVE-2026-109618 & CVE-2026-109619 — Pre-Auth RCE in PHP Core (session.upload_progress). Scanner, exploit verifier, and full technical analysis.
PoC: CVE-2026-50053
Offline Python detector for CVE-2026-50053 version exposure in Zimbra Collaboration Suite.
PoC: CVE-2026-115889
Offline Python detector for CVE-2026-115889 version exposure in Wasmtime.
PoC: CVE-2026-53921
Offline Python source-pattern auditor for CVE-2026-53921 in odhcpd.
PoC: gitlab-rce-toolkit
CVE-2026-97229 + CVE-2026-110264 — GitLab Onigmo RCE Exploit Toolkit (CVSS 10.0)
PoC: CVE-2026-101259
Reproducer for CVE-2026-101259 — Apache Camel camel-coap consumer sent the exception message to the CoAP client as a 5.00 payload (CWE-209). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-71569
Reproducer for CVE-2026-71569 — Apache Camel camel-a2a push-notification webhook guard accepted an IPv6 unique local address (fc00::/7) reached through a host name (CWE-918). Camel Spring Boot + Camel Quarkus.
PoC: RDPBleed
CVE-2026-56190 - Windows RDP Server Uninitialized Resource leads to RCE
PoC: CVE-2026-94386
Reproducer for CVE-2026-94386 — Apache Camel camel-oauth cross-scope token reuse via a JVM-global token cache keyed only on endpoint+clientId (CWE-524). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-95629
Reproducer for CVE-2026-95629 — Apache Camel camel-docling passed the CamelDoclingOutputFilePath header to docling's --output verbatim (CWE-22). Camel Spring Boot + Camel Quarkus.
PoC: php2shell-advisory-response
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) advisory response: inventory, patch, Wazuh hunt mapping, attestation outline.
PoC: CVE-2026-95628
Reproducer for CVE-2026-95628 — Apache Camel camel-docling custom-argument path validation did not reject absolute paths, an incomplete fix of CVE-2026-40047 (CWE-22). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-95663
Reproducer for CVE-2026-95663 — Apache Camel camel-keycloak served a cached token introspection result past the token's expiry (CWE-613). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-97798_LPE_Windows
CVE-2026-97798 PoC — WER Time Travel Debugging argument injection to SYSTEM (Windows 11 LPE), with an adaptive faultrep.dll resolver.
PoC: CVE-2026-95664
Reproducer for CVE-2026-95664 — Apache Camel camel-aws2-s3 evaluated a header-supplied object key as a Simple expression (CWE-917). Camel Spring Boot + Camel Quarkus.
PoC: woff2shell
poc of CVE-2026-111497 delivered as a WOFF2 file
PoC: wiz-bulb-tool
WiZ smart bulb LAN security tool - auto-discovery, CVE-tagged audit, intel recon & device control. Extends CVE-2019-18980 to new hardware. No credentials required.
PoC: CVE-2026-90885
Reproducer for CVE-2026-90885 — Apache Camel camel-saxon XQuery XML External Entity via an already-built javax.xml.transform.Source (CWE-611, HIGH). Camel Spring Boot + Camel Quarkus.
PoC: cve-2026-109618-cve-2026-109619-poc
pHp2Shell CVE 2016 109618 - 109619
PoC: php2shell
Realistic multi-version lab + toolkit for the PHP php2shell pre-auth RCE (CVE-2026-109618/109619): detect, blindly prove, and understand it. No shared mounts, no planted files, no LFI.
PoC: secure-api-cve-2024-23897
Work 1 — secure Flask REST API, three-stage CI, and CVE-2024-23897 (Jenkins CLI) analysis
PoC: charla-php2shell
PHP2Shell (CVE-2026-109618/109619): demos reproducibles y guia de parcheo paso a paso.
PoC: PHP2shell
CVE-2026-109618_CVE-2026-109619
PoC: waffers
The layer that protects you. Proactive defense-in-depth Web Application Firewall mitigating recent critical PHP engine vulnerabilities including PHP2Shell (CVE-2026-109618/9), PHP-CGI Argument Injection (CVE-2024-4577), iconv Filter Chains (CVE-2024-2961), and stream wrapper abuse.
PoC: node2shell-inventory-scanner
Local inventory triage for Node2Shell (CVE-2026-111497): grade every Node, Bun and Brotli copy on disk. Detection-only, no network probes, no payloads.
PoC: php2shell-check
A Claude Skill that passively checks whether a website (and optionally its subdomains) runs PHP, confirms the version where possible, and flags exposure to PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: CVE-2026-97631-PoC
An educational laboratory for studying a PXE network-boot vulnerability in EDK II / OVMF. It builds a pinned EDK II revision, boots a UEFI virtual machine in QEMU, and includes Python proof-of-concept scripts for investigating denial of service (DoS) and memory corruption.
PoC: practica-integradora-ciberseguridad
Práctica Integradora de Ciberseguridad (Comisión 1) - Investigación, análisis técnico y laboratorio práctico de CVE-2021-41773 (Apache HTTP Server)
PoC: node2shell-audit
Read-only audit for Node2Shell (CVE-2026-111497): Node.js/Bun Brotli decoder out-of-bounds write
PoC: cve-2026-111497-wordpress-poc
CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress
PoC: demo-zip-rce-sandbox
Live demo: the same vulnerable Rust zip crate (RUSTSEC-2026-0367 setuid + CVE-2026-115905 zip cloaking) contained by a deny-by-default Cosmonic WebAssembly sandbox.
PoC: php2leak
Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)
PoC: CVE-2026-101767-research
Research notes on CVE-2026-101767 — unauthenticated vulnerability in Oracle Application Object Library (E-Business Suite)
PoC: threat-intelligence-log4shell-analysis
Cybersecurity research project analyzing threat intelligence feeds, Log4Shell (CVE-2021-44228), attack progression, remediation, incident response, and threat hunting.
PoC: CVE-2026-15723
Offline Python detector for CVE-2026-15723 version exposure in self-managed GitLab CE/EE, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-105014
Offline Python applicability detector for CVE-2026-105014 in Azure Pipelines, with strict CSV/JSON inventories and auditable reports.
PoC: CVE-2026-114625
Offline Python detector for CVE-2026-114625 exposure in on-premises VeloCloud Orchestrator, with train-specific build checks and auditable reports.
PoC: CVE-2026-97785
Offline Python applicability detector for CVE-2026-97785 in Microsoft Entra application proxy, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-83938
Offline Python applicability detector for CVE-2026-83938 in Azure Kubernetes Configuration Service, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-110063
Offline Python applicability detector for CVE-2026-110063 in Azure VM Inspector, with strict CSV/JSON inventories and auditable reports.
PoC: php56-amzn1-security
Security-patched php56 RPMs for Amazon Linux 1 (AMI 2018.03): PHP2Shell (CVE-2026-109618, CVE-2026-109619) and post-5.6.40 fixes backported from deb.sury.org
PoC: CVE-2026-109618-exploit
[PHP2Shell] Golang exploit for CVE-2026-109618 / CVE-2026-109619: Unauthenticated RCE in PHP 5.4–8.5.11 via OOM corruption + session.upload_progress UAF
PoC: CVE-2026-93903
Security advisory for CVE-2026-93903 affecting LiteSpeed Web Server.
PoC: s25u-ghostlock-kernelsu-lkm
Galaxy S25 Ultra (SM-S9380): GhostLock/CVE-2026-43499 memory-only root + KernelSU LKM via kallsyms prelink; Zygisk findings
PoC: cve-2026-98260-uaf
CVE-2026-98260 (posix-cpu-timers exec UAF) exploit research: S9280 Android 14 GKI 6.1 — UAF trigger + zero-write primitive + SELinux Permissive. Handoff doc in HANDOFF.md
PoC: copy-fail-CVE-2026-31431-aarch64
Linux 4.19 aarch64 PoC for CVE-2026-31431 (Copy Fail) - AF_ALG/authencesn page-cache write
PoC: aia-pdfjs-poc
CVE-2024-4367 PDF.js FontMatrix PoC - authorized pentest artifact
PoC: CVE-2025-10035
CVE-2025-10035 is a critical vulnerability in Fortra GoAnywhere MFT that may allow attackers to execute commands remotely on a vulnerable server.
PoC: CVE-2026-35223-Joomla-Access-Control
Proof of Concept for CVE-2026-35223 – Joomla Improper Access Control
PoC: php2shell-audit
Non-intrusive detector for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) - scans codebases and live hosts for vulnerable PHP versions and risky config. Detection, not exploitation.
PoC: TimerRoot
Android front end for CVE-2026-98260: root shell + KernelSU late-load through Shizuku
PoC: php2shell-fixed-images
Reproducible RHITE fixed PHP runtime images for CVE-2026-109618 and CVE-2026-109619
PoC: php-worker-pin
Multi-worker exploitation of the PHP 8.5 OOM-to-RCE chain (CVE-2026-109618/109619): pool pinning, measured
PoC: PHP2SHELL-Lab
Laboratorio para detectar y explotar las vulnerabilidades CVE-2026-109618 y CVE-2026-109619
PoC: CVE-2026-79397-Authenticated-OS-Command-Injection-in-ONT-4GE-RFDW-Ping-Diagnostics
Authenticated OS command injection in ONT-4GE-RFDW’s Ping diagnostics exploitable via default credentials.
PoC: rw-salon
CVE-2024-4442
PoC: rw-tutor
CVE-2024-4223
PoC: CVE-2026-111497-DOS-
CVE-2026-111497 DOS
PoC: rw-stock
CVE-2024-36779
PoC: php2shell-nse-scanner
Advanced Nmap Scripting Engine (NSE) script designed to identify PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619). Features multi-layer Black-Box analysis resilient against WAF, proxies, and header stripping.
PoC: rw-web-directory-free
CVE-2024-3552
PoC: cve-2025-27740
Proof-of-concept exploit for CVE-2025-27740 Subject Key Identifier injection in Active Directory Certificate Services
PoC: rw-country-state-city-auto-dropdown
cve-2024-3495
PoC: rw-fluentform
CVE-2024-2771
PoC: CVE-2023-42824
PoC / exploit archive for CVE-2023-42824
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free