[POC] MAL-2025-6022 — CVE-2026-79294Sep 12, 2026
pocexploitMAL-2025-6022
CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory.
Honor WIN RT (AAK-AN00) CVE-2026-43499 temporary root - research notes
Research notes for CVE-2024-30350
GitLab CE/EE unauthenticated path traversal (CVE-2026-85706) - PoC
OpenPanel Unauthenticated Server-Side Request Forgery (SSRF)
PoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read
CVE-2026-15667 WordPress Event Solution LFI POC
Writeup: Hackcar - DockerLabs (Node.js Inspector RCE + CVE-2025-55182 React2Shell)
Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1
Easy Media Replace <= 0.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery
Simple Proof Of Concept about CVE 2026-33017
CVE-2004-2687 (Distcc 3.2.1) exploitation, methodology & remediation — Metasploitable2 lab
CVE-2026-85706_docker_exp
CVE-2026-45674 / CVE-2026-47691 / CVE-2026-45673: offline checker for DNS cache poisoning in io.netty:netty-resolver-dns - and whether your app actually uses that resolver. Spring WebClient on Reactor Netty uses it by default, although it is not in your pom.xml.
CVE-2026-41089 Netlogon RCE PoC — security research, vulnerability validation & defensive testing.
SecDim Challenge Builder repro inspired by CVE-2026-88861: AAL1 MFA bypass at privileged credential boundary
Write-up and proof of concept for CVE-2026-20516: MediaTek Android TV MiracastService confused deputy vulnerability.
End-to-end recon and exploitation of a known backdoor (CVE-2010-2075) on Metasploitable2 using Nmap and Metasploit.