[POC] CVE-2026-48908 — CVE-2026-48908Jul 7, 2026
pocexploitCVE-2026-48908
CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, shell verification. For authorized security testing only.
Next.js / RSC - Unauthenticated RCE (React2Shell) (CVE-2025-55182)
In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution
ProtonVPN v4.4.1 - Unquoted Service Path
WordPress Bricks Builder Theme - RCE
iOS Bluetooth PAN Exploit - Ethernet Gateway without Adapter
Discuz! X5.0 - Authentication Bypass
Tenable Nessus 10.12.1 - SQL Injection
MCPJam Inspector - Remote Code Execution
Flowise 3.1.3 - arbitrary code execution
Exploitability PoC for CVE-2026-49352 (9router Hardcoded JWT Secret Authentication Bypass)
HTB "Abducted" write-up. Exploit CVE-2026-4480 (Samba RCE) → SMB wide links → systemd → root. Full methodology and flags.
AF_ALG/splice 기반 Linux Page Cache 변조 취약점 분석 및 대응 실습
OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value.
Pre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)
Proof of Concept (PoC) for CVE-2026-49975 – HTTP/2 server memory exhaustion attack leveraging HPACK amplification and connection retention (HTTP/2 Slowloris).
Public PoC and detector for CVE-2026-20896 ("Gitea Docker: One Header, Any User")