Exploits

MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 - RCE

CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j — Next.js next/og ImageResponse SVG injection (Satori, GHSA-wx4j-mvgx-mqwp): isolated Docker validation lab with vulnerable (16.3.5) vs patched (16.3.6) controls, non-destructive Python scanner with pixel-level PNG evidence, and root-cause analysis of the upstream Satori fix. Authorized security research only.

Unauthenticated Authentication Bypass

CVE-2026-87902 detector. WordPress get_page_template LFI class. Detect-only. Authorized lab.

WordPress Core <= 7.1.1 unauthenticated LFI to RCE - validation lab, PoC, nuclei template (GHSA-7hp8-65ch-5whp)

CVE-2026-94545 - Draft or TODO

Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). Authorized/defensive testing.

Critical Zero-Authentication Vulnerability Alert! CVE-2026-87902 carries a massive CVSS 9.2 rating affecting nearly every version of WordPress Core from 4.7.0 up through 7.1.1. how attackers chain it with PHP environments to achieve full Remote Code Execution (RCE), and exactly how to mitigate and patch it immediately. 

PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab

Unauthenticated RCE on Wordpress

CVE-2026-87902 - WordPress - WordPress Core - High 8.1 - Unauthenticated GET /?page_id={id}&pagename=templates%252... - Unauthenticated Local File Inclusion (conditional RCE)

Simple Checks to look for indicators of compromise

Improper Restriction of Rendered UI Layers or Frames (CWE-1021)

This project describes detailed information about the CVE-2026-51772 vulnerability.

CVE-2026-61628 - nginx-ignition - High 8.1 - Unauthenticated Privilege Escalation (Administrator Account Creation)

POC-CVE-2026-93674 Authenticated Blind command injection proof of concept exploit code

This repository documents the VectorFreed RCE chain and includes a PoC for CVE-2026-96889.

Technical details, proof of concept, and responsible disclosure timeline for CVE-2026-93528 (Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce).