[POC] MAL-2026-2307 — crypto-lab-merkle-proofsJun 29, 2026
pocexploitMAL-2026-2307
Browser-based Merkle tree demo — build a tree, generate inclusion proofs, recompute the root hash by hash, and replay the RFC 6962 second-preimage and CVE-2012-2459 attacks. Real SHA-256. No backend.
React2Shell: CVE-2025-55182
Hack The Box - DevHub Machine Walkthrough (Medium Linux, CVE-2026-23744, Chisel Tunneling, Jupyter, Root Privilege Escalation)
CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9
Обзор n-day уязвимости на русском языке.
CVE-2026-41940 authentication bypass vulnerability proof-of-concept
PoC for CVE-2025-56399 - Unrestricted File Upload leading to RCE in alexusmai/laravel-file-manager (≤3.3.1). Automates detection, CSRF extraction, and File Upload
DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503
OpenSTAManager-RCE-Exploit-CVE-2026-38751
Automated PoC for CVE-2025-69212 - OpenSTAManager <=2.9.8 authenticated RCE
patched ffmpeg-tools for jellyfin to patch CVE-2026-8461 aka PixelSmash
Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only — no exploit code. TLP:CLEAR.
PoC for CVE-2026-5366: git argument injection in Prefect's GitRepository leading to RCE on the worker.
CVE-2026-0073-Android-ADBD-bypass-POC汉化版
CVE-2026-48907 is a CVSS 10.0 pre-auth RCE in Joomla Content Editor affecting all versions ≤ 2.9.99.4. The Grayxploit team breaks down the 3-weakness chain — missing auth, no extension validation, and an unsafe upload flag — that lets attackers pop a shell in 3 HTTP requests.
Hack The Box - Orion (Easy) | CVE-2025-32432 & CVE-2026-24061
WP Full Stripe Free <= 8.4.3 - Missing Authorization
Out-of-bounds array read in LibRaw