Access-Control-Bypass — PoC Archivehttps://poc.intelseclab.com/tags/access-control-bypass/Latest proof-of-concept entries.Hugoen-usSat, 11 Jul 2026 00:00:00 +0000Unauthenticated Arbitrary File Upload RCE in iCagenda for Joomla (CVE-2026-48939)https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-48939. Status: Weaponized (public PoC available, actively exploited in the wild, in CISA KEV since 2026-07-10). Affects: iCagenda — events/calendar extension (component) for Joomla. Tags: joomla, icagenda, file-upload, rce, cwe-434, unauthenticated, remote, kev, cms, php, access-control-bypass.webCriticaljoomlaicagendafile-uploadrcecwe-434unauthenticatedremotekevcmsphpaccess-control-bypassMitel MiCollab Path Normalization Bypass to Internal Endpoints (CVE-2025-52913)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-52913-mitel-micollab-path-traversal/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-52913-mitel-micollab-path-traversal/Critical severity (CVSS 9.8) — network · CVE-2025-52913. Status: PoC. Affects: Mitel MiCollab (unified communications appliance). Tags: mitel, micollab, path-traversal, path-normalization, access-control-bypass, authentication-bypass, cwe-22, axis2, python, unified-communications.networkCriticalmitelmicollabpath-traversalpath-normalizationaccess-control-bypassauthentication-bypasscwe-22axis2pythonunified-communicationsVaultwarden Organization Collection Permissions Bypass & Cipher Enumeration (CVE-2026-26012)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26012-vaultwarden-collection-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26012-vaultwarden-collection-bypass/Medium severity (CVSS 6.5) — web · CVE-2026-26012 (GHSA-h265-g7rm-h337). Status: PoC. Affects: Vaultwarden (unofficial Bitwarden-compatible server). Tags: vaultwarden, bitwarden, password-manager, idor, access-control-bypass, api, cipher-enumeration, self-hosted.webMediumvaultwardenbitwardenpassword-manageridoraccess-control-bypassapicipher-enumerationself-hostedphpSysInfo IP Allowlist Bypass via X-Forwarded-For Spoofing — CVE-2026-55584https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-55584-phpsysinfo-xff-allowlist-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-55584-phpsysinfo-xff-allowlist-bypass/High severity (CVSS 7.5) — web · CVE-2026-55584 / GHSA-786w-p5pm-cvgh. Status: PoC. Affects: phpSysInfo. Tags: phpsysinfo, ip-spoofing, x-forwarded-for, access-control-bypass, cwe-290, information-disclosure.webHighphpsysinfoip-spoofingx-forwarded-foraccess-control-bypasscwe-290information-disclosure