https://poc.intelseclab.com/tags/active-exploitation/Latest proof-of-concept entries.Hugoen-usFri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-35616-forticlient-ems-auth-bypass/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-35616-forticlient-ems-auth-bypass/Critical severity (CVSS 9.1) — network · CVE-2026-35616. Status: Weaponized. Affects: Fortinet FortiClient Endpoint Management Server (EMS). Tags: authentication-bypass, header-spoofing, Fortinet, FortiClient-EMS, FortiBleed, credential-theft, CISA-KEV, active-exploitation, ransomware.networkCriticalauthentication-bypassheader-spoofingFortinetFortiClient-EMSFortiBleedcredential-theftCISA-KEVactive-exploitationransomwarehttps://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-8451-citrix-netscaler-memory-leak/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-8451-citrix-netscaler-memory-leak/High severity (CVSS 7.5) — network · CVE-2026-8451. Status: Incomplete PoC (memory-leak/detection primitive only — no session-hijack automation). Affects: Citrix NetScaler ADC and NetScaler Gateway. Tags: memory-disclosure, SAML, Citrix, NetScaler, ADC, Gateway, citrixbleed, unauthenticated, active-exploitation.networkHighmemory-disclosureSAMLCitrixNetScalerADCGatewaycitrixbleedunauthenticatedactive-exploitationhttps://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-45247-mirasvit-magento-cache-warmer-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-45247-mirasvit-magento-cache-warmer-rce/Critical severity (CVSS 9.3) — web · CVE-2026-45247. Status: Weaponized. Affects: Mirasvit Full Page Cache Warmer extension for Magento 2. Tags: php-object-injection, insecure-deserialization, RCE, Magento, Mirasvit, e-commerce, cookie-based, unauthenticated, CISA-KEV, active-exploitation.webCriticalphp-object-injectioninsecure-deserializationRCEMagentoMirasvite-commercecookie-basedunauthenticatedCISA-KEVactive-exploitationhttps://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-48907-joomla-jce-unauth-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-48907-joomla-jce-unauth-rce/Critical severity (CVSS 10) — web · CVE-2026-48907. Status: Weaponized. Affects: Joomla Content Editor (JCE) extension by Widget Factory. Tags: RCE, unauthenticated, Joomla, JCE, CMS, access-control, webshell, php-webshell, file-upload, CISA-KEV, active-exploitation.webCriticalRCEunauthenticatedJoomlaJCECMSaccess-controlwebshellphp-webshellfile-uploadCISA-KEVactive-exploitationhttps://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-11645-chrome-v8-oob-crash/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-11645-chrome-v8-oob-crash/High severity (CVSS 8.8) — web · CVE-2026-11645. Status: Incomplete PoC (crash only — no confirmed public RCE chain). Affects: Google Chrome / Chromium — V8 JavaScript and WebAssembly engine. Tags: browser, chrome, v8, javascript, turbofan, out-of-bounds, memory-corruption, zero-day, incomplete-poc, active-exploitation.webHighbrowserchromev8javascriptturbofanout-of-boundsmemory-corruptionzero-dayincomplete-pocactive-exploitationhttps://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-20230-cisco-ucm-webdialer-ssrf-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-20230-cisco-ucm-webdialer-ssrf-rce/Critical severity (CVSS 8.6) — network · CVE-2026-20230. Status: Weaponized. Affects: Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). Tags: SSRF, RCE, Cisco, Unified-Communications-Manager, WebDialer, file-write, webshell, jsp-webshell, CISA-KEV, active-exploitation.networkCriticalSSRFRCECiscoUnified-Communications-ManagerWebDialerfile-writewebshelljsp-webshellCISA-KEVactive-exploitationhttps://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-20262-cisco-sdwan-manager-file-write/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-20262-cisco-sdwan-manager-file-write/Medium severity (CVSS 6.5) — network · CVE-2026-20262. Status: PoC. Affects: Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). Tags: path-traversal, file-write, Cisco, SD-WAN, vManage, authenticated, CWE-22, active-exploitation.networkMediumpath-traversalfile-writeCiscoSD-WANvManageauthenticatedCWE-22active-exploitationhttps://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-24061-gnu-telnetd-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-24061-gnu-telnetd-rce/Critical severity (CVSS 9.8) — network · CVE-2026-24061. Status: Weaponized. Affects: GNU Inetutils telnetd. Tags: RCE, unauthenticated, authentication-bypass, telnetd, GNU-Inetutils, NEW-ENVIRON, legacy, OT, CISA-KEV, active-exploitation, Python.networkCriticalRCEunauthenticatedauthentication-bypasstelnetdGNU-InetutilsNEW-ENVIRONlegacyOTCISA-KEVactive-exploitationPythonhttps://poc.intelseclab.com/pocs/network/2026-05-17_ivanti-connect-secure-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_ivanti-connect-secure-rce/Critical severity (CVSS 9) — network · CVE-2025-0282. Status: Weaponized. Affects: Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateways. Tags: RCE, stack-overflow, buffer-overflow, pre-auth, unauthenticated, VPN, zero-day, active-exploitation, Ivanti, TLS.networkCriticalRCEstack-overflowbuffer-overflowpre-authunauthenticatedVPNzero-dayactive-exploitationIvantiTLShttps://poc.intelseclab.com/pocs/network/2026-05-17_fortinet-forticloud-sso-auth-bypass/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_fortinet-forticloud-sso-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-59718, CVE-2025-59719 (Advisory: FG-IR-25-647). Status: Weaponized. Affects: Fortinet FortiOS, FortiProxy, FortiSwitchManager (FortiCloud SSO feature). Tags: auth-bypass, SAML, SSO, unauthenticated, FortiOS, FortiProxy, FortiSwitchManager, active-exploitation.networkCriticalauth-bypassSAMLSSOunauthenticatedFortiOSFortiProxyFortiSwitchManageractive-exploitation