https://poc.intelseclab.com/tags/broken-access-control/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56423-misp-core-deleteselection-broken-access-control/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56423-misp-core-deleteselection-broken-access-control/High severity (CVSS 8.8) — web · CVE-2026-56423. Status: Weaponized — contributor-level bulk hard-delete of a foreign organizations Event Report confirmed against a real MISP core build; denied on the patched build. Affects: MISP (Malware Information Sharing Platform) Core — EventReportsController::deleteSelection and SharingGroupsController::deleteSelection. Tags: misp, misp-core, broken-access-control, cwe-862, bulk-deletion, authenticated, threat-intel-platform.webHighmispmisp-corebroken-access-controlcwe-862bulk-deletionauthenticatedthreat-intel-platformhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13342-frontend-admin-unauth-admin-creation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13342-frontend-admin-unauth-admin-creation/Critical severity (CVSS 9.8) — web · CVE-2025-13342. Status: Weaponized. Affects: Frontend Admin by DynamiApps (WordPress plugin built on Advanced Custom Fields / ACF frontend forms). Tags: wordpress, wordpress-plugin, frontend-admin, dynamiapps, acf, advanced-custom-fields, broken-access-control, cwe-284, privilege-escalation, unauthenticated, admin-takeover, python.webCriticalwordpresswordpress-pluginfrontend-admindynamiappsacfadvanced-custom-fieldsbroken-access-controlcwe-284privilege-escalationunauthenticatedadmin-takeoverpythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44595-yamcs-iam-user-enumeration/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44595-yamcs-iam-user-enumeration/Medium severity (CVSS 4.3) — web · CVE-2026-44595 / GHSA-p2rj-mrmc-9w29. Status: PoC. Affects: yamcs-core (YAMCS mission control software). Tags: yamcs, iam, missing-authorization, user-enumeration, broken-access-control, api.webMediumyamcsiammissing-authorizationuser-enumerationbroken-access-controlapihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54807-woocommerce-reg-admin-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54807-woocommerce-reg-admin-privesc/Info severity — web · CVE-2026-54807. Status: PoC. Affects: WordPress plugin exposing a custom WooCommerce-style frontend registration form (form fields prefixed tgwcfb_*). Tags: wordpress, woocommerce, privilege-escalation, registration-form, admin-takeover, broken-access-control.webInfowordpresswoocommerceprivilege-escalationregistration-formadmin-takeoverbroken-access-controlhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-7459-poc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-7459-poc/High severity (CVSS 7.5) — web · CVE-2026-7459. Status: PoC. Affects: Simple History (WordPress plugin). Tags: wordpress, simple-history, broken-access-control, account-takeover, rest-api, password-reset.webHighwordpresssimple-historybroken-access-controlaccount-takeoverrest-apipassword-resethttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4484-masteriyo-lms-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4484-masteriyo-lms-privesc/High severity (CVSS 8.8) — web · CVE-2026-4484. Status: PoC. Affects: Masteriyo LMS plugin for WordPress. Tags: wordpress, masteriyo-lms, privilege-escalation, rest-api, cwe-269, broken-access-control.webHighwordpressmasteriyo-lmsprivilege-escalationrest-apicwe-269broken-access-controlhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-47102-litellm-privesc-user-update/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-47102-litellm-privesc-user-update/High severity (CVSS 8.8) — web · CVE-2026-47102. Status: PoC. Affects: LiteLLM (LLM API proxy / gateway). Tags: litellm, privilege-escalation, broken-access-control, cwe-863, api-authorization, llm-proxy.webHighlitellmprivilege-escalationbroken-access-controlcwe-863api-authorizationllm-proxyhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35029-litellm-config-broken-access-control/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35029-litellm-config-broken-access-control/High severity (CVSS 8.8) — web · CVE-2026-35029. Status: Weaponized. Affects: LiteLLM proxy. Tags: broken-access-control, litellm, ai-gateway, config-update, ssrf, rce, environment-variable-theft, cwe-863.webHighbroken-access-controllitellmai-gatewayconfig-updatessrfrceenvironment-variable-theftcwe-863https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21721-grafana-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21721-grafana-lpe/High severity — web · CVE-2026-21721. Status: PoC. Affects: Grafana (self-hosted, dashboard permissions API). Tags: grafana, privilege-escalation, broken-access-control, dashboard-permissions, editor-to-admin, api.webHighgrafanaprivilege-escalationbroken-access-controldashboard-permissionseditor-to-adminapihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5173-gitlab-websocket-graphql-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5173-gitlab-websocket-graphql-bypass/High severity — web · CVE-2026-5173. Status: PoC. Affects: GitLab CE/EE, ActionCable WebSocket endpoint (/-/cable), GraphqlChannel. Tags: gitlab, websocket, graphql, actioncable, graphqlchannel, information-disclosure, broken-access-control.webHighgitlabwebsocketgraphqlactioncablegraphqlchannelinformation-disclosurebroken-access-controlhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40776-eventin-broken-access-control/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40776-eventin-broken-access-control/High severity (CVSS 7.5) — web · CVE-2026-40776 / Patchstack PSID 85de025d71e7. Status: PoC. Affects: Eventin — Events Calendar, Event Booking, Ticket & Registration (wp-event-solution WordPress plugin). Tags: wordpress, wordpress-plugin, broken-access-control, idor, nonce-misuse, cwe-862, pii-disclosure, unauthenticated.webHighwordpresswordpress-pluginbroken-access-controlidornonce-misusecwe-862pii-disclosureunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54415-azuriom-account-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54415-azuriom-account-takeover/High severity (CVSS 3.1) — web · CVE-2026-54415. Status: PoC. Affects: Azuriom CMS. Tags: azuriom, cms, broken-access-control, cwe-862, cwe-269, privilege-escalation, account-takeover, php, laravel, azlink.webHighazuriomcmsbroken-access-controlcwe-862cwe-269privilege-escalationaccount-takeoverphplaravelazlink