https://poc.intelseclab.com/tags/cms/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/High severity (CVSS 8.9) — web · CVE-2026-64638. Status: Patched. Affects: WordPress Core, wp-login.php failed-login error message, KSES sanitizer vs PHP strip_tags(). Tags: wordpress, wordpress-core, pre-auth, xss, reflected-xss, xss2shell, rce, parser-differential, dom-clobbering, some, jsonp, rest-api, application-password, plugin-upload, CWE-79, CWE-94, cms.webHighwordpresswordpress-corepre-authxssreflected-xssxss2shellrceparser-differentialdom-clobberingsomejsonprest-apiapplication-passwordplugin-uploadCWE-79CWE-94cmshttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-48939. Status: Weaponized (public PoC available, actively exploited in the wild, in CISA KEV since 2026-07-10). Affects: iCagenda — events/calendar extension (component) for Joomla. Tags: joomla, icagenda, file-upload, rce, cwe-434, unauthenticated, remote, kev, cms, php, access-control-bypass.webCriticaljoomlaicagendafile-uploadrcecwe-434unauthenticatedremotekevcmsphpaccess-control-bypasshttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-42237-sitecore-xp-deserialization-rce/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-42237-sitecore-xp-deserialization-rce/Critical severity (CVSS 9.8) — web · CVE-2021-42237 (Sitecore advisory SC2021-003-499266). Status: Weaponized (public PoC + Metasploit module, in CISA KEV, known ransomware campaign use). Affects: Sitecore Experience Platform (XP). Tags: sitecore, deserialization, rce, cms, unauthenticated, remote, kev, known-ransomware-use, cwe-502.webCriticalsitecoredeserializationrcecmsunauthenticatedremotekevknown-ransomware-usecwe-502https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5615-vvvebjs-svg-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5615-vvvebjs-svg-stored-xss/High severity (CVSS 8.5) — web · CVE-2026-5615. Status: PoC. Affects: VvvebJs (drag-and-drop website builder). Tags: vvvebjs, stored-xss, svg-upload, file-upload, cms.webHighvvvebjsstored-xsssvg-uploadfile-uploadcmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27621-typicms-svg-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27621-typicms-svg-xss/Medium severity — web · CVE-2026-27621 (GHSA-xfvg-8v67-j7wp). Status: PoC. Affects: TypiCMS Core (typicms/core). Tags: typicms, stored-xss, svg-upload, cwe-79, cms, file-upload, laravel, session-hijack.webMediumtypicmsstored-xsssvg-uploadcwe-79cmsfile-uploadlaravelsession-hijackhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27886-strapi-account-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27886-strapi-account-takeover/Critical severity — web · CVE-2026-27886. Status: Weaponized. Affects: Strapi CMS (Content API). Tags: strapi, cms, account-takeover, password-reset, boolean-oracle, api-filter-bypass, authentication.webCriticalstrapicmsaccount-takeoverpassword-resetboolean-oracleapi-filter-bypassauthenticationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-56290-joomla-pagebuilderck-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-56290-joomla-pagebuilderck-rce/Critical severity (CVSS 9.8) — web · CVE-2026-56290. Status: PoC. Affects: Page Builder CK (com_pagebuilderck) — Joomla extension. Tags: joomla, page-builder-ck, com_pagebuilderck, file-upload, unauth-rce, csrf, cms.webCriticaljoomlapage-builder-ckcom_pagebuilderckfile-uploadunauth-rcecsrfcmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21627-joomla-nrframework-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21627-joomla-nrframework-rce/Critical severity (CVSS 9.5) — web · CVE-2026-21627. Status: Weaponized. Affects: plg_system_nrframework (Tassos/Novarain Framework) Joomla plugin, bundled with Convert Forms, Engage Box, Google Structured Data, and other Tassos.gr extensions. Tags: joomla, nrframework, file-inclusion, unauthenticated, arbitrary-file-upload, arbitrary-file-delete, php, cms.webCriticaljoomlanrframeworkfile-inclusionunauthenticatedarbitrary-file-uploadarbitrary-file-deletephpcmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46395-haxcms-hmac-key-leak/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46395-haxcms-hmac-key-leak/Critical severity (CVSS 9.8) — web · CVE-2026-46395. Status: PoC. Affects: HAXcms Node.js backend (elmsln/HAXcms, haxcms-nodejs) — src/lib/HAXCMS.js. Tags: haxcms, nodejs, hmac, jwt-forgery, cwe-321, cwe-200, key-disclosure, cms.webCriticalhaxcmsnodejshmacjwt-forgerycwe-321cwe-200key-disclosurecmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46394-haxcms-git-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46394-haxcms-git-command-injection/High severity (CVSS 7.2) — web · CVE-2026-46394. Status: PoC. Affects: HAXcms PHP backend (elmsln/HAXcms) — system/backend/php/lib/Git.php. Tags: haxcms, php, command-injection, cwe-78, git, proc_open, cms.webHighhaxcmsphpcommand-injectioncwe-78gitproc_opencmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25099-bludit-webshell-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25099-bludit-webshell-rce/High severity — web · CVE-2026-25099. Status: Weaponized. Affects: Bludit CMS (/api/files/<page-key> endpoint). Tags: bludit, cms, file-upload, webshell, rce, php, api-token, cwe-434, authenticated.webHighbluditcmsfile-uploadwebshellrcephpapi-tokencwe-434authenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54415-azuriom-account-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54415-azuriom-account-takeover/High severity (CVSS 3.1) — web · CVE-2026-54415. Status: PoC. Affects: Azuriom CMS. Tags: azuriom, cms, broken-access-control, cwe-862, cwe-269, privilege-escalation, account-takeover, php, laravel, azlink.webHighazuriomcmsbroken-access-controlcwe-862cwe-269privilege-escalationaccount-takeoverphplaravelazlinkhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-32731-apostrophecms-tar-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-32731-apostrophecms-tar-path-traversal/High severity — web · CVE-2026-32731. Status: PoC. Affects: ApostropheCMS (site export/import feature). Tags: apostrophecms, cms, path-traversal, tar-slip, arbitrary-file-write, import, node-js.webHighapostrophecmscmspath-traversaltar-sliparbitrary-file-writeimportnode-jshttps://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-48907-joomla-jce-unauth-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-48907-joomla-jce-unauth-rce/Critical severity (CVSS 10) — web · CVE-2026-48907. Status: Weaponized. Affects: Joomla Content Editor (JCE) extension by Widget Factory. Tags: RCE, unauthenticated, Joomla, JCE, CMS, access-control, webshell, php-webshell, file-upload, CISA-KEV, active-exploitation.webCriticalRCEunauthenticatedJoomlaJCECMSaccess-controlwebshellphp-webshellfile-uploadCISA-KEVactive-exploitationhttps://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Critical severity (CVSS 10) — web · CVE-2026-48908 (GHSA-8fwr-8fxr-8v2p). Status: Weaponized — public PoC with mass-scan support, added to CISA KEV 2026-07-07, confirmed active in-the-wild exploitation. Affects: SP Page Builder extension for Joomla (joomshaper.net). Tags: RCE, unauthenticated, file-upload, PHP-webshell, Joomla, CMS, access-control, Python, CVSS-10, kev, backdoor, cwe-434.webCriticalRCEunauthenticatedfile-uploadPHP-webshellJoomlaCMSaccess-controlPythonCVSS-10kevbackdoorcwe-434