https://poc.intelseclab.com/tags/code-injection/Latest proof-of-concept entries.Hugoen-usFri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-9198-langflow-auto-login-validate-code-rce/Fri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-9198-langflow-auto-login-validate-code-rce/Critical severity (CVSS 9.8) — web · CVE-2026-9198. Status: Weaponized. Affects: IBM Langflow OSS (visual AI/agent-flow builder). Tags: langflow, ibm, auto-login, code-injection, cwe-94, unauthenticated, rce, python-exec, ai-agent-framework.webCriticallangflowibmauto-logincode-injectioncwe-94unauthenticatedrcepython-execai-agent-frameworkhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-24893-xwiki-solrsearch-groovy-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-24893-xwiki-solrsearch-groovy-rce/Critical severity (CVSS 9.8) — web · CVE-2025-24893. Status: Weaponized. Affects: XWiki (SolrSearch macro, Main.SolrSearch). Tags: xwiki, groovy, rce, unauthenticated, cwe-94, code-injection, reverse-shell, python, wiki.webCriticalxwikigroovyrceunauthenticatedcwe-94code-injectionreverse-shellpythonwikihttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-2945-pgadmin-eval-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-2945-pgadmin-eval-rce/Critical severity (CVSS 9.9) — web · CVE-2025-2945. Status: Weaponized. Affects: pgAdmin 4 (web-based PostgreSQL administration tool). Tags: pgadmin, postgresql, rce, eval-injection, code-injection, cwe-95, python, authenticated, sqleditor.webCriticalpgadminpostgresqlrceeval-injectioncode-injectioncwe-95pythonauthenticatedsqleditorhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23498-shopware-twig-code-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23498-shopware-twig-code-injection/High severity — web · CVE-2026-23498. Status: PoC. Affects: Shopware (shopware/shopware, shopware/core). Tags: shopware, twig, code-injection, ssti, php, cwe-94, regression, template-sandbox-bypass.webHighshopwaretwigcode-injectionsstiphpcwe-94regressiontemplate-sandbox-bypasshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-36239-pbootcms-authenticated-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-36239-pbootcms-authenticated-rce/Critical severity — web · CVE-2026-36239. Status: Weaponized. Affects: PbootCMS. Tags: pbootcms, rce, authenticated, code-injection, template-injection, cwe-94.webCriticalpbootcmsrceauthenticatedcode-injectiontemplate-injectioncwe-94https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0766-openwebui-tool-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0766-openwebui-tool-rce/High severity (CVSS 8.8) — web · CVE-2026-0766 (ZDI-26-032, GHSA-cggw-334c-f4mj). Status: Weaponized. Affects: OpenWebUI (self-hosted LLM web interface). Tags: openwebui, llm, code-injection, exec, tool-creation, cwe-94, rce, authenticated.webHighopenwebuillmcode-injectionexectool-creationcwe-94rceauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41242-protobufjs-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41242-protobufjs-rce/Critical severity — web · CVE-2026-41242. Status: PoC. Affects: Node.js application using protobufjs (Root.fromJSON + dynamic decode). Tags: nodejs, protobufjs, rce, deserialization, express, code-injection, javascript.webCriticalnodejsprotobufjsrcedeserializationexpresscode-injectionjavascripthttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-47668-dbgate-json-script-runner-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-47668-dbgate-json-script-runner-rce/Critical severity (CVSS 3.1) — web · CVE-2026-47668. Status: PoC. Affects: DbGate (dbgate-serve — web-based database management tool). Tags: dbgate, rce, code-injection, javascript-injection, cwe-94, cwe-20, cwe-1188, database-management.webCriticaldbgatercecode-injectionjavascript-injectioncwe-94cwe-20cwe-1188database-managementhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48017-dbgate-loadreader-functionname-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48017-dbgate-loadreader-functionname-rce/High severity (CVSS 8.8) — web · CVE-2026-48017 / GHSA-hv83-ggc4-v385. Status: PoC. Affects: DbGate (dbgate-api), a web-based database management GUI. Tags: dbgate, nodejs, code-injection, rce, cwe-94, authenticated, database-gui.webHighdbgatenodejscode-injectionrcecwe-94authenticateddatabase-guihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39816-apache-nifi-groovy-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39816-apache-nifi-groovy-rce/Critical severity — web · CVE-2026-39816. Status: Weaponized. Affects: Apache NiFi (with the optional graph bundle / nifi-other-graph-services-nar). Tags: apache-nifi, groovy, code-injection, privilege-escalation, rce, graph-bundle, authenticated.webCriticalapache-nifigroovycode-injectionprivilege-escalationrcegraph-bundleauthenticated