https://poc.intelseclab.com/tags/credential-theft/Latest proof-of-concept entries.Hugoen-usSat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-42208-litellm-sqli-proxy-authbypass/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-42208-litellm-sqli-proxy-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-42208 (GHSA-r75f-5x8p-qvmc). Status: Weaponized (public working PoC + Docker lab, actively exploited in the wild within 36 hours of disclosure). Affects: LiteLLM Proxy — open-source LLM/AI gateway (22,000+ GitHub stars) fronting OpenAI, Anthropic, and other model provider APIs. Tags: litellm, ai-gateway, llm-proxy, sql-injection, cwe-89, unauthenticated, remote, blind-sqli, kev-adjacent, credential-theft.webCriticallitellmai-gatewayllm-proxysql-injectioncwe-89unauthenticatedremoteblind-sqlikev-adjacentcredential-thefthttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12539-tnc-toolbox-cpanel-creds-exposure/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12539-tnc-toolbox-cpanel-creds-exposure/Critical severity (CVSS 10) — web · CVE-2025-12539. Status: Weaponized. Affects: TNC Toolbox: Web Performance (WordPress plugin). Tags: wordpress, tnc-toolbox, sensitive-information-exposure, unauthenticated, cpanel, credential-theft, privilege-escalation, python.webCriticalwordpresstnc-toolboxsensitive-information-exposureunauthenticatedcpanelcredential-theftprivilege-escalationpythonhttps://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-68926-rustfs-grpc-token-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-68926-rustfs-grpc-token-bypass/Critical severity (CVSS 9.8) — cloud · CVE-2025-68926. Status: Weaponized. Affects: RustFS (Rust-based S3-compatible distributed object storage) — internal node-to-node gRPC service. Tags: rustfs, grpc, hardcoded-credentials, authentication-bypass, object-storage, s3-compatible, information-disclosure, credential-theft, data-destruction, cwe-798, cwe-306.cloudCriticalrustfsgrpchardcoded-credentialsauthentication-bypassobject-storages3-compatibleinformation-disclosurecredential-theftdata-destructioncwe-798cwe-306https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26801-pdfmake-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26801-pdfmake-ssrf/High severity — web · CVE-2026-26801. Status: Weaponized. Affects: pdfmake (Node.js PDF generation library), src/URLResolver.js. Tags: ssrf, pdfmake, node-js, cloud-metadata, aws-imds, cwe-918, credential-theft, data-exfiltration.webHighssrfpdfmakenode-jscloud-metadataaws-imdscwe-918credential-theftdata-exfiltrationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24418-openstamanager-sqli-scadenzario/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24418-openstamanager-sqli-scadenzario/High severity (CVSS 8.8) — web · CVE-2026-24418. Status: Weaponized. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, error-based, openstamanager, php, extractvalue, rce, credential-theft, authenticated.webHighsql-injectionerror-basedopenstamanagerphpextractvaluercecredential-theftauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24419-openstamanager-sqli-prima-nota/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24419-openstamanager-sqli-prima-nota/High severity — web · CVE-2026-24419. Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, error-based, openstamanager, php, extractvalue, credential-theft, authenticated.webHighsql-injectionerror-basedopenstamanagerphpextractvaluecredential-theftauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24416-openstamanager-sqli-article-pricing/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24416-openstamanager-sqli-article-pricing/High severity — web · CVE-2026-24416. Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, time-based-blind, openstamanager, php, ajax, credential-theft, authenticated.webHighsql-injectiontime-based-blindopenstamanagerphpajaxcredential-theftauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34200-nhost-mcp-cors-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34200-nhost-mcp-cors-takeover/Critical severity (CVSS 9.6) — web · CVE-2026-34200 (GHSA-6c5x-3h35-vvw2). Status: PoC. Affects: Nhost CLI local MCP server (nhost mcp start). Tags: mcp, cors, csrf, drive-by, cors-bypass, credential-theft, hasura, dns-rebinding.webCriticalmcpcorscsrfdrive-bycors-bypasscredential-thefthasuradns-rebindinghttps://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-35616-forticlient-ems-auth-bypass/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-35616-forticlient-ems-auth-bypass/Critical severity (CVSS 9.1) — network · CVE-2026-35616. Status: Weaponized. Affects: Fortinet FortiClient Endpoint Management Server (EMS). Tags: authentication-bypass, header-spoofing, Fortinet, FortiClient-EMS, FortiBleed, credential-theft, CISA-KEV, active-exploitation, ransomware.networkCriticalauthentication-bypassheader-spoofingFortinetFortiClient-EMSFortiBleedcredential-theftCISA-KEVactive-exploitationransomwarehttps://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-47729-squidbleed-squid-ftp-oob-read/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-47729-squidbleed-squid-ftp-oob-read/Medium severity — network · CVE-2026-47729. Status: PoC. Affects: Squid Proxy — FTP gateway / directory-listing parser. Tags: memory-disclosure, information-disclosure, Squid, proxy, FTP, heap-overflow, oob-read, credential-theft, legacy.networkMediummemory-disclosureinformation-disclosureSquidproxyFTPheap-overflowoob-readcredential-theftlegacyhttps://poc.intelseclab.com/pocs/binary/2026-05-17_windows-ntlm-hash-disclosure-cve-2025-24054/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-ntlm-hash-disclosure-cve-2025-24054/Medium severity (CVSS 6.5) — binary · CVE-2025-24054. Status: Patched. Affects: Windows File Explorer (Windows Shell). Tags: NTLM, NTLMv2, hash-disclosure, zero-click, Windows, File-Explorer, UNC, SMB, credential-theft, in-the-wild, state-sponsored.binaryMediumNTLMNTLMv2hash-disclosurezero-clickWindowsFile-ExplorerUNCSMBcredential-theftin-the-wildstate-sponsoredhttps://poc.intelseclab.com/pocs/web/2026-05-17_jenkins-cli-arbitrary-file-read-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_jenkins-cli-arbitrary-file-read-rce/Critical severity (CVSS 9.8) — web · CVE-2024-23897. Status: Weaponized. Affects: Jenkins controller (CLI endpoint). Tags: arbitrary-file-read, Jenkins, CLI, credential-theft, RCE, unauthenticated, KEV.webCriticalarbitrary-file-readJenkinsCLIcredential-theftRCEunauthenticatedKEV