CVSS-10 — PoC Archivehttps://poc.intelseclab.com/tags/cvss-10/Latest proof-of-concept entries.Hugoen-usTue, 30 Jun 2026 00:00:00 +0000SP Page Builder (Joomla) Unauthenticated File Upload RCE (CVE-2026-48908)https://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Critical severity (CVSS 10) — web · CVE-2026-48908 (GHSA-8fwr-8fxr-8v2p). Status: Weaponized — public PoC with mass-scan support, added to CISA KEV 2026-07-07, confirmed active in-the-wild exploitation. Affects: SP Page Builder extension for Joomla (joomshaper.net). Tags: RCE, unauthenticated, file-upload, PHP-webshell, Joomla, CMS, access-control, Python, CVSS-10, kev, backdoor, cwe-434.webCriticalRCEunauthenticatedfile-uploadPHP-webshellJoomlaCMSaccess-controlPythonCVSS-10kevbackdoorcwe-434GeoVision GV-I/O Box 4E DVRSearch Unauthenticated Stack Buffer Overflow RCE (CVE-2026-12485)https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-12485-geovision-dvrsearch-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-12485-geovision-dvrsearch-rce/Critical severity (CVSS 10) — network · CVE-2026-12485. Status: PoC. Affects: GeoVision GV-I/O Box 4E (Linux-based smart embedded I/O device). Tags: RCE, unauthenticated, stack-overflow, buffer-overflow, IoT, GeoVision, DVR, embedded, UDP, network, Python, CVSS-10.networkCriticalRCEunauthenticatedstack-overflowbuffer-overflowIoTGeoVisionDVRembeddedUDPnetworkPythonCVSS-10