Cwe-20 — PoC Archivehttps://poc.intelseclab.com/tags/cwe-20/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Laravel `files.*` Wildcard Validation Bypass via Polyglot JPEG+PHP Upload (CVE-2025-27515)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-27515-laravel-polyglot-upload-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-27515-laravel-polyglot-upload-bypass/Critical severity (CVSS 9.8) — web · CVE-2025-27515. Status: Weaponized. Affects: Laravel Framework (file upload validation using files.* wildcard rules). Tags: laravel, php, file-upload, validation-bypass, polyglot, jpeg, wildcard-validation, cwe-20, rce, web-shell.webCriticallaravelphpfile-uploadvalidation-bypasspolyglotjpegwildcard-validationcwe-20rceweb-shellApache Parquet-Avro Schema Deserialization RCE/SSRF — Incomplete-Fix Bypass (CVE-2025-30065)https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-30065-parquet-avro-schema-deserialization-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-30065-parquet-avro-schema-deserialization-rce/Critical severity (CVSS 9.8) — misc · CVE-2025-30065. Status: PoC. Affects: Apache Parquet Java (parquet-avro module). Tags: rce, ssrf, unsafe-deserialization, parquet-avro, avro-schema, java-class, jvm, cwe-502, cwe-20, incomplete-fix, java.miscCriticalrcessrfunsafe-deserializationparquet-avroavro-schemajava-classjvmcwe-502cwe-20incomplete-fixjavaUnPoller Path Traversal / Arbitrary File Read via file:// Password Prefix (CVE-2026-36851)https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-36851-unpoller-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-36851-unpoller-path-traversal/High severity (CVSS 7.5) — misc · CVE-2026-36851. Status: PoC. Affects: UnPoller (unpoller/unpoller). Tags: unpoller, path-traversal, arbitrary-file-read, unifi, cwe-22, cwe-20.miscHighunpollerpath-traversalarbitrary-file-readunificwe-22cwe-20DbGate Unauthenticated RCE via JSON Script Runner (CVE-2026-47668)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-47668-dbgate-json-script-runner-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-47668-dbgate-json-script-runner-rce/Critical severity (CVSS 3.1) — web · CVE-2026-47668. Status: PoC. Affects: DbGate (dbgate-serve — web-based database management tool). Tags: dbgate, rce, code-injection, javascript-injection, cwe-94, cwe-20, cwe-1188, database-management.webCriticaldbgatercecode-injectionjavascript-injectioncwe-94cwe-20cwe-1188database-managementApache Solr UNC Path Validation Bypass to RCE (CVE-2026-22444)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22444-solr-unc-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22444-solr-unc-rce/Critical severity — web · CVE-2026-22444. Status: Weaponized. Affects: Apache Solr, standalone mode, running on Windows. Tags: apache-solr, rce, unc-path, smb, configset, javascript-script-update-processor, windows, cwe-20.webCriticalapache-solrrceunc-pathsmbconfigsetjavascript-script-update-processorwindowscwe-20