https://poc.intelseclab.com/tags/cwe-22/Latest proof-of-concept entries.Hugoen-usFri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-65694-microweber-path-traversal/Fri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-65694-microweber-path-traversal/High severity (CVSS 7.5) — web · CVE-2026-65694 (VulnCheck advisory). Status: Unpatched. Affects: Microweber CMS — ServeStaticFileContoller::serveFromUserfiles(). Tags: microweber, path-traversal, cwe-22, unauthenticated, arbitrary-file-read, laravel, query-string-override.webHighmicroweberpath-traversalcwe-22unauthenticatedarbitrary-file-readlaravelquery-string-overridehttps://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-66066-rails-activestorage-libvips-rce/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-66066-rails-activestorage-libvips-rce/Critical severity (CVSS 9.5) — web · CVE-2026-66066 (GHSA-xr9x-r78c-5hrm). Status: Weaponized. Affects: Ruby on Rails — Active Storage (image variant processing via :vips/libvips). Tags: ruby-on-rails, active-storage, libvips, arbitrary-file-read, marshal-deserialization, rce, unauthenticated, cwe-22.webCriticalruby-on-railsactive-storagelibvipsarbitrary-file-readmarshal-deserializationrceunauthenticatedcwe-22https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-48282-coldfusion-rds-path-traversal-rce/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-48282-coldfusion-rds-path-traversal-rce/Critical severity (CVSS 10) — web · CVE-2026-48282 (Adobe APSB26-68). Status: Weaponized — arbitrary file read/write, directory browsing, webshell deployment, and command execution all confirmed. Affects: Adobe ColdFusion — Remote Development Service (RDS), /CFIDE/main/ide.cfm. Tags: coldfusion, adobe, rds, path-traversal, cwe-22, unauthenticated, remote, webshell, kev, actively-exploited.webCriticalcoldfusionadoberdspath-traversalcwe-22unauthenticatedremotewebshellkevactively-exploitedhttps://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56260-crawl4ai-output-path-arbitrary-write/Sun, 12 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56260-crawl4ai-output-path-arbitrary-write/Critical severity (CVSS 9.1) — web · CVE-2026-56260 (GHSA-365w-hqf6-vxfg). Status: PoC — lab (vulnerable-app/) demonstrates genuine unrestricted arbitrary file write; the bundled poc.py scanner is deliberately conservative (writes only to a randomized safe /tmp marker) so it is safe to run against real/production targets. See Notes.. Affects: Crawl4AI — open-source LLM-friendly web crawler/scraper (unclecode/crawl4ai), Docker API server mode. Tags: crawl4ai, ai-web-crawler, docker-api, path-traversal, arbitrary-file-write, cwe-22, unauthenticated, remote, denial-of-service.webCriticalcrawl4aiai-web-crawlerdocker-apipath-traversalarbitrary-file-writecwe-22unauthenticatedremotedenial-of-servicehttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2023-38950-zkteco-biotime-path-traversal/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2023-38950-zkteco-biotime-path-traversal/High severity (CVSS 7.5) — web · CVE-2023-38950. Status: Weaponized (public PoC, in CISA KEV). Affects: ZKTeco BioTime (web-based time & attendance / access control management platform). Tags: zkteco, biotime, path-traversal, arbitrary-file-read, cwe-22, unauthenticated, remote, iclock-api, kev.webHighzktecobiotimepath-traversalarbitrary-file-readcwe-22unauthenticatedremoteiclock-apikevhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-63888-thinkphp-file-inclusion-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-63888-thinkphp-file-inclusion-rce/Critical severity (CVSS 9.8) — web · CVE-2025-63888. Status: Weaponized. Affects: ThinkPHP (top10.org / TopThink PHP framework). Tags: thinkphp, php, file-inclusion, lfi, rce, log-poisoning, webshell, cwe-98, cwe-22.webCriticalthinkphpphpfile-inclusionlfircelog-poisoningwebshellcwe-98cwe-22https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4632-magicinfo-path-traversal-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4632-magicinfo-path-traversal-rce/Critical severity (CVSS 9.8) — web · CVE-2025-4632. Status: Weaponized. Affects: Samsung MagicINFO 9 Server (digital signage content management server), SWUpdateFileUploader servlet. Tags: samsung, magicinfo, path-traversal, arbitrary-file-upload, unauthenticated-rce, jsp-webshell, cwe-22, cwe-434, python.webCriticalsamsungmagicinfopath-traversalarbitrary-file-uploadunauthenticated-rcejsp-webshellcwe-22cwe-434pythonhttps://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-4517-tarfile-filter-data-path-max-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-4517-tarfile-filter-data-path-max-bypass/Critical severity (CVSS 9.4) — misc · CVE-2025-4517. Status: Weaponized. Affects: Python standard library tarfile module — filter="data" / filter="tar" extraction filters (PEP 706). Tags: python, tarfile, path-traversal, sandbox-bypass, path_max, realpath, symlink, cwe-22, stdlib.miscCriticalpythontarfilepath-traversalsandbox-bypasspath_maxrealpathsymlinkcwe-22stdlibhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49132-pterodactyl-locale-path-traversal/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49132-pterodactyl-locale-path-traversal/Critical severity (CVSS 10) — web · CVE-2025-49132. Status: Weaponized. Affects: Pterodactyl Panel (game server management panel). Tags: pterodactyl, path-traversal, unauthenticated, information-disclosure, credential-leak, database, php, config-exposure, cwe-22.webCriticalpterodactylpath-traversalunauthenticatedinformation-disclosurecredential-leakdatabasephpconfig-exposurecwe-22https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-52913-mitel-micollab-path-traversal/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-52913-mitel-micollab-path-traversal/Critical severity (CVSS 9.8) — network · CVE-2025-52913. Status: PoC. Affects: Mitel MiCollab (unified communications appliance). Tags: mitel, micollab, path-traversal, path-normalization, access-control-bypass, authentication-bypass, cwe-22, axis2, python, unified-communications.networkCriticalmitelmicollabpath-traversalpath-normalizationaccess-control-bypassauthentication-bypasscwe-22axis2pythonunified-communicationshttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-64446-fortiweb-cgiinfo-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-64446-fortiweb-cgiinfo-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-64446. Status: PoC. Affects: Fortinet FortiWeb (Web Application Firewall appliance). Tags: fortiweb, fortinet, waf, authentication-bypass, path-traversal, cgiinfo, cwe-22, cwe-288, admin-account-creation, python.networkCriticalfortiwebfortinetwafauthentication-bypasspath-traversalcgiinfocwe-22cwe-288admin-account-creationpythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37066-veno-file-manager-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37066-veno-file-manager-path-traversal/High severity — web · CVE-2026-37066. Status: PoC. Affects: Veno File Manager Project. Tags: veno-file-manager, path-traversal, arbitrary-file-read, authenticated, superadmin, cwe-22.webHighveno-file-managerpath-traversalarbitrary-file-readauthenticatedsuperadmincwe-22https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37065-veno-file-manager-file-deletion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37065-veno-file-manager-file-deletion/High severity — web · CVE-2026-37065. Status: PoC. Affects: Veno File Manager Project. Tags: veno-file-manager, arbitrary-file-deletion, authenticated, superadmin, cwe-22.webHighveno-file-managerarbitrary-file-deletionauthenticatedsuperadmincwe-22https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-36851-unpoller-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-36851-unpoller-path-traversal/High severity (CVSS 7.5) — misc · CVE-2026-36851. Status: PoC. Affects: UnPoller (unpoller/unpoller). Tags: unpoller, path-traversal, arbitrary-file-read, unifi, cwe-22, cwe-20.miscHighunpollerpath-traversalarbitrary-file-readunificwe-22cwe-20https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25964-tandoor-recipes-lfi/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25964-tandoor-recipes-lfi/Medium severity (CVSS 4.9) — web · CVE-2026-25964 (GHSA-6485-jr28-52xx). Status: PoC. Affects: Tandoor Recipes (self-hosted recipe manager, Django-based). Tags: path-traversal, local-file-disclosure, tandoor-recipes, django, rest-api, authenticated, cwe-22, arbitrary-file-read.webMediumpath-traversallocal-file-disclosuretandoor-recipesdjangorest-apiauthenticatedcwe-22arbitrary-file-readhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24849-openemr-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24849-openemr-path-traversal/Critical severity (CVSS 6.5) — web · CVE-2026-24849. Status: PoC. Affects: OpenEMR (Fax/SMS module, EtherFax provider). Tags: openemr, path-traversal, arbitrary-file-read, cwe-22, php, healthcare, phi-exposure, authenticated.webCriticalopenemrpath-traversalarbitrary-file-readcwe-22phphealthcarephi-exposureauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-53519-nezha-path-traversal-jwt-forgery/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-53519-nezha-path-traversal-jwt-forgery/Info severity — web · CVE-2026-53519 (GHSA-5c25-7vpj-9mqh). Status: PoC. Affects: Nezha Dashboard (monitoring/agent management panel). Tags: nezha, path-traversal, jwt-forgery, unauthenticated, config-disclosure, sqlite, privilege-escalation, cwe-22, cwe-347.webInfonezhapath-traversaljwt-forgeryunauthenticatedconfig-disclosuresqliteprivilege-escalationcwe-22cwe-347https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27825-mcp-atlassian-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27825-mcp-atlassian-path-traversal/Critical severity (CVSS 9.3) — web · CVE-2026-27825 (read-side twin of GHSA-xjgw-4wvw-rgm4). Status: PoC. Affects: sooperset/mcp-atlassian MCP server. Tags: mcp, path-traversal, arbitrary-file-read, confluence, mcp-atlassian, cwe-22, unauthenticated.webCriticalmcppath-traversalarbitrary-file-readconfluencemcp-atlassiancwe-22unauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42048-langflow-kb-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42048-langflow-kb-path-traversal/High severity — web · CVE-2026-42048 (GHSA-9whx-c884-c68q). Status: PoC. Affects: Langflow (Knowledge Bases bulk delete API). Tags: langflow, path-traversal, arbitrary-file-deletion, cwe-22, api, docker-lab, knowledge-base.webHighlangflowpath-traversalarbitrary-file-deletioncwe-22apidocker-labknowledge-basehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48866-gravityforms-path-traversal-file-deletion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48866-gravityforms-path-traversal-file-deletion/Critical severity (CVSS 9.6) — web · CVE-2026-48866. Status: PoC. Affects: Gravity Forms plugin for WordPress. Tags: wordpress, gravity-forms, path-traversal, cwe-22, arbitrary-file-deletion, php, unauthenticated-injection.webCriticalwordpressgravity-formspath-traversalcwe-22arbitrary-file-deletionphpunauthenticated-injectionhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25895-fuxa-path-traversal-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25895-fuxa-path-traversal-rce/Critical severity (CVSS 9.8) — web · CVE-2026-25895. Status: Weaponized. Affects: FUXA (Node.js-based SCADA/HMI platform), frangoteam. Tags: fuxa, scada, ics, path-traversal, arbitrary-file-write, rce, unauthenticated, cwe-22, cron-persistence, webshell.webCriticalfuxascadaicspath-traversalarbitrary-file-writerceunauthenticatedcwe-22cron-persistencewebshellhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6815-casdoor-path-traversal-file-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6815-casdoor-path-traversal-file-write/High severity — web · CVE-2026-6815. Status: Weaponized. Affects: Casdoor (open-source identity/access management platform). Tags: casdoor, path-traversal, arbitrary-file-write, rce, dos, authenticated, cwe-22.webHighcasdoorpath-traversalarbitrary-file-writercedosauthenticatedcwe-22https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21440-adonisjs-bodyparser-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21440-adonisjs-bodyparser-path-traversal/Critical severity (CVSS 9.2) — web · CVE-2026-21440 (GHSA-gvq6-hvvp-h34h). Status: Weaponized. Affects: @adonisjs/bodyparser (AdonisJS multipart file-upload handling). Tags: adonisjs, nodejs, path-traversal, arbitrary-file-write, cwe-22, file-upload, rce, bodyparser.webCriticaladonisjsnodejspath-traversalarbitrary-file-writecwe-22file-uploadrcebodyparserhttps://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-20262-cisco-sdwan-manager-file-write/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-01_cve-2026-20262-cisco-sdwan-manager-file-write/Medium severity (CVSS 6.5) — network · CVE-2026-20262. Status: PoC. Affects: Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). Tags: path-traversal, file-write, Cisco, SD-WAN, vManage, authenticated, CWE-22, active-exploitation.networkMediumpath-traversalfile-writeCiscoSD-WANvManageauthenticatedCWE-22active-exploitation