https://poc.intelseclab.com/tags/cwe-502/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-63077-teamcity-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-63077-teamcity-preauth-rce/Critical severity (CVSS 9.8) — web · CVE-2026-63077. Status: Patched. Affects: JetBrains TeamCity (on-premises CI/CD server), agent polling subsystem. Tags: jetbrains, teamcity, preauth-rce, xstream, deserialization, hsqldb, polyglot, jsp, CWE-502, agent-polling, ci-cd.webCriticaljetbrainsteamcitypreauth-rcexstreamdeserializationhsqldbpolyglotjspCWE-502agent-pollingci-cdhttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-42237-sitecore-xp-deserialization-rce/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-42237-sitecore-xp-deserialization-rce/Critical severity (CVSS 9.8) — web · CVE-2021-42237 (Sitecore advisory SC2021-003-499266). Status: Weaponized (public PoC + Metasploit module, in CISA KEV, known ransomware campaign use). Affects: Sitecore Experience Platform (XP). Tags: sitecore, deserialization, rce, cms, unauthenticated, remote, kev, known-ransomware-use, cwe-502.webCriticalsitecoredeserializationrcecmsunauthenticatedremotekevknown-ransomware-usecwe-502https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-31324-sap-netweaver-visual-composer-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-31324-sap-netweaver-visual-composer-rce/Critical severity (CVSS 10) — web · CVE-2025-31324. Status: Weaponized. Affects: SAP NetWeaver Application Server (AS) Java — Visual Composer component (VCFRAMEWORK), specifically the Metadata Uploader servlet. Tags: sap-netweaver, visual-composer, metadatauploader, unrestricted-file-upload, java-deserialization, jsp-webshell, rce, cwe-434, cwe-502, python.webCriticalsap-netweavervisual-composermetadatauploaderunrestricted-file-uploadjava-deserializationjsp-webshellrcecwe-434cwe-502pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49113-roundcube-php-object-deserialization-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49113-roundcube-php-object-deserialization-rce/Critical severity (CVSS 9.9) — web · CVE-2025-49113. Status: Weaponized. Affects: Roundcube Webmail. Tags: roundcube, webmail, php, deserialization, object-injection, gadget-chain, rce, post-auth, cwe-502.webCriticalroundcubewebmailphpdeserializationobject-injectiongadget-chainrcepost-authcwe-502https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54068-livewire-appkey-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54068-livewire-appkey-rce/Critical severity (CVSS 9.8) — web · CVE-2025-54068. Status: Weaponized. Affects: Laravel Livewire (versions prior to v3.6.4). Tags: laravel, livewire, php, deserialization, app-key, hmac-forgery, gadget-chain, rce, cwe-502, python.webCriticallaravellivewirephpdeserializationapp-keyhmac-forgerygadget-chainrcecwe-502pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Critical severity (CVSS 9.8) — web · CVE-2025-22777. Status: PoC. Affects: GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, 100,000+ active installs). Tags: givewp, wordpress, wordpress-plugin, php-object-injection, deserialization, unserialize, gadget-chain, cwe-502, php, unauthenticated.webCriticalgivewpwordpresswordpress-pluginphp-object-injectiondeserializationunserializegadget-chaincwe-502phpunauthenticatedhttps://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-30065-parquet-avro-schema-deserialization-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-30065-parquet-avro-schema-deserialization-rce/Critical severity (CVSS 9.8) — misc · CVE-2025-30065. Status: PoC. Affects: Apache Parquet Java (parquet-avro module). Tags: rce, ssrf, unsafe-deserialization, parquet-avro, avro-schema, java-class, jvm, cwe-502, cwe-20, incomplete-fix, java.miscCriticalrcessrfunsafe-deserializationparquet-avroavro-schemajava-classjvmcwe-502cwe-20incomplete-fixjavahttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2026-27172-camel-consul-registry-deserialization/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2026-27172-camel-consul-registry-deserialization/Critical severity (CVSS 9.8) — web · CVE-2026-27172. Status: Patched. Affects: Apache Camel camel-consul component (org.apache.camel.component.consul.ConsulRegistry). Tags: apache-camel, camel-consul, consulregistry, java-deserialization, rce, cwe-502, gadget-chain, ysoserial, spring-boot.webCriticalapache-camelcamel-consulconsulregistryjava-deserializationrcecwe-502gadget-chainysoserialspring-boothttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54806-wp-activity-log-poi-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54806-wp-activity-log-poi-rce/Critical severity (CVSS 9.8) — web · CVE-2026-54806. Status: PoC. Affects: WP Activity Log (plugin slug: wp-security-audit-log) by Melapress, for WordPress. Tags: wordpress, wp-activity-log, wp-security-audit-log, php-object-injection, deserialization, cwe-502, blind-rce, gadget-chain.webCriticalwordpresswp-activity-logwp-security-audit-logphp-object-injectiondeserializationcwe-502blind-rcegadget-chainhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48909-sp-lms-joomla-phpobjectinjection-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48909-sp-lms-joomla-phpobjectinjection-rce/Critical severity (CVSS 9.5) — web · CVE-2026-48909 (GHSA-gf8c-xmwj-whrh). Status: PoC. Affects: JoomShaper SP LMS (com_splms) Joomla Learning Management System extension. Tags: joomla, sp-lms, com_splms, php-object-injection, cwe-502, deserialization, unauthenticated-rce, gadget-chain.webCriticaljoomlasp-lmscom_splmsphp-object-injectioncwe-502deserializationunauthenticated-rcegadget-chainhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0596-mlflow-mlserver-pickle-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0596-mlflow-mlserver-pickle-rce/Critical severity (CVSS 9.6) — web · CVE-2026-0596 (GHSA-rvhj-8chj-8v3c). Status: PoC. Affects: MLflow model serving stack (mlflow==2.11.1, mlserver==1.3.5, mlserver-mlflow==1.3.5). Tags: mlflow, mlserver, pickle, insecure-deserialization, rce, machine-learning, cwe-502, docker.webCriticalmlflowmlserverpickleinsecure-deserializationrcemachine-learningcwe-502dockerhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-53435-jenkins-deser-file-read/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-53435-jenkins-deser-file-read/High severity (CVSS 9.1) — web · CVE-2026-53435 (Jenkins SECURITY-3707). Status: PoC. Affects: Jenkins (core), View configuration (config.xml) deserialization path. Tags: jenkins, deserialization, classfilter-bypass, xstream, config-xml, stapler, arbitrary-file-read, docker-lab, cwe-502.webHighjenkinsdeserializationclassfilter-bypassxstreamconfig-xmlstaplerarbitrary-file-readdocker-labcwe-502https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9691-activecampaign-cf7-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9691-activecampaign-cf7-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-9691. Status: PoC. Affects: "Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms" WordPress plugin. Tags: wordpress, contact-form-7, wpforms, elementor, ninja-forms, php-object-injection, deserialization, cwe-502, unauthenticated.webHighwordpresscontact-form-7wpformselementorninja-formsphp-object-injectiondeserializationcwe-502unauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3296-everest-forms-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3296-everest-forms-object-injection/Critical severity (CVSS 9.8) — web · CVE-2026-3296. Status: PoC (functional two-phase injection/trigger tool; RCE requires supplying a real POP gadget chain via PHPGGC). Affects: Everest Forms (WordPress plugin — Contact Form, Payment Form, Quiz, Survey & Custom Form Builder). Tags: wordpress, everest-forms, php-object-injection, deserialization, unserialize, rce, cwe-502.webCriticalwordpresseverest-formsphp-object-injectiondeserializationunserializercecwe-502https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-24009-docling-core-yaml-deserialization/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-24009-docling-core-yaml-deserialization/High severity — misc · CVE-2026-24009. Status: PoC. Affects: docling-core (Python library). Tags: docling-core, yaml-deserialization, pyyaml, unsafe-loader, rce, python, cwe-502.miscHighdocling-coreyaml-deserializationpyyamlunsafe-loaderrcepythoncwe-502https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42779-apache-mina-deserialization-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42779-apache-mina-deserialization-bypass/Critical severity (CVSS 9.8) — network · CVE-2026-42779. Status: PoC. Affects: Apache MINA (mina-core). Tags: apache-mina, java, deserialization, cwe-502, gadget-chain, commons-collections, rce, filter-bypass.networkCriticalapache-minajavadeserializationcwe-502gadget-chaincommons-collectionsrcefilter-bypass