Cwe-862 — PoC Archivehttps://poc.intelseclab.com/tags/cwe-862/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000MISP Core `deleteSelection` Broken Access Control — Bulk Deletion of Foreign Event Reports & Sharing Groups (CVE-2026-56423)https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56423-misp-core-deleteselection-broken-access-control/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56423-misp-core-deleteselection-broken-access-control/High severity (CVSS 8.8) — web · CVE-2026-56423. Status: Weaponized — contributor-level bulk hard-delete of a foreign organizations Event Report confirmed against a real MISP core build; denied on the patched build. Affects: MISP (Malware Information Sharing Platform) Core — EventReportsController::deleteSelection and SharingGroupsController::deleteSelection. Tags: misp, misp-core, broken-access-control, cwe-862, bulk-deletion, authenticated, threat-intel-platform.webHighmispmisp-corebroken-access-controlcwe-862bulk-deletionauthenticatedthreat-intel-platformJoomla Helix Ultimate Framework — Unauthenticated Arbitrary File Deletion (CVE-2026-57830)https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-57830-joomla-helix-ultimate-file-deletion/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-57830-joomla-helix-ultimate-file-deletion/Critical severity (CVSS 9.1) — web · CVE-2026-57830. Status: Weaponized. Affects: Helix Ultimate Framework (plg_system_helixultimate), the JoomShaper Joomla template framework bundled with virtually every JoomShaper Joomla template. Tags: joomla, helix-ultimate, joomshaper, arbitrary-file-deletion, cwe-862, unauthenticated, csrf-token-only-check.webCriticaljoomlahelix-ultimatejoomshaperarbitrary-file-deletioncwe-862unauthenticatedcsrf-token-only-checkXWiki Unauthenticated XAR Import Leading to RCE — CVE-2026-33137https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33137-xwiki-xar-import-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33137-xwiki-xar-import-rce/Critical severity (CVSS 9.3) — web · CVE-2026-33137. Status: Weaponized. Affects: XWiki Platform. Tags: xwiki, rce, missing-authorization, xar-import, groovy, velocity, unauthenticated, cwe-862.webCriticalxwikircemissing-authorizationxar-importgroovyvelocityunauthenticatedcwe-862User Registration & Membership for WordPress — Unauthenticated Admin Approval Bypass (CVE-2026-6145)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6145-user-registration-wp-admin-approval-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6145-user-registration-wp-admin-approval-bypass/Medium severity (CVSS 5.3) — web · CVE-2026-6145. Status: Weaponized. Affects: User Registration & Membership for WordPress plugin. Tags: wordpress, missing-authorization, admin-approval-bypass, user-registration, cwe-862.webMediumwordpressmissing-authorizationadmin-approval-bypassuser-registrationcwe-862JoomCCK Unauthenticated SQL Injection via `tags.save` (CVE-2026-49048)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49048-joomcck-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49048-joomcck-sqli/Critical severity (CVSS 8.7) — web · CVE-2026-49048 (Advisory ID JOOMCCK-2026-001). Status: PoC. Affects: JoomCCK (com_joomcck) — Content Construction Kit extension for Joomla, by JoomCoder. Tags: joomla, joomcck, com_joomcck, sql-injection, cwe-89, missing-authorization, cwe-862, unauthenticated, blind-sqli, union-based.webCriticaljoomlajoomcckcom_joomccksql-injectioncwe-89missing-authorizationcwe-862unauthenticatedblind-sqliunion-basedEventin (wp-event-solution) Broken Access Control / IDOR (CVE-2026-40776)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40776-eventin-broken-access-control/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40776-eventin-broken-access-control/High severity (CVSS 7.5) — web · CVE-2026-40776 / Patchstack PSID 85de025d71e7. Status: PoC. Affects: Eventin — Events Calendar, Event Booking, Ticket & Registration (wp-event-solution WordPress plugin). Tags: wordpress, wordpress-plugin, broken-access-control, idor, nonce-misuse, cwe-862, pii-disclosure, unauthenticated.webHighwordpresswordpress-pluginbroken-access-controlidornonce-misusecwe-862pii-disclosureunauthenticatedAzuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54415-azuriom-account-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54415-azuriom-account-takeover/High severity (CVSS 3.1) — web · CVE-2026-54415. Status: PoC. Affects: Azuriom CMS. Tags: azuriom, cms, broken-access-control, cwe-862, cwe-269, privilege-escalation, account-takeover, php, laravel, azlink.webHighazuriomcmsbroken-access-controlcwe-862cwe-269privilege-escalationaccount-takeoverphplaravelazlinkAutoGPT Platform Chat Session IDOR / Session Hijack — CVE-2026-30950https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30950-autogpt-session-idor/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30950-autogpt-session-idor/High severity (CVSS 7.1) — web · CVE-2026-30950 (GHSA-q58p-v9r9-7gqj). Status: PoC. Affects: AutoGPT Platform (autogpt-platform-backend, chat/copilot feature). Tags: autogpt, idor, cwe-862, session-hijack, missing-authorization, python, fastapi, redis.webHighautogptidorcwe-862session-hijackmissing-authorizationpythonfastapiredis