https://poc.intelseclab.com/tags/cwe-89/Latest proof-of-concept entries.Hugoen-usSun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-63030-cve-2026-60137-wp2shell-wordpress-core-preauth-rce/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-63030-cve-2026-60137-wp2shell-wordpress-core-preauth-rce/Critical severity (CVSS 9.1) — web · CVE-2026-63030 (REST /batch/v1 route confusion, CVSS 7.5), CVE-2026-60137 (author__not_in SQL injection, CVSS 9.1); GHSA-ff9f-jf42-662q, GHSA-fpp7-x2x2-2mjf. Status: Weaponized — full pre-auth RCE confirmed against stock-default WordPress core, no plugins/misconfiguration required. Affects: WordPress core (REST API /batch/v1, WP_Query::author__not_in). Tags: wordpress, wp-core, sql-injection, route-confusion, cwe-89, cwe-436, unauthenticated, remote, privilege-escalation, rce, oembed, changeset.webCriticalwordpresswp-coresql-injectionroute-confusioncwe-89cwe-436unauthenticatedremoteprivilege-escalationrceoembedchangesethttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-42208-litellm-sqli-proxy-authbypass/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-42208-litellm-sqli-proxy-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-42208 (GHSA-r75f-5x8p-qvmc). Status: Weaponized (public working PoC + Docker lab, actively exploited in the wild within 36 hours of disclosure). Affects: LiteLLM Proxy — open-source LLM/AI gateway (22,000+ GitHub stars) fronting OpenAI, Anthropic, and other model provider APIs. Tags: litellm, ai-gateway, llm-proxy, sql-injection, cwe-89, unauthenticated, remote, blind-sqli, kev-adjacent, credential-theft.webCriticallitellmai-gatewayllm-proxysql-injectioncwe-89unauthenticatedremoteblind-sqlikev-adjacentcredential-thefthttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11391-ppom-woocommerce-blind-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11391-ppom-woocommerce-blind-sqli/Critical severity (CVSS 9.8) — web · CVE-2025-11391. Status: Patched. Affects: PPOM for WooCommerce (woocommerce-product-addon plugin). Tags: wordpress, woocommerce, ppom, product-addon, sql-injection, blind-sqli, time-based, cwe-89, python, php.webCriticalwordpresswoocommerceppomproduct-addonsql-injectionblind-sqlitime-basedcwe-89pythonphphttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-57819-freepbx-sqli-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-57819-freepbx-sqli-rce/Critical severity (CVSS 9.8) — web · CVE-2025-57819. Status: Weaponized. Affects: Sangoma FreePBX administrator web UI (admin/ajax.php, endpoint module). Tags: freepbx, sangoma, sqli, unauthenticated, ajax-php, cron-jobs, reverse-shell, voip, asterisk, cwe-89.webCriticalfreepbxsangomasqliunauthenticatedajax-phpcron-jobsreverse-shellvoipasteriskcwe-89https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-64459-django-queryset-connector-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-64459-django-queryset-connector-sqli/Critical severity (CVSS 9.1) — web · CVE-2025-64459. Status: Weaponized. Affects: Django ORM (QuerySet.filter() / Q object construction). Tags: django, python, sql-injection, queryset, q-object, orm, cwe-89, data-exposure, sqlite.webCriticaldjangopythonsql-injectionquerysetq-objectormcwe-89data-exposuresqlitehttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-65354-grocery-sitem-name-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-65354-grocery-sitem-name-sqli/Critical severity (CVSS 9.8) — web · CVE-2025-65354. Status: PoC. Affects: PHP-based "Grocery" web application, Grocery/search_products_itname.php endpoint. Tags: php, sql-injection, boolean-based-blind-sqli, cwe-89, grocery, unauthenticated, python.webCriticalphpsql-injectionboolean-based-blind-sqlicwe-89groceryunauthenticatedpythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27470-zoneminder-second-order-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27470-zoneminder-second-order-sqli/High severity (CVSS 8.8) — web · CVE-2026-27470. Status: Weaponized. Affects: ZoneMinder. Tags: zoneminder, sql-injection, second-order-sqli, authenticated, credential-extraction, cwe-89, php.webHighzonemindersql-injectionsecond-order-sqliauthenticatedcredential-extractioncwe-89phphttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6379-wp-photo-album-plus-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6379-wp-photo-album-plus-sqli/Critical severity (CVSS 8.6) — web · CVE-2026-6379. Status: PoC. Affects: WordPress plugin "WP Photo Album Plus" (WPPA+) by opajaap. Tags: wordpress, wp-photo-album-plus, sql-injection, unauthenticated, time-based-blind, cwe-89.webCriticalwordpresswp-photo-album-plussql-injectionunauthenticatedtime-based-blindcwe-89https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26198-ormar-orm-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26198-ormar-orm-sqli/Critical severity (CVSS 9.8) — web · CVE-2026-26198 (GHSA-xxh2-68g9-8jqr). Status: PoC. Affects: Ormar (async Python ORM, commonly used with FastAPI/Starlette). Tags: sql-injection, python, ormar, orm, fastapi, sqlalchemy, cwe-89, unauthenticated.webCriticalsql-injectionpythonormarormfastapisqlalchemycwe-89unauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49048-joomcck-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49048-joomcck-sqli/Critical severity (CVSS 8.7) — web · CVE-2026-49048 (Advisory ID JOOMCCK-2026-001). Status: PoC. Affects: JoomCCK (com_joomcck) — Content Construction Kit extension for Joomla, by JoomCoder. Tags: joomla, joomcck, com_joomcck, sql-injection, cwe-89, missing-authorization, cwe-862, unauthenticated, blind-sqli, union-based.webCriticaljoomlajoomcckcom_joomccksql-injectioncwe-89missing-authorizationcwe-862unauthenticatedblind-sqliunion-basedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49079-jetsearch-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49079-jetsearch-sqli/High severity (CVSS 7.5) — web · CVE-2026-49079. Status: PoC. Affects: JetSearch plugin for WordPress. Tags: wordpress, jetsearch, sql-injection, cwe-89, unauthenticated, ajax, union-based, blind-sqli.webHighwordpressjetsearchsql-injectioncwe-89unauthenticatedajaxunion-basedblind-sqlihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54597-itflow-blind-sqli-expires/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54597-itflow-blind-sqli-expires/High severity — web · CVE-2026-54597. Status: Weaponized. Affects: ITFlow (open-source MSP/IT management platform). Tags: itflow, sql-injection, blind-sqli, time-based, authenticated, cwe-89.webHighitflowsql-injectionblind-sqlitime-basedauthenticatedcwe-89https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54596-itflow-sqli-recurring-invoice/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54596-itflow-sqli-recurring-invoice/High severity — web · CVE-2026-54596. Status: Weaponized. Affects: ITFlow (open-source MSP/IT management platform). Tags: itflow, sql-injection, authenticated, technician-role, cwe-89.webHighitflowsql-injectionauthenticatedtechnician-rolecwe-89https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37749-attendance-management-sqli-authbypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37749-attendance-management-sqli-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-37749. Status: PoC. Affects: CodeAstro Simple Attendance Management System 1.0. Tags: php, sql-injection, authentication-bypass, cwe-89, unauthenticated, codeastro.webCriticalphpsql-injectionauthentication-bypasscwe-89unauthenticatedcodeastrohttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2576-business-directory-plugin-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2576-business-directory-plugin-sqli/High severity (CVSS 7.5) — web · CVE-2026-2576. Status: Weaponized. Affects: Business Directory Plugin (Easy Listing Directories) for WordPress. Tags: wordpress, sqli, time-based-blind, business-directory-plugin, unauthenticated, cwe-89, wpdb, docker-lab.webHighwordpresssqlitime-based-blindbusiness-directory-pluginunauthenticatedcwe-89wpdbdocker-labhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23980-superset-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23980-superset-sqli/Medium severity (CVSS 6.5) — web · CVE-2026-23980. Status: PoC. Affects: Apache Superset. Tags: apache-superset, sql-injection, error-based-sqli, postgresql, authenticated, api, python, cwe-89.webMediumapache-supersetsql-injectionerror-based-sqlipostgresqlauthenticatedapipythoncwe-89