https://poc.intelseclab.com/tags/cwe-94/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-64638-wordpress-xss2shell-pre-auth-xss-to-rce/High severity (CVSS 8.9) — web · CVE-2026-64638. Status: Patched. Affects: WordPress Core, wp-login.php failed-login error message, KSES sanitizer vs PHP strip_tags(). Tags: wordpress, wordpress-core, pre-auth, xss, reflected-xss, xss2shell, rce, parser-differential, dom-clobbering, some, jsonp, rest-api, application-password, plugin-upload, CWE-79, CWE-94, cms.webHighwordpresswordpress-corepre-authxssreflected-xssxss2shellrceparser-differentialdom-clobberingsomejsonprest-apiapplication-passwordplugin-uploadCWE-79CWE-94cmshttps://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-60004-gitea-diffpatch-githook-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-60004-gitea-diffpatch-githook-rce/High severity (CVSS 8.8) — web · CVE-2026-60004. Status: Patched. Affects: Gitea (self-hosted Git service), diffpatch API endpoint, Git three-way merge fallback. Tags: gitea, git, diffpatch, git-hook, post-index-change, three-way-merge, bare-repository, CWE-94, authenticated-rce, self-hosted, code-hosting.webHighgiteagitdiffpatchgit-hookpost-index-changethree-way-mergebare-repositoryCWE-94authenticated-rceself-hostedcode-hostinghttps://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-9198-langflow-auto-login-validate-code-rce/Fri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-9198-langflow-auto-login-validate-code-rce/Critical severity (CVSS 9.8) — web · CVE-2026-9198. Status: Weaponized. Affects: IBM Langflow OSS (visual AI/agent-flow builder). Tags: langflow, ibm, auto-login, code-injection, cwe-94, unauthenticated, rce, python-exec, ai-agent-framework.webCriticallangflowibmauto-logincode-injectioncwe-94unauthenticatedrcepython-execai-agent-frameworkhttps://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-58116-llamafactory-trust-remote-code-rce/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-58116-llamafactory-trust-remote-code-rce/Critical severity (CVSS 9.8) — web · CVE-2026-58116. Status: Weaponized — confirmed code execution via the exact sink LLaMA-Factory reaches. Affects: LLaMA-Factory ([hiyouga/LLaMA-Factory](https://github.com/hiyouga/LLaMA-Factory)) — WebUI Chat and Training interfaces. Tags: llamafactory, llm-training, webui, trust-remote-code, huggingface, transformers, cwe-94, unauthenticated-within-webui, remote-code-execution, ai-supply-chain.webCriticalllamafactoryllm-trainingwebuitrust-remote-codehuggingfacetransformerscwe-94unauthenticated-within-webuiremote-code-executionai-supply-chainhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-24893-xwiki-solrsearch-groovy-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-24893-xwiki-solrsearch-groovy-rce/Critical severity (CVSS 9.8) — web · CVE-2025-24893. Status: Weaponized. Affects: XWiki (SolrSearch macro, Main.SolrSearch). Tags: xwiki, groovy, rce, unauthenticated, cwe-94, code-injection, reverse-shell, python, wiki.webCriticalxwikigroovyrceunauthenticatedcwe-94code-injectionreverse-shellpythonwikihttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-47812-wingftp-null-byte-lua-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-47812-wingftp-null-byte-lua-rce/Critical severity (CVSS 10) — web · CVE-2025-47812. Status: Weaponized. Affects: Wing FTP Server, web administration/login interface (loginok.html, session mechanism). Tags: wingftp, ftp-server, null-byte-injection, lua-injection, unauthenticated-rce, session-file, cwe-94, cwe-158, python.webCriticalwingftpftp-servernull-byte-injectionlua-injectionunauthenticated-rcesession-filecwe-94cwe-158pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6389-wordpress-rogue-admin-user-creation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6389-wordpress-rogue-admin-user-creation/Critical severity (CVSS 9.8) — web · CVE-2025-6389. Status: Weaponized. Affects: Sneeit Framework (WordPress theme framework plugin, sneeit-framework). Tags: wordpress, sneeit-framework, rce, call_user_func, unauthenticated, wp_insert_user, privilege-escalation, admin-takeover, cwe-94, wp-ajax-nopriv.webCriticalwordpresssneeit-frameworkrcecall_user_funcunauthenticatedwp_insert_userprivilege-escalationadmin-takeovercwe-94wp-ajax-noprivhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-61757-oracle-identity-manager-auth-bypass-groovy-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-61757-oracle-identity-manager-auth-bypass-groovy-rce/Critical severity (CVSS 9.8) — web · CVE-2025-61757. Status: PoC. Affects: Oracle Identity Manager (OIM) — applicationmanagement REST API. Tags: oracle, identity-manager, oim, authentication-bypass, rce, groovy, wadl, security-filter, cwe-287, cwe-94.webCriticaloracleidentity-manageroimauthentication-bypassrcegroovywadlsecurity-filtercwe-287cwe-94https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-23061-mongoose-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-23061-mongoose-command-injection/Critical severity (CVSS 9) — web · CVE-2025-23061. Status: Weaponized. Affects: Mongoose (Node.js MongoDB ODM). Tags: mongoose, nodejs, nosql-injection, mongodb, populate, where-operator, command-injection, rce, cwe-943, cwe-94, express.webCriticalmongoosenodejsnosql-injectionmongodbpopulatewhere-operatorcommand-injectionrcecwe-943cwe-94expresshttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-47916-invision-community-template-injection-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-47916-invision-community-template-injection-rce/Critical severity (CVSS 10) — web · CVE-2025-47916. Status: Weaponized. Affects: Invision Community, themeeditor front controller (IPS\core\modules\front\system\themeeditor::customCss()). Tags: invision-community, ssti, template-injection, theme-editor, unauthenticated-rce, php, cwe-94, python.webCriticalinvision-communitysstitemplate-injectiontheme-editorunauthenticated-rcephpcwe-94pythonhttps://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-1974-ingressnightmare-nginx-admission-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-1974-ingressnightmare-nginx-admission-rce/Critical severity (CVSS 9.8) — cloud · CVE-2025-1974. Status: Weaponized. Affects: Kubernetes ingress-nginx admission controller. Tags: kubernetes, ingress-nginx, ingressnightmare, admission-controller, nginx, ssl-engine, shared-library-injection, cluster-secrets, docker, python, c, cwe-94.cloudCriticalkubernetesingress-nginxingressnightmareadmission-controllernginxssl-engineshared-library-injectioncluster-secretsdockerpythonccwe-94https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-59528-flowise-custommcp-function-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-59528-flowise-custommcp-function-rce/Critical severity (CVSS 10) — web · CVE-2025-59528. Status: Weaponized. Affects: Flowise (FlowiseAI/Flowise). Tags: flowise, rce, custommcp, function-constructor, javascript-injection, unauthenticated, llm, node-load-method, cwe-94.webCriticalflowisercecustommcpfunction-constructorjavascript-injectionunauthenticatedllmnode-load-methodcwe-94https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49002-dataease-postgresql-jdbc-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49002-dataease-postgresql-jdbc-rce/Critical severity (CVSS 9.8) — web · CVE-2025-49002. Status: PoC. Affects: DataEase (开源数据可视化分析工具 / open-source BI/data-visualization platform by 飞致云/FIT2CLOUD). Tags: dataease, jdbc, h2-database, runscript, rce, datasource-validate, ssrf-adjacent, cwe-94, python.webCriticaldataeasejdbch2-databaserunscriptrcedatasource-validatessrf-adjacentcwe-94pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13486-acf-extended-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13486-acf-extended-rce/Critical severity (CVSS 9.8) — web · CVE-2025-13486. Status: Weaponized. Affects: Advanced Custom Fields: Extended (ACFE) — WordPress plugin. Tags: wordpress, acf-extended, acfe, call_user_func_array, unauthenticated-rce, privilege-escalation, admin-account-creation, python, cwe-94.webCriticalwordpressacf-extendedacfecall_user_func_arrayunauthenticated-rceprivilege-escalationadmin-account-creationpythoncwe-94https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22738-spring-ai-spel-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22738-spring-ai-spel-rce/Critical severity (CVSS 9.8) — web · CVE-2026-22738. Status: Weaponized. Affects: Spring AI spring-ai-core (SimpleVectorStore). Tags: spring-ai, spel-injection, java, rce, vector-store, unauthenticated, cwe-94, docker-lab.webCriticalspring-aispel-injectionjavarcevector-storeunauthenticatedcwe-94docker-labhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23498-shopware-twig-code-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23498-shopware-twig-code-injection/High severity — web · CVE-2026-23498. Status: PoC. Affects: Shopware (shopware/shopware, shopware/core). Tags: shopware, twig, code-injection, ssti, php, cwe-94, regression, template-sandbox-bypass.webHighshopwaretwigcode-injectionsstiphpcwe-94regressiontemplate-sandbox-bypasshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-36239-pbootcms-authenticated-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-36239-pbootcms-authenticated-rce/Critical severity — web · CVE-2026-36239. Status: Weaponized. Affects: PbootCMS. Tags: pbootcms, rce, authenticated, code-injection, template-injection, cwe-94.webCriticalpbootcmsrceauthenticatedcode-injectiontemplate-injectioncwe-94https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0766-openwebui-tool-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0766-openwebui-tool-rce/High severity (CVSS 8.8) — web · CVE-2026-0766 (ZDI-26-032, GHSA-cggw-334c-f4mj). Status: Weaponized. Affects: OpenWebUI (self-hosted LLM web interface). Tags: openwebui, llm, code-injection, exec, tool-creation, cwe-94, rce, authenticated.webHighopenwebuillmcode-injectionexectool-creationcwe-94rceauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25924-kanboard-plugin-webshell/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25924-kanboard-plugin-webshell/High severity (CVSS 8.4) — web · CVE-2026-25924 / GHSA-grch-p7vf-vc4f. Status: Weaponized. Affects: Kanboard (project management application). Tags: kanboard, rce, webshell, plugin-installation, incorrect-authorization, cwe-863, cwe-94, admin-bypass, backdoor.webHighkanboardrcewebshellplugin-installationincorrect-authorizationcwe-863cwe-94admin-bypassbackdoorhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-47668-dbgate-json-script-runner-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-47668-dbgate-json-script-runner-rce/Critical severity (CVSS 3.1) — web · CVE-2026-47668. Status: PoC. Affects: DbGate (dbgate-serve — web-based database management tool). Tags: dbgate, rce, code-injection, javascript-injection, cwe-94, cwe-20, cwe-1188, database-management.webCriticaldbgatercecode-injectionjavascript-injectioncwe-94cwe-20cwe-1188database-managementhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48017-dbgate-loadreader-functionname-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48017-dbgate-loadreader-functionname-rce/High severity (CVSS 8.8) — web · CVE-2026-48017 / GHSA-hv83-ggc4-v385. Status: PoC. Affects: DbGate (dbgate-api), a web-based database management GUI. Tags: dbgate, nodejs, code-injection, rce, cwe-94, authenticated, database-gui.webHighdbgatenodejscode-injectionrcecwe-94authenticateddatabase-guihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6279-avada-builder-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6279-avada-builder-rce/Critical severity — web · CVE-2026-6279. Status: Weaponized. Affects: Avada Builder (Fusion Builder) WordPress theme/plugin. Tags: wordpress, avada, fusion-builder, rce, call_user_func, unauthenticated, cwe-94.webCriticalwordpressavadafusion-builderrcecall_user_funcunauthenticatedcwe-94