https://poc.intelseclab.com/tags/deserialization/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-63077-teamcity-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-63077-teamcity-preauth-rce/Critical severity (CVSS 9.8) — web · CVE-2026-63077. Status: Patched. Affects: JetBrains TeamCity (on-premises CI/CD server), agent polling subsystem. Tags: jetbrains, teamcity, preauth-rce, xstream, deserialization, hsqldb, polyglot, jsp, CWE-502, agent-polling, ci-cd.webCriticaljetbrainsteamcitypreauth-rcexstreamdeserializationhsqldbpolyglotjspCWE-502agent-pollingci-cdhttps://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-16723-fastjson-rce/Fri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-16723-fastjson-rce/Critical severity (CVSS 9) — web · CVE-2026-16723. Status: PoC (no vendor patch, Fastjson 1.x line unpatched). Affects: Alibaba Fastjson (Java JSON library), packaged inside a Spring Boot executable fat-JAR. Tags: fastjson, deserialization, rce, java, spring-boot, autotype-bypass, jar-protocol, ssrf.webCriticalfastjsondeserializationrcejavaspring-bootautotype-bypassjar-protocolssrfhttps://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-50522-sharepoint-preauth-rce/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-50522-sharepoint-preauth-rce/Critical severity (CVSS 9.8) — web · CVE-2026-50522. Status: Weaponized — public PoC confirmed used in real attacks within hours of release (watchTowr honeypot telemetry). Affects: Microsoft SharePoint Server (on-premises). Tags: sharepoint, deserialization, binaryformatter, ws-federation, unauthenticated, rce, kev, actively-exploited, microsoft.webCriticalsharepointdeserializationbinaryformatterws-federationunauthenticatedrcekevactively-exploitedmicrosofthttps://poc.intelseclab.com/pocs/web/2026-07-27_gitlab-oj-json-parser-rce-chain/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_gitlab-oj-json-parser-rce-chain/Critical severity — web · N/A (no CVE assigned as of 2026-07-27 — researcher disclosure via depthfirst.com blog, covered by The Hacker News). Status: Weaponized. Affects: GitLab Community/Enterprise Edition — Jupyter notebook diff rendering (backed by the Oj native Ruby JSON parser gem). Tags: gitlab, oj-gem, json-parser, rce, aslr-bypass, ruby, deserialization, no-cve-yet.webCriticalgitlaboj-gemjson-parserrceaslr-bypassrubydeserializationno-cve-yethttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-42237-sitecore-xp-deserialization-rce/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-42237-sitecore-xp-deserialization-rce/Critical severity (CVSS 9.8) — web · CVE-2021-42237 (Sitecore advisory SC2021-003-499266). Status: Weaponized (public PoC + Metasploit module, in CISA KEV, known ransomware campaign use). Affects: Sitecore Experience Platform (XP). Tags: sitecore, deserialization, rce, cms, unauthenticated, remote, kev, known-ransomware-use, cwe-502.webCriticalsitecoredeserializationrcecmsunauthenticatedremotekevknown-ransomware-usecwe-502https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49113-roundcube-php-object-deserialization-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49113-roundcube-php-object-deserialization-rce/Critical severity (CVSS 9.9) — web · CVE-2025-49113. Status: Weaponized. Affects: Roundcube Webmail. Tags: roundcube, webmail, php, deserialization, object-injection, gadget-chain, rce, post-auth, cwe-502.webCriticalroundcubewebmailphpdeserializationobject-injectiongadget-chainrcepost-authcwe-502https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-55182-react-server-components-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-55182-react-server-components-rce/Critical severity (CVSS 10) — web · CVE-2025-55182. Status: PoC. Affects: React Server Components (RSC) packages using the Flight protocol (commonly deployed via Next.js). Tags: react, react-server-components, rsc, flight-protocol, prototype-pollution, deserialization, unauthenticated-rce, nextjs, nodejs, python.webCriticalreactreact-server-componentsrscflight-protocolprototype-pollutiondeserializationunauthenticated-rcenextjsnodejspythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54068-livewire-appkey-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54068-livewire-appkey-rce/Critical severity (CVSS 9.8) — web · CVE-2025-54068. Status: Weaponized. Affects: Laravel Livewire (versions prior to v3.6.4). Tags: laravel, livewire, php, deserialization, app-key, hmac-forgery, gadget-chain, rce, cwe-502, python.webCriticallaravellivewirephpdeserializationapp-keyhmac-forgerygadget-chainrcecwe-502pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Critical severity (CVSS 9.8) — web · CVE-2025-22777. Status: PoC. Affects: GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, 100,000+ active installs). Tags: givewp, wordpress, wordpress-plugin, php-object-injection, deserialization, unserialize, gadget-chain, cwe-502, php, unauthenticated.webCriticalgivewpwordpresswordpress-pluginphp-object-injectiondeserializationunserializegadget-chaincwe-502phpunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49105-wp-zendesk-cf7-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49105-wp-zendesk-cf7-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-49105. Status: PoC. Affects: WP Zendesk for Contact Form 7 plugin for WordPress, cf7-zendesk.php. Tags: wordpress, zendesk, php-object-injection, deserialization, contact-form-7, pop-chain, unauthenticated.webHighwordpresszendeskphp-object-injectiondeserializationcontact-form-7pop-chainunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49085-wp-insightly-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49085-wp-insightly-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-49085. Status: PoC. Affects: WP Insightly (Contact Form 7 to Insightly CRM integration) plugin for WordPress, cf7-insightly.php. Tags: wordpress, insightly, php-object-injection, deserialization, contact-form-7, pop-chain, unauthenticated.webHighwordpressinsightlyphp-object-injectiondeserializationcontact-form-7pop-chainunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54806-wp-activity-log-poi-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54806-wp-activity-log-poi-rce/Critical severity (CVSS 9.8) — web · CVE-2026-54806. Status: PoC. Affects: WP Activity Log (plugin slug: wp-security-audit-log) by Melapress, for WordPress. Tags: wordpress, wp-activity-log, wp-security-audit-log, php-object-injection, deserialization, cwe-502, blind-rce, gadget-chain.webCriticalwordpresswp-activity-logwp-security-audit-logphp-object-injectiondeserializationcwe-502blind-rcegadget-chainhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-20251-splunk-jsonpickle-deserialization/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-20251-splunk-jsonpickle-deserialization/High severity (CVSS 8.8) — web · CVE-2026-20251. Status: PoC. Affects: Splunk Secure Gateway (SSG) app on Splunk Enterprise. Tags: splunk, deserialization, jsonpickle, rce, kv-store, python, validator-bypass, spacebridge.webHighsplunkdeserializationjsonpicklercekv-storepythonvalidator-bypassspacebridgehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48909-sp-lms-joomla-phpobjectinjection-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48909-sp-lms-joomla-phpobjectinjection-rce/Critical severity (CVSS 9.5) — web · CVE-2026-48909 (GHSA-gf8c-xmwj-whrh). Status: PoC. Affects: JoomShaper SP LMS (com_splms) Joomla Learning Management System extension. Tags: joomla, sp-lms, com_splms, php-object-injection, cwe-502, deserialization, unauthenticated-rce, gadget-chain.webCriticaljoomlasp-lmscom_splmsphp-object-injectioncwe-502deserializationunauthenticated-rcegadget-chainhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33439-openam-deserialization-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33439-openam-deserialization-rce/Critical severity (CVSS 9.8) — web · CVE-2026-33439. Status: Weaponized. Affects: ForgeRock / OpenIdentityPlatform OpenAM. Tags: openam, forgerock, deserialization, rce, pre-auth, java, gadget-chain, xalan, jato.webCriticalopenamforgerockdeserializationrcepre-authjavagadget-chainxalanjatohttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41242-protobufjs-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41242-protobufjs-rce/Critical severity — web · CVE-2026-41242. Status: PoC. Affects: Node.js application using protobufjs (Root.fromJSON + dynamic decode). Tags: nodejs, protobufjs, rce, deserialization, express, code-injection, javascript.webCriticalnodejsprotobufjsrcedeserializationexpresscode-injectionjavascripthttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5426-knowledgedeliver-viewstate-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5426-knowledgedeliver-viewstate-rce/Critical severity — web · CVE-2026-5426. Status: PoC. Affects: KnowledgeDeliver (ASP.NET Web Forms application). Tags: aspnet, viewstate, deserialization, rce, hardcoded-keys, machinekey, knowledgedeliver, webshell, python.webCriticalaspnetviewstatedeserializationrcehardcoded-keysmachinekeyknowledgedeliverwebshellpythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25526-jinjava-ssti-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25526-jinjava-ssti-rce/Critical severity — web · CVE-2026-25526. Status: Weaponized. Affects: Jinjava (HubSpot's Java Jinja-like template engine). Tags: ssti, jinjava, java, jackson, objectmapper, sandbox-escape, rce, deserialization.webCriticalsstijinjavajavajacksonobjectmappersandbox-escapercedeserializationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-53435-jenkins-deser-file-read/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-53435-jenkins-deser-file-read/High severity (CVSS 9.1) — web · CVE-2026-53435 (Jenkins SECURITY-3707). Status: PoC. Affects: Jenkins (core), View configuration (config.xml) deserialization path. Tags: jenkins, deserialization, classfilter-bypass, xstream, config-xml, stapler, arbitrary-file-read, docker-lab, cwe-502.webHighjenkinsdeserializationclassfilter-bypassxstreamconfig-xmlstaplerarbitrary-file-readdocker-labcwe-502https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49104-keap-infusionsoft-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49104-keap-infusionsoft-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-49104. Status: PoC. Affects: Integration for Keap/Infusionsoft (Contact Form 7 to Keap/Infusionsoft CRM integration) plugin for WordPress, cf7-infusionsoft.php. Tags: wordpress, keap, infusionsoft, php-object-injection, deserialization, contact-form-7, pop-chain, unauthenticated.webHighwordpresskeapinfusionsoftphp-object-injectiondeserializationcontact-form-7pop-chainunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9691-activecampaign-cf7-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9691-activecampaign-cf7-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-9691. Status: PoC. Affects: "Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms" WordPress plugin. Tags: wordpress, contact-form-7, wpforms, elementor, ninja-forms, php-object-injection, deserialization, cwe-502, unauthenticated.webHighwordpresscontact-form-7wpformselementorninja-formsphp-object-injectiondeserializationcwe-502unauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34838-groupoffice-deserialization-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34838-groupoffice-deserialization-rce/Critical severity — web · CVE-2026-34838 (GHSA-h22j-frrf-5vxq). Status: PoC. Affects: Group-Office groupware suite. Tags: php, deserialization, rce, groupware, gadget-chain, authenticated, group-office, guzzlehttp.webCriticalphpdeserializationrcegroupwaregadget-chainauthenticatedgroup-officeguzzlehttphttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-56121-feast-unauth-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-56121-feast-unauth-rce/Critical severity (CVSS 9.8) — misc · CVE-2026-56121. Status: PoC. Affects: Feast (open-source feature store) registry gRPC server. Tags: feast, feature-store, dill, pickle, deserialization, grpc, unauth-rce, mlops.miscCriticalfeastfeature-storedillpickledeserializationgrpcunauth-rcemlopshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3296-everest-forms-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3296-everest-forms-object-injection/Critical severity (CVSS 9.8) — web · CVE-2026-3296. Status: PoC (functional two-phase injection/trigger tool; RCE requires supplying a real POP gadget chain via PHPGGC). Affects: Everest Forms (WordPress plugin — Contact Form, Payment Form, Quiz, Survey & Custom Form Builder). Tags: wordpress, everest-forms, php-object-injection, deserialization, unserialize, rce, cwe-502.webCriticalwordpresseverest-formsphp-object-injectiondeserializationunserializercecwe-502https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34486-tomcat-tribes-deserialization-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34486-tomcat-tribes-deserialization-rce/Critical severity — web · CVE-2026-34486. Status: Weaponized. Affects: Apache Tomcat Tribes clustering (EncryptInterceptor). Tags: deserialization, rce, tomcat, tribes, clustering, java, gadget-chain, unauthenticated.webCriticaldeserializationrcetomcattribesclusteringjavagadget-chainunauthenticatedhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42779-apache-mina-deserialization-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42779-apache-mina-deserialization-bypass/Critical severity (CVSS 9.8) — network · CVE-2026-42779. Status: PoC. Affects: Apache MINA (mina-core). Tags: apache-mina, java, deserialization, cwe-502, gadget-chain, commons-collections, rce, filter-bypass.networkCriticalapache-minajavadeserializationcwe-502gadget-chaincommons-collectionsrcefilter-bypasshttps://poc.intelseclab.com/pocs/network/2026-07-03_redis-vector-set-hnsw-id-rce/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_redis-vector-set-hnsw-id-rce/Critical severity — network · None assigned as of 2026-07-03. Status: Weaponized. Affects: Redis server, Vector Set module (modules/vector-sets). Tags: redis, vector-set, hnsw, rce, deserialization, use-after-free, heap-corruption, rdb-restore.networkCriticalredisvector-sethnswrcedeserializationuse-after-freeheap-corruptionrdb-restorehttps://poc.intelseclab.com/pocs/web/2026-05-17_toolshell-sharepoint-chain/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_toolshell-sharepoint-chain/Critical severity — web · CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706. Status: Weaponized. Affects: Microsoft SharePoint Server. Tags: RCE, SharePoint, unauthenticated, deserialization, auth-bypass, APT27, APT31, ransomware, Windows, IIS.webCriticalRCESharePointunauthenticateddeserializationauth-bypassAPT27APT31ransomwareWindowsIIShttps://poc.intelseclab.com/pocs/web/2026-05-17_react2shell-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_react2shell-rce/Critical severity (CVSS 10) — web · CVE-2025-55182. Status: Weaponized. Affects: Next.js (App Router with React Server Components), React. Tags: RCE, Next.js, React, RSC, deserialization, prototype-pollution, unauthenticated, Node.js, cloud.webCriticalRCENext.jsReactRSCdeserializationprototype-pollutionunauthenticatedNode.jscloudhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-rsc-dos-flight-deserialization/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-rsc-dos-flight-deserialization/High severity (CVSS 7.5) — web · CVE-2026-23870. Status: Weaponized. Affects: Next.js App Router (React server-action / RSC reply parser). Tags: DoS, RSC, React-Flight, deserialization, cyclic-payload, Next.js, App-Router, unauthenticated, pre-auth.webHighDoSRSCReact-Flightdeserializationcyclic-payloadNext.jsApp-Routerunauthenticatedpre-authhttps://poc.intelseclab.com/pocs/web/2026-05-17_confluence-postauth-rce-cve-2024-21683/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_confluence-postauth-rce-cve-2024-21683/High severity (CVSS 8.3) — web · CVE-2024-21683. Status: Weaponized. Affects: Atlassian Confluence Data Center and Server. Tags: RCE, Confluence, post-auth, Rhino, JavaScript, Java, deserialization, Metasploit, red-team.webHighRCEConfluencepost-authRhinoJavaScriptJavadeserializationMetasploitred-team