https://poc.intelseclab.com/tags/gadget-chain/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49113-roundcube-php-object-deserialization-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49113-roundcube-php-object-deserialization-rce/Critical severity (CVSS 9.9) — web · CVE-2025-49113. Status: Weaponized. Affects: Roundcube Webmail. Tags: roundcube, webmail, php, deserialization, object-injection, gadget-chain, rce, post-auth, cwe-502.webCriticalroundcubewebmailphpdeserializationobject-injectiongadget-chainrcepost-authcwe-502https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54068-livewire-appkey-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54068-livewire-appkey-rce/Critical severity (CVSS 9.8) — web · CVE-2025-54068. Status: Weaponized. Affects: Laravel Livewire (versions prior to v3.6.4). Tags: laravel, livewire, php, deserialization, app-key, hmac-forgery, gadget-chain, rce, cwe-502, python.webCriticallaravellivewirephpdeserializationapp-keyhmac-forgerygadget-chainrcecwe-502pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-22777-givewp-php-object-injection/Critical severity (CVSS 9.8) — web · CVE-2025-22777. Status: PoC. Affects: GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, 100,000+ active installs). Tags: givewp, wordpress, wordpress-plugin, php-object-injection, deserialization, unserialize, gadget-chain, cwe-502, php, unauthenticated.webCriticalgivewpwordpresswordpress-pluginphp-object-injectiondeserializationunserializegadget-chaincwe-502phpunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2026-27172-camel-consul-registry-deserialization/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2026-27172-camel-consul-registry-deserialization/Critical severity (CVSS 9.8) — web · CVE-2026-27172. Status: Patched. Affects: Apache Camel camel-consul component (org.apache.camel.component.consul.ConsulRegistry). Tags: apache-camel, camel-consul, consulregistry, java-deserialization, rce, cwe-502, gadget-chain, ysoserial, spring-boot.webCriticalapache-camelcamel-consulconsulregistryjava-deserializationrcecwe-502gadget-chainysoserialspring-boothttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54806-wp-activity-log-poi-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54806-wp-activity-log-poi-rce/Critical severity (CVSS 9.8) — web · CVE-2026-54806. Status: PoC. Affects: WP Activity Log (plugin slug: wp-security-audit-log) by Melapress, for WordPress. Tags: wordpress, wp-activity-log, wp-security-audit-log, php-object-injection, deserialization, cwe-502, blind-rce, gadget-chain.webCriticalwordpresswp-activity-logwp-security-audit-logphp-object-injectiondeserializationcwe-502blind-rcegadget-chainhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48909-sp-lms-joomla-phpobjectinjection-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48909-sp-lms-joomla-phpobjectinjection-rce/Critical severity (CVSS 9.5) — web · CVE-2026-48909 (GHSA-gf8c-xmwj-whrh). Status: PoC. Affects: JoomShaper SP LMS (com_splms) Joomla Learning Management System extension. Tags: joomla, sp-lms, com_splms, php-object-injection, cwe-502, deserialization, unauthenticated-rce, gadget-chain.webCriticaljoomlasp-lmscom_splmsphp-object-injectioncwe-502deserializationunauthenticated-rcegadget-chainhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33439-openam-deserialization-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33439-openam-deserialization-rce/Critical severity (CVSS 9.8) — web · CVE-2026-33439. Status: Weaponized. Affects: ForgeRock / OpenIdentityPlatform OpenAM. Tags: openam, forgerock, deserialization, rce, pre-auth, java, gadget-chain, xalan, jato.webCriticalopenamforgerockdeserializationrcepre-authjavagadget-chainxalanjatohttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34838-groupoffice-deserialization-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34838-groupoffice-deserialization-rce/Critical severity — web · CVE-2026-34838 (GHSA-h22j-frrf-5vxq). Status: PoC. Affects: Group-Office groupware suite. Tags: php, deserialization, rce, groupware, gadget-chain, authenticated, group-office, guzzlehttp.webCriticalphpdeserializationrcegroupwaregadget-chainauthenticatedgroup-officeguzzlehttphttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34486-tomcat-tribes-deserialization-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34486-tomcat-tribes-deserialization-rce/Critical severity — web · CVE-2026-34486. Status: Weaponized. Affects: Apache Tomcat Tribes clustering (EncryptInterceptor). Tags: deserialization, rce, tomcat, tribes, clustering, java, gadget-chain, unauthenticated.webCriticaldeserializationrcetomcattribesclusteringjavagadget-chainunauthenticatedhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42779-apache-mina-deserialization-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42779-apache-mina-deserialization-bypass/Critical severity (CVSS 9.8) — network · CVE-2026-42779. Status: PoC. Affects: Apache MINA (mina-core). Tags: apache-mina, java, deserialization, cwe-502, gadget-chain, commons-collections, rce, filter-bypass.networkCriticalapache-minajavadeserializationcwe-502gadget-chaincommons-collectionsrcefilter-bypass