Git — PoC Archivehttps://poc.intelseclab.com/tags/git/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000Gitea — diffpatch API Git Hook Remote Code Execution (CVE-2026-60004)https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-60004-gitea-diffpatch-githook-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-60004-gitea-diffpatch-githook-rce/High severity (CVSS 8.8) — web · CVE-2026-60004. Status: Patched. Affects: Gitea (self-hosted Git service), diffpatch API endpoint, Git three-way merge fallback. Tags: gitea, git, diffpatch, git-hook, post-index-change, three-way-merge, bare-repository, CWE-94, authenticated-rce, self-hosted, code-hosting.webHighgiteagitdiffpatchgit-hookpost-index-changethree-way-mergebare-repositoryCWE-94authenticated-rceself-hostedcode-hostingPrefect GitRepository Git Argument Injection RCE via `commit_sha` — CVE-2026-5366https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5366-prefect-git-argument-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5366-prefect-git-argument-injection/High severity — web · CVE-2026-5366 (Huntr bounty e2e88a0f-a8f6-49c9-94c5-e98dc385f07a). Status: PoC. Affects: Prefect (workflow orchestration platform), GitRepository storage class. Tags: prefect, git, argument-injection, rce, upload-pack, workflow-orchestration, supply-chain, python.webHighprefectgitargument-injectionrceupload-packworkflow-orchestrationsupply-chainpythonHAXcms Git.php OS Command Injection (CVE-2026-46394)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46394-haxcms-git-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46394-haxcms-git-command-injection/High severity (CVSS 7.2) — web · CVE-2026-46394. Status: PoC. Affects: HAXcms PHP backend (elmsln/HAXcms) — system/backend/php/lib/Git.php. Tags: haxcms, php, command-injection, cwe-78, git, proc_open, cms.webHighhaxcmsphpcommand-injectioncwe-78gitproc_opencmsHashiCorp go-getter Git Pathspec Arbitrary File Read (CVE-2026-4660)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-4660-go-getter-terraform-pathspec-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-4660-go-getter-terraform-pathspec-injection/High severity (CVSS 7.5) — cloud · CVE-2026-4660 / HCSEC-2026-04. Status: PoC. Affects: hashicorp/go-getter (used by Terraform, Nomad, Packer, Waypoint). Tags: terraform, go-getter, git, pathspec-injection, arbitrary-file-read, ci-cd, supply-chain, iac.cloudHighterraformgo-gettergitpathspec-injectionarbitrary-file-readci-cdsupply-chainiacGogs Admin User Edit CSRF to Git Hook RCEhttps://poc.intelseclab.com/pocs/web/2026-07-03_gogs-admin-csrf-git-hook-rce/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_gogs-admin-csrf-git-hook-rce/Critical severity — web · None assigned as of 2026-07-03. Status: Weaponized. Affects: Gogs (self-hosted Git service). Tags: gogs, csrf, git-hooks, privilege-escalation, rce, admin-takeover, git, self-hosted.webCriticalgogscsrfgit-hooksprivilege-escalationrceadmin-takeovergitself-hosted