Go — PoC Archivehttps://poc.intelseclab.com/tags/go/Latest proof-of-concept entries.Hugoen-usFri, 31 Jul 2026 00:00:00 +0000Craft CMS Pre-Auth Remote Code Execution via Session Poisoning + Yii2 PhpManager Gadget (CVE-2025-32432)https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2025-32432-craftcms-preauth-rce/Fri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2025-32432-craftcms-preauth-rce/Critical severity (CVSS 10) — web · CVE-2025-32432. Status: Patched (Craft CMS 5.6.17+). Affects: Craft CMS (craftcms/cms). Tags: craftcms, rce, preauth, session-poisoning, php-deserialization, yii2, phpfpm, unauthenticated, go, cve-2025-32432.webCriticalcraftcmsrcepreauthsession-poisoningphp-deserializationyii2phpfpmunauthenticatedgocve-2025-32432ProFTPD mod_sql Pre-Auth SQL Injection Leading to RCE (CVE-2026-42167)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42167-proftpd-sqli-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42167-proftpd-sqli-rce/High severity (CVSS 8.1) — network · CVE-2026-42167. Status: PoC. Affects: ProFTPD (with mod_sql and SQL-backed logging configured). Tags: sqli, unauthenticated, proftpd, mod_sql, ftp, rce, backdoor, go.networkHighsqliunauthenticatedproftpdmod_sqlftprcebackdoorgoPocketBase OAuth2 Account Pre-Hijacking (CVE-2026-44166)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44166-pocketbase-oauth2-account-prehijack/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44166-pocketbase-oauth2-account-prehijack/Medium severity (CVSS 6.1) — web · CVE-2026-44166 / [GHSA-pq7p-mc74-g65w](https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w). Status: PoC. Affects: [PocketBase](https://github.com/pocketbase/pocketbase) (Go backend / BaaS). Tags: pocketbase, oauth2, account-takeover, account-pre-hijacking, cwe-287, improper-authentication, go.webMediumpocketbaseoauth2account-takeoveraccount-pre-hijackingcwe-287improper-authenticationgoGogs Wiki Arbitrary File Deletion via Path Traversal (CVE-2026-24135)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24135-gogs-wiki-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24135-gogs-wiki-path-traversal/High severity (CVSS 7.5) — web · CVE-2026-24135 (GHSA-jp7c-wj6q-3qf2). Status: PoC. Affects: Gogs self-hosted Git service. Tags: gogs, path-traversal, arbitrary-file-deletion, wiki, git-service, authenticated, go.webHighgogspath-traversalarbitrary-file-deletionwikigit-serviceauthenticatedgo