Hmac — PoC Archivehttps://poc.intelseclab.com/tags/hmac/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000StoryChief WordPress Plugin Unauthenticated Arbitrary File Upload via Webhook (CVE-2025-7441)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Critical severity (CVSS 9.8) — web · CVE-2025-7441. Status: PoC. Affects: StoryChief WordPress plugin. Tags: storychief, wordpress, wordpress-plugin, arbitrary-file-upload, ssrf, remote-code-execution, unauthenticated, webhook, hmac, cwe-434, python.webCriticalstorychiefwordpresswordpress-pluginarbitrary-file-uploadssrfremote-code-executionunauthenticatedwebhookhmaccwe-434pythonHAXcms Node.js Private Key Disclosure via Broken HMAC (CVE-2026-46395)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46395-haxcms-hmac-key-leak/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46395-haxcms-hmac-key-leak/Critical severity (CVSS 9.8) — web · CVE-2026-46395. Status: PoC. Affects: HAXcms Node.js backend (elmsln/HAXcms, haxcms-nodejs) — src/lib/HAXCMS.js. Tags: haxcms, nodejs, hmac, jwt-forgery, cwe-321, cwe-200, key-disclosure, cms.webCriticalhaxcmsnodejshmacjwt-forgerycwe-321cwe-200key-disclosurecms