In-the-Wild — PoC Archivehttps://poc.intelseclab.com/tags/in-the-wild/Latest proof-of-concept entries.Hugoen-usWed, 01 Jul 2026 00:00:00 +0000WinRAR Windows Path Traversal via NTFS Alternate Data Streams (CVE-2025-8088)https://poc.intelseclab.com/pocs/misc/2026-07-01_cve-2025-8088-winrar-ads-path-traversal/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-01_cve-2025-8088-winrar-ads-path-traversal/High severity (CVSS 8.4) — misc · CVE-2025-8088. Status: Weaponized. Affects: WinRAR (Windows). Tags: path-traversal, WinRAR, NTFS, Alternate-Data-Streams, RomCom, Storm-0978, persistence, startup-folder, in-the-wild.miscHighpath-traversalWinRARNTFSAlternate-Data-StreamsRomComStorm-0978persistencestartup-folderin-the-wildDirtyClone — Linux Kernel LPE via Cloned Packet Page-Cache Overwrite (CVE-2026-43503)https://poc.intelseclab.com/pocs/binary/2026-06-28_dirtyclone-cve-2026-43503-lpe/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-28_dirtyclone-cve-2026-43503-lpe/High severity (CVSS 8.8) — binary · CVE-2026-43503. Status: Weaponized. Affects: Linux kernel (netfilter TEE / __pskb_copy_fclone()). Tags: LPE, Linux kernel, netfilter, TEE, IPsec, XFRM, page-cache, file-backed memory, DirtyFrag, skb, privilege escalation, C, in-the-wild.binaryHighLPELinux kernelnetfilterTEEIPsecXFRMpage-cachefile-backed memoryDirtyFragskbprivilege escalationCin-the-wildWindows NTLM Hash Disclosure via File Explorer - CVE-2025-24054https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-ntlm-hash-disclosure-cve-2025-24054/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-ntlm-hash-disclosure-cve-2025-24054/Medium severity (CVSS 6.5) — binary · CVE-2025-24054. Status: Patched. Affects: Windows File Explorer (Windows Shell). Tags: NTLM, NTLMv2, hash-disclosure, zero-click, Windows, File-Explorer, UNC, SMB, credential-theft, in-the-wild, state-sponsored.binaryMediumNTLMNTLMv2hash-disclosurezero-clickWindowsFile-ExplorerUNCSMBcredential-theftin-the-wildstate-sponsoredWindows MMC MSC EvilTwin - CVE-2025-26633https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-mmc-eviltwin-cve-2025-26633/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-mmc-eviltwin-cve-2025-26633/High severity — binary · CVE-2025-26633. Status: Patched. Affects: Microsoft Management Console (MMC), Windows. Tags: RCE, Windows, MMC, MSC, ActiveX, EvilTwin, APT, EncryptHub, Water-Gamayun, zero-day, in-the-wild.binaryHighRCEWindowsMMCMSCActiveXEvilTwinAPTEncryptHubWater-Gamayunzero-dayin-the-wildErlang/OTP SSH Pre-Auth RCE - CVE-2025-32433https://poc.intelseclab.com/pocs/network/2026-05-17_erlang-otp-ssh-preauth-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_erlang-otp-ssh-preauth-rce/Critical severity (CVSS 10) — network · CVE-2025-32433. Status: Patched. Affects: Erlang/OTP SSH server daemon. Tags: RCE, pre-auth, unauthenticated, SSH, Erlang, OTP, RabbitMQ, CouchDB, ICS, OT, reverse-shell, in-the-wild.networkCriticalRCEpre-authunauthenticatedSSHErlangOTPRabbitMQCouchDBICSOTreverse-shellin-the-wild