https://poc.intelseclab.com/tags/kev/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-34910-unifi-os-unauth-rce/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-34910-unifi-os-unauth-rce/Critical severity (CVSS 10) — network · CVE-2026-34910, CVE-2026-34909, CVE-2026-34908. Status: Patched. Affects: Ubiquiti UniFi OS Server. Tags: ubiquiti, unifi, unifi-os, auth-bypass, path-traversal, command-injection, rce, unauth, kev, mirai, nginx, CVE-2026-34910.networkCriticalubiquitiunifiunifi-osauth-bypasspath-traversalcommand-injectionrceunauthkevmirainginxCVE-2026-34910https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2021-22205-gitlab-exiftool-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2021-22205-gitlab-exiftool-preauth-rce/Critical severity (CVSS 10) — web · CVE-2021-22205 (chains CVE-2021-22204 in ExifTool). Status: Patched (GitLab 13.8.8, 13.9.6, 13.10.3). Affects: GitLab Community Edition and Enterprise Edition (via bundled ExifTool, invoked by GitLab Workhorse). Tags: gitlab, exiftool, djvu, rce, preauth, unauthenticated, workhorse, perl, qx, reverse-shell, metadata-injection, kev, ransomware, python, cve-2021-22205, cve-2021-22204.webCriticalgitlabexiftooldjvurcepreauthunauthenticatedworkhorseperlqxreverse-shellmetadata-injectionkevransomwarepythoncve-2021-22205cve-2021-22204https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2024-51378-cyberpanel-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2024-51378-cyberpanel-preauth-rce/Critical severity (CVSS 10) — web · CVE-2024-51378. Status: Patched (commit 1c0c6cb; CyberPanel 2.3.8 and later). Affects: CyberPanel (aka Cyber Panel), by CyberPersons — Django-based hosting control panel. Tags: cyberpanel, rce, command-injection, preauth, unauthenticated, options-method, secmiddleware-bypass, statusfile, kev, ransomware, psaux, python, httpx, cve-2024-51378.webCriticalcyberpanelrcecommand-injectionpreauthunauthenticatedoptions-methodsecmiddleware-bypassstatusfilekevransomwarepsauxpythonhttpxcve-2024-51378https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-50522-sharepoint-preauth-rce/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-50522-sharepoint-preauth-rce/Critical severity (CVSS 9.8) — web · CVE-2026-50522. Status: Weaponized — public PoC confirmed used in real attacks within hours of release (watchTowr honeypot telemetry). Affects: Microsoft SharePoint Server (on-premises). Tags: sharepoint, deserialization, binaryformatter, ws-federation, unauthenticated, rce, kev, actively-exploited, microsoft.webCriticalsharepointdeserializationbinaryformatterws-federationunauthenticatedrcekevactively-exploitedmicrosofthttps://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56291-joomla-balbooa-forms-file-upload-rce/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56291-joomla-balbooa-forms-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-56291. Status: Weaponized. Affects: Balbooa Forms (com_baforms) — third-party Joomla! extension by balbooa.com. Tags: joomla, balbooa-forms, file-upload, webshell, unauthenticated, rce, kev, actively-exploited, cwe-434.webCriticaljoomlabalbooa-formsfile-uploadwebshellunauthenticatedrcekevactively-exploitedcwe-434https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-48558-simplehelp-oidc-auth-bypass/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-48558-simplehelp-oidc-auth-bypass/Critical severity (CVSS 10) — web · CVE-2026-48558. Status: Weaponized — forges valid privileged sessions with no credentials. Affects: SimpleHelp — remote support / RMM (remote monitoring and management) platform, OIDC authentication flow. Tags: simplehelp, rmm, oidc, jwt, alg-none, cwe-347, authentication-bypass, unauthenticated, remote, kev, actively-exploited, ransomware.webCriticalsimplehelprmmoidcjwtalg-nonecwe-347authentication-bypassunauthenticatedremotekevactively-exploitedransomwarehttps://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-55255-langflow-responses-api-idor/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-55255-langflow-responses-api-idor/High severity (CVSS 8.4) — web · CVE-2026-55255 (GHSA-qrpv-q767-xqq2). Status: Weaponized — confirmed cross-user flow execution via a minimal request-only PoC. Affects: Langflow — open-source platform for building and deploying AI-powered agents and workflows (langflow-ai/langflow), OpenAI-compatible Responses API. Tags: langflow, ai-agent-framework, idor, cwe-639, authenticated, remote, cross-tenant, kev.webHighlangflowai-agent-frameworkidorcwe-639authenticatedremotecross-tenantkevhttps://poc.intelseclab.com/pocs/network/2026-07-19_cve-2026-20230-cisco-ucm-ssrf-arbitrary-file-write/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-19_cve-2026-20230-cisco-ucm-ssrf-arbitrary-file-write/Critical severity (CVSS 8.6) — network · CVE-2026-20230 (cisco-sa-cucm-ssrf-cXPnHcW). Status: PoC — scanner/tester confirms the WebDialer precondition and SSRF reachability. Affects: Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) — WebDialer service. Tags: cisco, unified-communications-manager, ucm, webdialer, ssrf, cwe-918, unauthenticated, remote, privilege-escalation, kev, actively-exploited.networkCriticalciscounified-communications-managerucmwebdialerssrfcwe-918unauthenticatedremoteprivilege-escalationkevactively-exploitedhttps://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-48282-coldfusion-rds-path-traversal-rce/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-48282-coldfusion-rds-path-traversal-rce/Critical severity (CVSS 10) — web · CVE-2026-48282 (Adobe APSB26-68). Status: Weaponized — arbitrary file read/write, directory browsing, webshell deployment, and command execution all confirmed. Affects: Adobe ColdFusion — Remote Development Service (RDS), /CFIDE/main/ide.cfm. Tags: coldfusion, adobe, rds, path-traversal, cwe-22, unauthenticated, remote, webshell, kev, actively-exploited.webCriticalcoldfusionadoberdspath-traversalcwe-22unauthenticatedremotewebshellkevactively-exploitedhttps://poc.intelseclab.com/pocs/network/2026-07-15_cve-2026-15409-sonicwall-sma1000-ssrf-erlang-rce/Wed, 15 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-15_cve-2026-15409-sonicwall-sma1000-ssrf-erlang-rce/Critical severity (CVSS 10) — network · CVE-2026-15409 (SNWLID-2026-0008). Status: Weaponized — unauthenticated, non-root remote code execution confirmed against a real appliance build. Affects: SonicWall SMA1000 Appliance — WorkPlace interface (websocket proxy service). Tags: sonicwall, sma1000, workplace, ssrf, erlang, rpc, cwe-918, unauthenticated, remote, kev, actively-exploited.networkCriticalsonicwallsma1000workplacessrferlangrpccwe-918unauthenticatedremotekevactively-exploitedhttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2023-38950-zkteco-biotime-path-traversal/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2023-38950-zkteco-biotime-path-traversal/High severity (CVSS 7.5) — web · CVE-2023-38950. Status: Weaponized (public PoC, in CISA KEV). Affects: ZKTeco BioTime (web-based time & attendance / access control management platform). Tags: zkteco, biotime, path-traversal, arbitrary-file-read, cwe-22, unauthenticated, remote, iclock-api, kev.webHighzktecobiotimepath-traversalarbitrary-file-readcwe-22unauthenticatedremoteiclock-apikevhttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-48939. Status: Weaponized (public PoC available, actively exploited in the wild, in CISA KEV since 2026-07-10). Affects: iCagenda — events/calendar extension (component) for Joomla. Tags: joomla, icagenda, file-upload, rce, cwe-434, unauthenticated, remote, kev, cms, php, access-control-bypass.webCriticaljoomlaicagendafile-uploadrcecwe-434unauthenticatedremotekevcmsphpaccess-control-bypasshttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-42237-sitecore-xp-deserialization-rce/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-42237-sitecore-xp-deserialization-rce/Critical severity (CVSS 9.8) — web · CVE-2021-42237 (Sitecore advisory SC2021-003-499266). Status: Weaponized (public PoC + Metasploit module, in CISA KEV, known ransomware campaign use). Affects: Sitecore Experience Platform (XP). Tags: sitecore, deserialization, rce, cms, unauthenticated, remote, kev, known-ransomware-use, cwe-502.webCriticalsitecoredeserializationrcecmsunauthenticatedremotekevknown-ransomware-usecwe-502https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25296-nagios-xi-windowswmi-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25296-nagios-xi-windowswmi-command-injection/High severity (CVSS 8.8) — web · CVE-2021-25296. Status: Weaponized (public Metasploit module + nuclei templates, in CISA KEV). Affects: Nagios XI — Windows WMI monitoring configuration wizard. Tags: nagios-xi, os-command-injection, authenticated, config-wizard, windowswmi, cwe-78, kev, metasploit.webHighnagios-xios-command-injectionauthenticatedconfig-wizardwindowswmicwe-78kevmetasploithttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25297-nagios-xi-switch-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25297-nagios-xi-switch-command-injection/High severity (CVSS 8.8) — web · CVE-2021-25297. Status: Weaponized (public Metasploit module + nuclei templates, in CISA KEV). Affects: Nagios XI — Switch (SNMP) monitoring configuration wizard. Tags: nagios-xi, os-command-injection, authenticated, config-wizard, switch, cwe-78, kev, metasploit.webHighnagios-xios-command-injectionauthenticatedconfig-wizardswitchcwe-78kevmetasploithttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25298-nagios-xi-cloudvm-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25298-nagios-xi-cloudvm-command-injection/High severity (CVSS 8.8) — web · CVE-2021-25298. Status: Weaponized (public Metasploit module + nuclei templates, in CISA KEV). Affects: Nagios XI — Cloud/VM monitoring configuration wizard (DigitalOcean provider sub-option). Tags: nagios-xi, os-command-injection, authenticated, config-wizard, cloud-vm, cwe-78, kev, metasploit.webHighnagios-xios-command-injectionauthenticatedconfig-wizardcloud-vmcwe-78kevmetasploithttps://poc.intelseclab.com/pocs/network/2026-07-11_cve-2022-26258-dlink-dir820l-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-11_cve-2022-26258-dlink-dir820l-command-injection/Critical severity (CVSS 9.8) — network · CVE-2022-26258. Status: Weaponized (public PoC available; listed in CISA KEV). Affects: D-Link DIR-820L wireless router, all hardware revisions. Tags: d-link, dir-820l, router, command-injection, cwe-78, unauthenticated, remote, iot, eol-device, kev.networkCriticald-linkdir-820lroutercommand-injectioncwe-78unauthenticatedremoteioteol-devicekevhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-34299-monsta-ftp-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-34299-monsta-ftp-rce/Critical severity (CVSS 9.8) — network · CVE-2025-34299. Status: Weaponized. Affects: Monsta FTP (web-based FTP manager). Tags: monsta-ftp, rce, pre-auth, unrestricted-file-upload, cwe-434, php, ftp, docker, nuclei, kev.networkCriticalmonsta-ftprcepre-authunrestricted-file-uploadcwe-434phpftpdockernucleikevhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-39808-fortisandbox-os-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-39808-fortisandbox-os-command-injection/Critical severity (CVSS 9.8) — network · CVE-2026-39808. Status: Weaponized — real, working exploit verified from two independent sources. Affects: Fortinet FortiSandbox. Tags: fortinet, fortisandbox, os-command-injection, unauthenticated, root-rce, cwe-78, actively-exploited, kev.networkCriticalfortinetfortisandboxos-command-injectionunauthenticatedroot-rcecwe-78actively-exploitedkevhttps://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Critical severity (CVSS 10) — web · CVE-2026-48908 (GHSA-8fwr-8fxr-8v2p). Status: Weaponized — public PoC with mass-scan support, added to CISA KEV 2026-07-07, confirmed active in-the-wild exploitation. Affects: SP Page Builder extension for Joomla (joomshaper.net). Tags: RCE, unauthenticated, file-upload, PHP-webshell, Joomla, CMS, access-control, Python, CVSS-10, kev, backdoor, cwe-434.webCriticalRCEunauthenticatedfile-uploadPHP-webshellJoomlaCMSaccess-controlPythonCVSS-10kevbackdoorcwe-434https://poc.intelseclab.com/pocs/web/2026-05-17_jenkins-cli-arbitrary-file-read-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_jenkins-cli-arbitrary-file-read-rce/Critical severity (CVSS 9.8) — web · CVE-2024-23897. Status: Weaponized. Affects: Jenkins controller (CLI endpoint). Tags: arbitrary-file-read, Jenkins, CLI, credential-theft, RCE, unauthenticated, KEV.webCriticalarbitrary-file-readJenkinsCLIcredential-theftRCEunauthenticatedKEVhttps://poc.intelseclab.com/pocs/network/2026-05-17_fortimanager-fortijump-rce-cve-2024-47575/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_fortimanager-fortijump-rce-cve-2024-47575/Critical severity (CVSS 9.8) — network · CVE-2024-47575. Status: Weaponized. Affects: Fortinet FortiManager / FortiManager Cloud (fgfmd daemon). Tags: RCE, unauthenticated, FortiManager, fgfmd, zero-day, KEV.networkCriticalRCEunauthenticatedFortiManagerfgfmdzero-dayKEVhttps://poc.intelseclab.com/pocs/network/2026-05-16_vmware-vcenter-dcerpc-heap-overflow-rce/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-16_vmware-vcenter-dcerpc-heap-overflow-rce/Critical severity (CVSS 9.8) — network · CVE-2024-37079. Status: Weaponized. Affects: VMware vCenter Server. Tags: RCE, heap-overflow, DCE/RPC, vCenter, unauthenticated, KEV.networkCriticalRCEheap-overflowDCE/RPCvCenterunauthenticatedKEVhttps://poc.intelseclab.com/pocs/web/2026-05-16_fortios-sslvpn-rce-cve-2024-21762/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-16_fortios-sslvpn-rce-cve-2024-21762/Critical severity (CVSS 9.6) — web · CVE-2024-21762. Status: Weaponized. Affects: Fortinet FortiOS SSL VPN (sslvpnd). Tags: RCE, out-of-bounds-write, SSL-VPN, FortiOS, edge-appliance, unauthenticated, KEV.webCriticalRCEout-of-bounds-writeSSL-VPNFortiOSedge-applianceunauthenticatedKEVhttps://poc.intelseclab.com/pocs/web/2026-05-16_fortios-fortiproxy-auth-bypass-cve-2024-55591/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-16_fortios-fortiproxy-auth-bypass-cve-2024-55591/Critical severity (CVSS 9.6) — web · CVE-2024-55591 (Fortinet FG-IR-24-535). Status: Weaponized — public PoC exploit code available, listed in CISA KEV (added 2025-01-14), confirmed used in ransomware intrusions. Affects: Fortinet FortiOS/FortiProxy management interfaces. Tags: auth-bypass, websocket, race-condition, FortiOS, FortiProxy, unauthenticated, super-admin, kev, known-ransomware-use, cwe-288.webCriticalauth-bypasswebsocketrace-conditionFortiOSFortiProxyunauthenticatedsuper-adminkevknown-ransomware-usecwe-288