Laravel — PoC Archivehttps://poc.intelseclab.com/tags/laravel/Latest proof-of-concept entries.Hugoen-usFri, 31 Jul 2026 00:00:00 +0000Microweber CMS Unauthenticated Path Traversal → Arbitrary File Read (CVE-2026-65694)https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-65694-microweber-path-traversal/Fri, 31 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-31_cve-2026-65694-microweber-path-traversal/High severity (CVSS 7.5) — web · CVE-2026-65694 (VulnCheck advisory). Status: Unpatched. Affects: Microweber CMS — ServeStaticFileContoller::serveFromUserfiles(). Tags: microweber, path-traversal, cwe-22, unauthenticated, arbitrary-file-read, laravel, query-string-override.webHighmicroweberpath-traversalcwe-22unauthenticatedarbitrary-file-readlaravelquery-string-overrideLaravel Livewire Remote Code Execution via Known APP_KEY (CVE-2025-54068)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54068-livewire-appkey-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54068-livewire-appkey-rce/Critical severity (CVSS 9.8) — web · CVE-2025-54068. Status: Weaponized. Affects: Laravel Livewire (versions prior to v3.6.4). Tags: laravel, livewire, php, deserialization, app-key, hmac-forgery, gadget-chain, rce, cwe-502, python.webCriticallaravellivewirephpdeserializationapp-keyhmac-forgerygadget-chainrcecwe-502pythonLaravel `files.*` Wildcard Validation Bypass via Polyglot JPEG+PHP Upload (CVE-2025-27515)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-27515-laravel-polyglot-upload-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-27515-laravel-polyglot-upload-bypass/Critical severity (CVSS 9.8) — web · CVE-2025-27515. Status: Weaponized. Affects: Laravel Framework (file upload validation using files.* wildcard rules). Tags: laravel, php, file-upload, validation-bypass, polyglot, jpeg, wildcard-validation, cwe-20, rce, web-shell.webCriticallaravelphpfile-uploadvalidation-bypasspolyglotjpegwildcard-validationcwe-20rceweb-shellXboard / V2Board — Magic Link Token Leak Unauth Account Takeover (CVE-2026-39912)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39912-xboard-v2board-account-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39912-xboard-v2board-account-takeover/Critical severity (CVSS 9.1) — web · CVE-2026-39912. Status: Weaponized. Affects: V2Board / Xboard (VPN/proxy subscription management panels). Tags: xboard, v2board, php, laravel, account-takeover, magic-link, unauthenticated, information-disclosure, proxy-panel.webCriticalxboardv2boardphplaravelaccount-takeovermagic-linkunauthenticatedinformation-disclosureproxy-panelTypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27621-typicms-svg-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27621-typicms-svg-xss/Medium severity — web · CVE-2026-27621 (GHSA-xfvg-8v67-j7wp). Status: PoC. Affects: TypiCMS Core (typicms/core). Tags: typicms, stored-xss, svg-upload, cwe-79, cms, file-upload, laravel, session-hijack.webMediumtypicmsstored-xsssvg-uploadcwe-79cmsfile-uploadlaravelsession-hijackKrayin CRM — TinyMCE Upload Unrestricted File Upload to RCE (CVE-2026-38526)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-38526-krayin-crm-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-38526-krayin-crm-file-upload-rce/Critical severity — web · CVE-2026-38526. Status: Weaponized. Affects: Krayin CRM. Tags: krayin-crm, laravel, unrestricted-file-upload, tinymce, rce, reverse-shell, authenticated.webCriticalkrayin-crmlaravelunrestricted-file-uploadtinymcercereverse-shellauthenticateddedoc/scramble Laravel API-Doc Generator Unauthenticated eval() RCE (CVE-2026-44262)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44262-dedoc-scramble-eval-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44262-dedoc-scramble-eval-rce/Critical severity — web · CVE-2026-44262 / [GHSA-4rm2-28vj-fj39](https://github.com/advisories/GHSA-4rm2-28vj-fj39). Status: PoC. Affects: [dedoc/scramble](https://github.com/dedoc/scramble) — Laravel API documentation generator. Tags: laravel, php, dedoc-scramble, eval-injection, rce, unauthenticated, api-documentation, openapi.webCriticallaravelphpdedoc-scrambleeval-injectionrceunauthenticatedapi-documentationopenapiAzuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54415-azuriom-account-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54415-azuriom-account-takeover/High severity (CVSS 3.1) — web · CVE-2026-54415. Status: PoC. Affects: Azuriom CMS. Tags: azuriom, cms, broken-access-control, cwe-862, cwe-269, privilege-escalation, account-takeover, php, laravel, azlink.webHighazuriomcmsbroken-access-controlcwe-862cwe-269privilege-escalationaccount-takeoverphplaravelazlink