LFI — PoC Archivehttps://poc.intelseclab.com/tags/lfi/Latest proof-of-concept entries.Hugoen-usSat, 05 Sep 2026 00:00:00 +0000WordPress Divi Ajax Filter LFI (CVE-2026-11613)https://poc.intelseclab.com/pocs/web/2026-09-05_cve-2026-11613-divi-ajax-filter-lfi/Sat, 05 Sep 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-09-05_cve-2026-11613-divi-ajax-filter-lfi/Critical severity (CVSS 9.8) — web · CVE-2026-11613. Status: PoC. Affects: Divi Ajax Filter plugin for WordPress. Tags: LFI, WordPress, Divi, unauthenticated, Python.webCriticalLFIWordPressDiviunauthenticatedPythonThinkPHP 5.0.24 File Inclusion Leading to Remote Code Execution (CVE-2025-63888)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-63888-thinkphp-file-inclusion-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-63888-thinkphp-file-inclusion-rce/Critical severity (CVSS 9.8) — web · CVE-2025-63888. Status: Weaponized. Affects: ThinkPHP (top10.org / TopThink PHP framework). Tags: thinkphp, php, file-inclusion, lfi, rce, log-poisoning, webshell, cwe-98, cwe-22.webCriticalthinkphpphpfile-inclusionlfircelog-poisoningwebshellcwe-98cwe-22Kubio AI Page Builder <= 2.5.1 Unauthenticated Local File Inclusion (CVE-2025-2294)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-2294-kubio-lfi/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-2294-kubio-lfi/Critical severity (CVSS 9.8) — web · CVE-2025-2294. Status: PoC. Affects: Kubio AI Page Builder (WordPress plugin). Tags: wordpress, kubio, page-builder, lfi, local-file-inclusion, unauthenticated, php, python, cwe-98.webCriticalwordpresskubiopage-builderlfilocal-file-inclusionunauthenticatedphppythoncwe-98Adobe Magento "SessionReaper" Unauthenticated File Upload / LFI (CVE-2025-54236)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54236-magento-sessionreaper-lfi/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54236-magento-sessionreaper-lfi/Critical severity (CVSS 9.1) — web · CVE-2025-54236. Status: PoC. Affects: Adobe Commerce / Magento Open Source — customer/address_file/upload endpoint (dubbed "SessionReaper"). Tags: magento, adobe-commerce, sessionreaper, file-upload, lfi, customer-address, form-key, cwe-434, python.webCriticalmagentoadobe-commercesessionreaperfile-uploadlficustomer-addressform-keycwe-434pythonTermix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22804-termix-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22804-termix-stored-xss/High severity — web · CVE-2026-22804 (GHSA-m3cv-5hgp-hv35). Status: Weaponized. Affects: Termix (Electron-based SSH/terminal manager), File Manager component (FileViewer.tsx). Tags: termix, electron, stored-xss, svg-injection, session-hijacking, lfi, file-manager, ssh.webHightermixelectronstored-xsssvg-injectionsession-hijackinglfifile-managersshProdigy Commerce WordPress Plugin — Unauthenticated Local File Inclusion (CVE-2026-0926)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0926-prodigy-commerce-lfi/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0926-prodigy-commerce-lfi/High severity — web · CVE-2026-0926. Status: PoC. Affects: Prodigy Commerce (WordPress plugin). Tags: wordpress, plugin, prodigy-commerce, lfi, local-file-inclusion, unauthenticated, ajax.webHighwordpresspluginprodigy-commercelfilocal-file-inclusionunauthenticatedajaxMicrosoft Exchange Authenticated Arbitrary File Read via EWS Reference Attachment (CVE-2026-45504)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-45504-exchange-file-read/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-45504-exchange-file-read/High severity — web · CVE-2026-45504. Status: PoC. Affects: Microsoft Exchange Server (OWA / EWS). Tags: exchange, owa, ews, file-read, ssrf, ntlm, soap, lfi.webHighexchangeowaewsfile-readssrfntlmsoaplfiDolibarr selectobject.php Authenticated Local File Inclusion (CVE-2026-34036)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34036-dolibarr-selectobject-lfi/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34036-dolibarr-selectobject-lfi/Medium severity — web · CVE-2026-34036. Status: PoC. Affects: Dolibarr ERP/CRM. Tags: dolibarr, lfi, local-file-inclusion, authenticated, crm, ajax, php.webMediumdolibarrlfilocal-file-inclusionauthenticatedcrmajaxphpDiscuz! X5.0 Race Condition + CAPTCHA-Solving Pre-Auth to RCE Chain (CVE-2026-49952)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49952-discuz-race-condition-captcha-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49952-discuz-race-condition-captcha-rce/Critical severity — web · CVE-2026-49952 (chain also referenced as KIS-2026-09, KIS-2026-10, KIS-2026-11). Status: PoC. Affects: Discuz! X5.0 (PHP-based forum/CMS software). Tags: discuz, php, forum, race-condition, captcha-bypass, ocr, account-takeover, lfi, webshell, rce, pre-auth.webCriticaldiscuzphpforumrace-conditioncaptcha-bypassocraccount-takeoverlfiwebshellrcepre-authBetterDocs Pro Unauthenticated Local File Inclusion to RCE — CVE-2026-7515https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-7515-poc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-7515-poc/Critical severity (CVSS 9.8) — web · CVE-2026-7515. Status: PoC. Affects: BetterDocs Pro (WordPress plugin). Tags: wordpress, betterdocs-pro, lfi, path-traversal, log-poisoning, rce, cwe-98, admin-ajax.webCriticalwordpressbetterdocs-prolfipath-traversallog-poisoningrcecwe-98admin-ajax