https://poc.intelseclab.com/tags/missing-authorization/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1937-yaymail-woocommerce-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1937-yaymail-woocommerce-privesc/High severity (CVSS 7.2) — web · CVE-2026-1937. Status: Weaponized. Affects: YayMail – WooCommerce Email Customizer plugin for WordPress. Tags: wordpress, woocommerce, plugin, missing-authorization, privilege-escalation, mass-exploitation, ajax.webHighwordpresswoocommercepluginmissing-authorizationprivilege-escalationmass-exploitationajaxhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44595-yamcs-iam-user-enumeration/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44595-yamcs-iam-user-enumeration/Medium severity (CVSS 4.3) — web · CVE-2026-44595 / GHSA-p2rj-mrmc-9w29. Status: PoC. Affects: yamcs-core (YAMCS mission control software). Tags: yamcs, iam, missing-authorization, user-enumeration, broken-access-control, api.webMediumyamcsiammissing-authorizationuser-enumerationbroken-access-controlapihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33137-xwiki-xar-import-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33137-xwiki-xar-import-rce/Critical severity (CVSS 9.3) — web · CVE-2026-33137. Status: Weaponized. Affects: XWiki Platform. Tags: xwiki, rce, missing-authorization, xar-import, groovy, velocity, unauthenticated, cwe-862.webCriticalxwikircemissing-authorizationxar-importgroovyvelocityunauthenticatedcwe-862https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4106-htmega-wordpress-pii-disclosure/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4106-htmega-wordpress-pii-disclosure/High severity — web · CVE-2026-4106. Status: Weaponized. Affects: HT Mega – Absolute Addons for Elementor (WordPress plugin). Tags: wordpress, elementor, ht-mega, wp-ajax, pii-disclosure, missing-authorization, mass-scanner, plugin-vulnerability.webHighwordpresselementorht-megawp-ajaxpii-disclosuremissing-authorizationmass-scannerplugin-vulnerabilityhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39676-wordpress-download-manager-idor/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39676-wordpress-download-manager-idor/Medium severity — web · CVE-2026-39676. Status: PoC. Affects: Download Manager plugin for WordPress. Tags: wordpress, wordpress-plugin, idor, missing-authorization, unauthenticated, download-manager.webMediumwordpresswordpress-pluginidormissing-authorizationunauthenticateddownload-managerhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6145-user-registration-wp-admin-approval-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6145-user-registration-wp-admin-approval-bypass/Medium severity (CVSS 5.3) — web · CVE-2026-6145. Status: Weaponized. Affects: User Registration & Membership for WordPress plugin. Tags: wordpress, missing-authorization, admin-approval-bypass, user-registration, cwe-862.webMediumwordpressmissing-authorizationadmin-approval-bypassuser-registrationcwe-862https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-11912-simple-file-list-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-11912-simple-file-list-path-traversal/High severity (CVSS 7.5) — web · CVE-2026-11912. Status: PoC. Affects: Simple File List WordPress plugin. Tags: wordpress, plugin, path-traversal, missing-authorization, unauthenticated, file-deletion, ajax, nonce.webHighwordpresspluginpath-traversalmissing-authorizationunauthenticatedfile-deletionajaxnoncehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49048-joomcck-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49048-joomcck-sqli/Critical severity (CVSS 8.7) — web · CVE-2026-49048 (Advisory ID JOOMCCK-2026-001). Status: PoC. Affects: JoomCCK (com_joomcck) — Content Construction Kit extension for Joomla, by JoomCoder. Tags: joomla, joomcck, com_joomcck, sql-injection, cwe-89, missing-authorization, cwe-862, unauthenticated, blind-sqli, union-based.webCriticaljoomlajoomcckcom_joomccksql-injectioncwe-89missing-authorizationcwe-862unauthenticatedblind-sqliunion-basedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30950-autogpt-session-idor/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30950-autogpt-session-idor/High severity (CVSS 7.1) — web · CVE-2026-30950 (GHSA-q58p-v9r9-7gqj). Status: PoC. Affects: AutoGPT Platform (autogpt-platform-backend, chat/copilot feature). Tags: autogpt, idor, cwe-862, session-hijack, missing-authorization, python, fastapi, redis.webHighautogptidorcwe-862session-hijackmissing-authorizationpythonfastapiredis