Nonce — PoC Archivehttps://poc.intelseclab.com/tags/nonce/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000WavePlayer Unauthenticated Arbitrary File Upload to RCE (CVE-2025-12057)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12057-waveplayer-webshell-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12057-waveplayer-webshell-upload/Critical severity (CVSS 9.8) — web · CVE-2025-12057. Status: Weaponized. Affects: WavePlayer (WordPress plugin). Tags: wordpress, waveplayer, arbitrary-file-upload, unauthenticated, rce, webshell, ajax, nonce, php, python.webCriticalwordpresswaveplayerarbitrary-file-uploadunauthenticatedrcewebshellajaxnoncephppythonWP Captcha PRO Subscriber-to-Administrator Authentication Bypass — CVE-2026-5415https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5415-wp-captcha-pro-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5415-wp-captcha-pro-auth-bypass/High severity (CVSS 8.8) — web · CVE-2026-5415. Status: PoC. Affects: WP Captcha PRO (WordPress plugin, Advanced Google reCAPTCHA). Tags: wordpress, wp-captcha-pro, auth-bypass, privilege-escalation, nonce, ajax, account-takeover, plugin.webHighwordpresswp-captcha-proauth-bypassprivilege-escalationnonceajaxaccount-takeoverpluginSimple File List Plugin Unauthenticated File Modification / Path Traversal — CVE-2026-11912https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-11912-simple-file-list-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-11912-simple-file-list-path-traversal/High severity (CVSS 7.5) — web · CVE-2026-11912. Status: PoC. Affects: Simple File List WordPress plugin. Tags: wordpress, plugin, path-traversal, missing-authorization, unauthenticated, file-deletion, ajax, nonce.webHighwordpresspluginpath-traversalmissing-authorizationunauthenticatedfile-deletionajaxnonce