https://poc.intelseclab.com/tags/nuclei/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-6440. Status: Weaponized. Affects: WordPress WooCommerce Dynamic Pricing & Discounts plugin (wc-designer-pro). Tags: wordpress, woocommerce, wc-designer-pro, dynamic-pricing, file-upload, rce, unauthenticated, wp-ajax, cwe-434, nuclei.webCriticalwordpresswoocommercewc-designer-prodynamic-pricingfile-uploadrceunauthenticatedwp-ajaxcwe-434nucleihttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-13315-twonky-server-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-13315-twonky-server-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-13315. Status: PoC. Affects: Twonky Server (Lynx Technology), a DLNA/UPnP media server. Tags: twonky-server, dlna, upnp, media-server, auth-bypass, access-control, information-disclosure, credential-leak, cwe-284, unauthenticated, nuclei.networkCriticaltwonky-serverdlnaupnpmedia-serverauth-bypassaccess-controlinformation-disclosurecredential-leakcwe-284unauthenticatednucleihttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-34299-monsta-ftp-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-34299-monsta-ftp-rce/Critical severity (CVSS 9.8) — network · CVE-2025-34299. Status: Weaponized. Affects: Monsta FTP (web-based FTP manager). Tags: monsta-ftp, rce, pre-auth, unrestricted-file-upload, cwe-434, php, ftp, docker, nuclei, kev.networkCriticalmonsta-ftprcepre-authunrestricted-file-uploadcwe-434phpftpdockernucleikevhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-66039-freepbx-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-66039-freepbx-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-66039. Status: PoC. Affects: FreePBX (Sangoma) framework module — web-based administration panel for Asterisk-based VoIP/PBX systems. Tags: freepbx, sangoma, voip, telephony, authentication-bypass, access-control, authtype, webserver-auth, cwe-287, cwe-863, nuclei, version-fingerprinting.networkCriticalfreepbxsangomavoiptelephonyauthentication-bypassaccess-controlauthtypewebserver-authcwe-287cwe-863nucleiversion-fingerprintinghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41462-projeqtor-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41462-projeqtor-sqli/Critical severity (CVSS 9.8) — web · CVE-2026-41462. Status: Weaponized. Affects: ProjeQtor project management tool. Tags: projeqtor, sqli, unauthenticated, login-bypass, stacked-queries, admin-creation, nuclei.webCriticalprojeqtorsqliunauthenticatedlogin-bypassstacked-queriesadmin-creationnucleihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4350-perfmatters-file-deletion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4350-perfmatters-file-deletion/High severity (CVSS 8.1) — web · CVE-2026-4350. Status: PoC. Affects: Perfmatters WordPress plugin. Tags: wordpress, plugin, perfmatters, path-traversal, arbitrary-file-deletion, admin-ajax, dos, nuclei.webHighwordpresspluginperfmatterspath-traversalarbitrary-file-deletionadmin-ajaxdosnucleihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42589-gotenberg-exiftool-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42589-gotenberg-exiftool-rce/Critical severity (CVSS 9.8) — web · CVE-2026-42589. Status: PoC. Affects: Gotenberg (document/PDF conversion microservice). Tags: gotenberg, exiftool, command-injection, cwe-78, unauthenticated, rce, docker-lab, nuclei.webCriticalgotenbergexiftoolcommand-injectioncwe-78unauthenticatedrcedocker-labnuclei