https://poc.intelseclab.com/tags/privilege-escalation/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-21508-windows-mediaplayer-dll-hijack-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-21508-windows-mediaplayer-dll-hijack-lpe/High severity (CVSS 7.8) — binary · CVE-2026-21508. Status: Patched. Affects: Microsoft Windows Media Player / WUDFHost.exe. Tags: windows, dll-hijack, lpe, privilege-escalation, media-player, wudfhost, session0, com-hijack, CVE-2026-21508.binaryHighwindowsdll-hijacklpeprivilege-escalationmedia-playerwudfhostsession0com-hijackCVE-2026-21508https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-68398-ubuntu-pppol2tp-uaf-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-68398-ubuntu-pppol2tp-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2026-68398. Status: Patched. Affects: Linux Kernel (PPPoL2TP subsystem). Tags: linux, kernel, ubuntu, pppol2tp, l2tp, ppp, uaf, use-after-free, race-condition, lpe, privilege-escalation, kaslr-bypass, apparmor-bypass, suid, heap-spray, kmalloc-256, CVE-2026-68398.binaryHighlinuxkernelubuntupppol2tpl2tppppuafuse-after-freerace-conditionlpeprivilege-escalationkaslr-bypassapparmor-bypasssuidheap-spraykmalloc-256CVE-2026-68398https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-23111-nftables-catchall-uaf-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-23111-nftables-catchall-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2026-23111. Status: Patched. Affects: Linux kernel (nf_tables subsystem). Tags: linux, kernel, nftables, nf-tables, uaf, catchall, lpe, privilege-escalation, slab-spray, kaslr-bypass, rop, namespace, CVE-2026-23111.binaryHighlinuxkernelnftablesnf-tablesuafcatchalllpeprivilege-escalationslab-spraykaslr-bypassropnamespaceCVE-2026-23111https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-27912-resetnightmare-kerberos-changepw-password-reset/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-27912-resetnightmare-kerberos-changepw-password-reset/High severity (CVSS 8) — network · CVE-2026-27912. Status: Patched. Affects: Microsoft Windows Kerberos Key Distribution Center (KDC), Change Password protocol (kadmin/changepw). Tags: windows, kerberos, active-directory, privilege-escalation, password-reset, domain-controller, upn, rubeus, changepw, krbtgt, CWE-285, microsoft, CVE-2026-27912.networkHighwindowskerberosactive-directoryprivilege-escalationpassword-resetdomain-controllerupnrubeuschangepwkrbtgtCWE-285microsoftCVE-2026-27912https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/High severity (CVSS 7.8) — binary · Bypass of CVE-2026-50656 (RoguePlanet); no CVE assigned to ShieldBreak as of 2026-08-11. Status: Unpatched. Affects: Microsoft Windows Defender (Antimalware Service Executable / MsMpEng.exe), threat remediation subsystem. Tags: windows, windows-defender, lpe, privilege-escalation, 0day, patch-bypass, cloud-files, cfapi, object-manager, symlink, wer, dll-sideload, CWE-59, CWE-426, microsoft, rogueplanet, shieldbreak.binaryHighwindowswindows-defenderlpeprivilege-escalation0daypatch-bypasscloud-filescfapiobject-managersymlinkwerdll-sideloadCWE-59CWE-426microsoftrogueplanetshieldbreakhttps://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-25177-ad-spn-unicode-collision-detector/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-25177-ad-spn-unicode-collision-detector/High severity (CVSS 8.8) — network · CVE-2026-25177. Status: Patched. Affects: Microsoft Active Directory Domain Services, Service Principal Name (SPN) validation. Tags: windows, active-directory, kerberos, spn, unicode, homoglyph, privilege-escalation, detection, scanner, ldap, CWE-641, microsoft, CVE-2026-25177.networkHighwindowsactive-directorykerberosspnunicodehomoglyphprivilege-escalationdetectionscannerldapCWE-641microsoftCVE-2026-25177https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2026-16232-checkpoint-smartconsole-auth-bypass/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2026-16232-checkpoint-smartconsole-auth-bypass/Critical severity (CVSS 9.1) — network · CVE-2026-16232. Status: Patched. Affects: Check Point Security Management Server and Multi-Domain Security Management Server (MDS) — the legacy FWM/CPMI SIC service on TCP 18190 and the CPM SOAP web services on TCP 19009. Tags: check-point, smartconsole, security-management-server, multi-domain-server, cpmi, sic, fwm, authentication-bypass, CWE-287, improper-authentication, privilege-escalation, sso-token-forgery, soap, dle, cisa-kev, bod-26-04, python, firewall-management.networkCriticalcheck-pointsmartconsolesecurity-management-servermulti-domain-servercpmisicfwmauthentication-bypassCWE-287improper-authenticationprivilege-escalationsso-token-forgerysoapdlecisa-kevbod-26-04pythonfirewall-managementhttps://poc.intelseclab.com/pocs/binary/2026-08-01_notcve-2026-0010-barrier-daemon-lpe/Sat, 01 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-01_notcve-2026-0010-barrier-daemon-lpe/High severity — binary · NotCVE-2026-0010 (disputed CVE assignment — author contests the identifier). Status: Unpatched — Barrier is unmaintained with no vendor fix; patched successor Deskflow covers the same issue via CVE-2026-41477 / GHSA-6rx5-g478-775c. Affects: Barrier (debauchee), Windows service daemon barrierd.exe. Tags: barrier, barrierd, windows, ipc, tcp-24801, unauthenticated, lpe, privilege-escalation, system, cwe-306, local.binaryHighbarrierbarrierdwindowsipctcp-24801unauthenticatedlpeprivilege-escalationsystemcwe-306localhttps://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-49176-windows-walletservice-lpe/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-49176-windows-walletservice-lpe/High severity (CVSS 7.8) — binary · CVE-2026-49176. Status: Weaponized — SYSTEM shell confirmed against a real, vulnerable Windows 11 build. Affects: Windows WalletService (Windows.ApplicationModel.Wallet WinRT API, backed by an ESE/Jet Blue database under the caller's Documents\Wallet folder). Tags: windows, walletservice, lpe, privilege-escalation, ese, extensible-storage-engine, known-folder-redirection, persisted-callback, local.binaryHighwindowswalletservicelpeprivilege-escalationeseextensible-storage-engineknown-folder-redirectionpersisted-callbacklocalhttps://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54121-certighost-adcs-dc-impersonation/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54121-certighost-adcs-dc-impersonation/High severity (CVSS 8.8) — network · CVE-2026-54121. Status: Weaponized. Affects: Microsoft Active Directory Certificate Services (AD CS) Enterprise CA, in environments where AD FS / certificate enrollment resolves DC identity via "chase" (cdc/rmd) request attributes. Tags: active-directory, adcs, certificate-services, dcsync, pkinit, kerberos, privilege-escalation, domain-controller-impersonation, windows.networkHighactive-directoryadcscertificate-servicesdcsyncpkinitkerberosprivilege-escalationdomain-controller-impersonationwindowshttps://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-63030-cve-2026-60137-wp2shell-wordpress-core-preauth-rce/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-63030-cve-2026-60137-wp2shell-wordpress-core-preauth-rce/Critical severity (CVSS 9.1) — web · CVE-2026-63030 (REST /batch/v1 route confusion, CVSS 7.5), CVE-2026-60137 (author__not_in SQL injection, CVSS 9.1); GHSA-ff9f-jf42-662q, GHSA-fpp7-x2x2-2mjf. Status: Weaponized — full pre-auth RCE confirmed against stock-default WordPress core, no plugins/misconfiguration required. Affects: WordPress core (REST API /batch/v1, WP_Query::author__not_in). Tags: wordpress, wp-core, sql-injection, route-confusion, cwe-89, cwe-436, unauthenticated, remote, privilege-escalation, rce, oembed, changeset.webCriticalwordpresswp-coresql-injectionroute-confusioncwe-89cwe-436unauthenticatedremoteprivilege-escalationrceoembedchangesethttps://poc.intelseclab.com/pocs/network/2026-07-19_cve-2026-20230-cisco-ucm-ssrf-arbitrary-file-write/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-19_cve-2026-20230-cisco-ucm-ssrf-arbitrary-file-write/Critical severity (CVSS 8.6) — network · CVE-2026-20230 (cisco-sa-cucm-ssrf-cXPnHcW). Status: PoC — scanner/tester confirms the WebDialer precondition and SSRF reachability. Affects: Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) — WebDialer service. Tags: cisco, unified-communications-manager, ucm, webdialer, ssrf, cwe-918, unauthenticated, remote, privilege-escalation, kev, actively-exploited.networkCriticalciscounified-communications-managerucmwebdialerssrfcwe-918unauthenticatedremoteprivilege-escalationkevactively-exploitedhttps://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56271-flowise-hardcoded-jwt-authbypass/Sun, 12 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56271-flowise-hardcoded-jwt-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-56271 (GHSA-cc4f-hjpj-g9p8). Status: Weaponized (functional PoC forges valid admin JWTs and confirms bypass against real endpoints). Affects: Flowise — open-source low-code LLM/agent orchestration platform (enterprise edition, passport authentication middleware). Tags: flowise, ai-gateway, llm-orchestration, jwt, hardcoded-secret, authentication-bypass, cwe-321, unauthenticated, remote, privilege-escalation.webCriticalflowiseai-gatewayllm-orchestrationjwthardcoded-secretauthentication-bypasscwe-321unauthenticatedremoteprivilege-escalationhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-5947-servicefinder-bookings-cookie-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-5947-servicefinder-bookings-cookie-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2025-5947. Status: Weaponized. Affects: WordPress plugin "Service Finder Bookings" (sf-booking). Tags: wordpress, service-finder-bookings, sf-booking, authentication-bypass, cookie-forgery, privilege-escalation, cwe-639.webCriticalwordpressservice-finder-bookingssf-bookingauthentication-bypasscookie-forgeryprivilege-escalationcwe-639https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-68860-wp-jwt-admin-forge/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-68860-wp-jwt-admin-forge/Critical severity (CVSS 9.8) — web · CVE-2025-68860. Status: Weaponized. Affects: WordPress "Mobile Builder" plugin. Tags: wordpress, mobile-builder, jwt, authentication-bypass, hardcoded-secret, privilege-escalation, rest-api, python, cwe-288.webCriticalwordpressmobile-builderjwtauthentication-bypasshardcoded-secretprivilege-escalationrest-apipythoncwe-288https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12539-tnc-toolbox-cpanel-creds-exposure/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12539-tnc-toolbox-cpanel-creds-exposure/Critical severity (CVSS 10) — web · CVE-2025-12539. Status: Weaponized. Affects: TNC Toolbox: Web Performance (WordPress plugin). Tags: wordpress, tnc-toolbox, sensitive-information-exposure, unauthenticated, cpanel, credential-theft, privilege-escalation, python.webCriticalwordpresstnc-toolboxsensitive-information-exposureunauthenticatedcpanelcredential-theftprivilege-escalationpythonhttps://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-32463-sudo-chroot-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-32463-sudo-chroot-privesc/Critical severity (CVSS 9.3) — binary · CVE-2025-32463. Status: Weaponized. Affects: sudo (-R / --chroot option). Tags: sudo, chroot, privilege-escalation, nsswitch, nss-module, local-privesc, linux, shell, c.binaryCriticalsudochrootprivilege-escalationnsswitchnss-modulelocal-privesclinuxshellchttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6389-wordpress-rogue-admin-user-creation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6389-wordpress-rogue-admin-user-creation/Critical severity (CVSS 9.8) — web · CVE-2025-6389. Status: Weaponized. Affects: Sneeit Framework (WordPress theme framework plugin, sneeit-framework). Tags: wordpress, sneeit-framework, rce, call_user_func, unauthenticated, wp_insert_user, privilege-escalation, admin-takeover, cwe-94, wp-ajax-nopriv.webCriticalwordpresssneeit-frameworkrcecall_user_funcunauthenticatedwp_insert_userprivilege-escalationadmin-takeovercwe-94wp-ajax-noprivhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4334-simple-user-registration-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4334-simple-user-registration-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-4334. Status: PoC. Affects: "Simple User Registration" WordPress plugin (registration/form-builder plugin, wpr_submit_form AJAX action). Tags: wordpress, wp-plugin, simple-user-registration, privilege-escalation, unauthenticated, admin-ajax, cwe-269, python.webCriticalwordpresswp-pluginsimple-user-registrationprivilege-escalationunauthenticatedadmin-ajaxcwe-269pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-53580-sbd-password-reset-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-53580-sbd-password-reset-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-53580. Status: Weaponized. Affects: quantumcloud "Simple Business Directory Pro" WordPress plugin (simple-business-directory-pro). Tags: wordpress, wordpress-plugin, simple-business-directory-pro, password-reset, privilege-escalation, incorrect-privilege-assignment, cwe-266, account-takeover, unauthenticated, python.webCriticalwordpresswordpress-pluginsimple-business-directory-propassword-resetprivilege-escalationincorrect-privilege-assignmentcwe-266account-takeoverunauthenticatedpythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6758-realspaces-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6758-realspaces-privesc/Critical severity (CVSS 9.8) — web · CVE-2025-6758. Status: Weaponized. Affects: Real Spaces - Properties Directory Theme for WordPress (imic_agent_register AJAX handler). Tags: wordpress, real-spaces, imic, privilege-escalation, unauthenticated, admin-ajax, role-assignment, cwe-269, cwe-863, python.webCriticalwordpressreal-spacesimicprivilege-escalationunauthenticatedadmin-ajaxrole-assignmentcwe-269cwe-863pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6934-opal-estate-admin-register/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6934-opal-estate-admin-register/Critical severity (CVSS 9.8) — web · CVE-2025-6934. Status: Weaponized. Affects: Opal Estate Pro (WordPress real-estate plugin). Tags: wordpress, opal-estate-pro, privilege-escalation, unauthenticated-registration, admin-ajax, nonce-abuse, cwe-269, python.webCriticalwordpressopal-estate-proprivilege-escalationunauthenticated-registrationadmin-ajaxnonce-abusecwe-269pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-41115-grafana-scim-user-impersonation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-41115-grafana-scim-user-impersonation/Critical severity (CVSS 10) — web · CVE-2025-41115. Status: PoC. Affects: Grafana Enterprise / Grafana Cloud, SCIM provisioning component (/api/scim/v2/Users). Tags: grafana, grafana-enterprise, scim, user-impersonation, privilege-escalation, id-collision, python, docker, cwe-287.webCriticalgrafanagrafana-enterprisescimuser-impersonationprivilege-escalationid-collisionpythondockercwe-287https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13342-frontend-admin-unauth-admin-creation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13342-frontend-admin-unauth-admin-creation/Critical severity (CVSS 9.8) — web · CVE-2025-13342. Status: Weaponized. Affects: Frontend Admin by DynamiApps (WordPress plugin built on Advanced Custom Fields / ACF frontend forms). Tags: wordpress, wordpress-plugin, frontend-admin, dynamiapps, acf, advanced-custom-fields, broken-access-control, cwe-284, privilege-escalation, unauthenticated, admin-takeover, python.webCriticalwordpresswordpress-pluginfrontend-admindynamiappsacfadvanced-custom-fieldsbroken-access-controlcwe-284privilege-escalationunauthenticatedadmin-takeoverpythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14156-fox-lms-privilege-escalation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14156-fox-lms-privilege-escalation/Critical severity (CVSS 9.8) — web · CVE-2025-14156. Status: Weaponized. Affects: Fox LMS (WordPress LMS plugin). Tags: wordpress, fox-lms, rest-api, privilege-escalation, role-injection, unauthenticated, python, cwe-269.webCriticalwordpressfox-lmsrest-apiprivilege-escalationrole-injectionunauthenticatedpythoncwe-269https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11492-connectwise-automate-aitm-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11492-connectwise-automate-aitm-rce/Critical severity (CVSS 9.6) — network · CVE-2025-11492. Status: Weaponized. Affects: ConnectWise Automate (LabTech) RMM Agent. Tags: connectwise-automate, labtech, rmm, aitm, mitm, plugin-hijack, unencrypted-http, des3, privilege-escalation, python, csharp, dnspy, dotnet.networkCriticalconnectwise-automatelabtechrmmaitmmitmplugin-hijackunencrypted-httpdes3privilege-escalationpythoncsharpdnspydotnethttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11749-ai-engine-admin-account-creation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11749-ai-engine-admin-account-creation/Critical severity (CVSS 9.8) — web · CVE-2025-11749. Status: Weaponized. Affects: AI Engine plugin for WordPress (mwai). Tags: wordpress, ai-engine, mwai, mcp, rest-api, information-disclosure, privilege-escalation, admin-account-creation, python, mass-scanner.webCriticalwordpressai-enginemwaimcprest-apiinformation-disclosureprivilege-escalationadmin-account-creationpythonmass-scannerhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13486-acf-extended-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13486-acf-extended-rce/Critical severity (CVSS 9.8) — web · CVE-2025-13486. Status: Weaponized. Affects: Advanced Custom Fields: Extended (ACFE) — WordPress plugin. Tags: wordpress, acf-extended, acfe, call_user_func_array, unauthenticated-rce, privilege-escalation, admin-account-creation, python, cwe-94.webCriticalwordpressacf-extendedacfecall_user_func_arrayunauthenticated-rceprivilege-escalationadmin-account-creationpythoncwe-94https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1937-yaymail-woocommerce-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1937-yaymail-woocommerce-privesc/High severity (CVSS 7.2) — web · CVE-2026-1937. Status: Weaponized. Affects: YayMail – WooCommerce Email Customizer plugin for WordPress. Tags: wordpress, woocommerce, plugin, missing-authorization, privilege-escalation, mass-exploitation, ajax.webHighwordpresswoocommercepluginmissing-authorizationprivilege-escalationmass-exploitationajaxhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5415-wp-captcha-pro-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5415-wp-captcha-pro-auth-bypass/High severity (CVSS 8.8) — web · CVE-2026-5415. Status: PoC. Affects: WP Captcha PRO (WordPress plugin, Advanced Google reCAPTCHA). Tags: wordpress, wp-captcha-pro, auth-bypass, privilege-escalation, nonce, ajax, account-takeover, plugin.webHighwordpresswp-captcha-proauth-bypassprivilege-escalationnonceajaxaccount-takeoverpluginhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3629-wordpress-privilege-escalation/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3629-wordpress-privilege-escalation/Critical severity — web · CVE-2026-3629. Status: PoC. Affects: Import and Export Users and Customers (WordPress plugin). Tags: wordpress, privilege-escalation, plugin, import-export-users, cwe-269.webCriticalwordpressprivilege-escalationpluginimport-export-userscwe-269https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27542-woocommerce-wwlc-privesc-fileupload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27542-woocommerce-wwlc-privesc-fileupload/Critical severity (CVSS 9.8) — web · CVE-2026-27542 (bundled with CVE-2026-27540). Status: Weaponized. Affects: WooCommerce Wholesale Lead Capture (WWLC) plugin for WordPress. Tags: wordpress, woocommerce, plugin, privilege-escalation, file-upload, rce, unauthenticated, mass-scanning.webCriticalwordpresswoocommercepluginprivilege-escalationfile-uploadrceunauthenticatedmass-scanninghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54807-woocommerce-reg-admin-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54807-woocommerce-reg-admin-privesc/Info severity — web · CVE-2026-54807. Status: PoC. Affects: WordPress plugin exposing a custom WooCommerce-style frontend registration form (form fields prefixed tgwcfb_*). Tags: wordpress, woocommerce, privilege-escalation, registration-form, admin-takeover, broken-access-control.webInfowordpresswoocommerceprivilege-escalationregistration-formadmin-takeoverbroken-access-controlhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-42978-wpn-uaf-race/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-42978-wpn-uaf-race/High severity (CVSS 7.8) — binary · CVE-2026-42978. Status: PoC. Affects: Windows Push Notifications service (WpnService, wpncore.dll). Tags: windows, kernel, wpnservice, use-after-free, race-condition, toctou, privilege-escalation, etw, sysmon, patch-diffing.binaryHighwindowskernelwpnserviceuse-after-freerace-conditiontoctouprivilege-escalationetwsysmonpatch-diffinghttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-40369-windows-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-40369-windows-kernel-lpe/High severity — binary · CVE-2026-40369. Status: PoC. Affects: Windows kernel (ntoskrnl.exe). Tags: windows, kernel, lpe, privilege-escalation, token-stealing, sedebugprivilege, ntoskrnl, local.binaryHighwindowskernellpeprivilege-escalationtoken-stealingsedebugprivilegentoskrnllocalhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-26128-adcs-kerberos-relay-unicode-spn/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-26128-adcs-kerberos-relay-unicode-spn/Critical severity — network · CVE-2026-26128. Status: Weaponized. Affects: Windows Active Directory (DnsCache SPN resolution / Kerberos authentication). Tags: kerberos-relay, active-directory, adcs, unicode-normalization, spn-spoofing, ntlm-relay, dns-spoofing, privilege-escalation.networkCriticalkerberos-relayactive-directoryadcsunicode-normalizationspn-spoofingntlm-relaydns-spoofingprivilege-escalationhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20817-windows-wer-alpc-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20817-windows-wer-alpc-lpe/High severity — binary · CVE-2026-20817. Status: PoC. Affects: Windows Error Reporting Service (WerSvc). Tags: windows, wersvc, alpc, lpe, privilege-escalation, ntdll, system32, native-cpp.binaryHighwindowswersvcalpclpeprivilege-escalationntdllsystem32native-cpphttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37071-veno-file-manager-rename-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37071-veno-file-manager-rename-privesc/High severity — web · CVE-2026-37071. Status: PoC. Affects: Veno File Manager Project. Tags: file-manager, privilege-escalation, arbitrary-file-rename, php, authenticated, veno-file-manager.webHighfile-managerprivilege-escalationarbitrary-file-renamephpauthenticatedveno-file-managerhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1492-user-registration-membership-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1492-user-registration-membership-privesc/Critical severity (CVSS 9.8) — web · CVE-2026-1492. Status: Weaponized. Affects: User Registration & Membership WordPress plugin (Custom Registration Form Builder, Login Form, User Profile, Content Restriction & Membership). Tags: wordpress, privilege-escalation, unauthenticated, ajax, membership-plugin, admin-takeover, cwe-269.webCriticalwordpressprivilege-escalationunauthenticatedajaxmembership-pluginadmin-takeovercwe-269https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-0651-tapo-c260-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-0651-tapo-c260-rce/Critical severity — network · CVE-2026-0651 (chained with CVE-2026-0652, CVE-2026-0653). Status: Weaponized. Affects: TP-Link Tapo C260 IP camera (pre-patch firmware, shared /bin/main omnibus binary across models). Tags: iot, ip-camera, tp-link, tapo, path-traversal, command-injection, privilege-escalation, exploit-chain.networkCriticaliotip-cameratp-linktapopath-traversalcommand-injectionprivilege-escalationexploit-chainhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-4112-sonicwall-sma-sqli-hash-extraction/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-4112-sonicwall-sma-sqli-hash-extraction/High severity (CVSS 7.2) — network · CVE-2026-4112 (SonicWall Advisory SNWLID-2026-0003). Status: Weaponized. Affects: SonicWall SMA 8200v management console (Jetty + Struts 2, port 8443). Tags: sonicwall, sma, sql-injection, blind-sqli, privilege-escalation, load-file, hash-extraction, appliance.networkHighsonicwallsmasql-injectionblind-sqliprivilege-escalationload-filehash-extractionappliancehttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20980-samsung-android-at-command-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20980-samsung-android-at-command-lpe/Critical severity — binary · CVE-2026-20980 (chained with CVE-2026-20981 and CVE-2026-20982). Status: PoC. Affects: Samsung Android AT-command distribution stack (at_distributor / libpacm_client.so, FacAtFunction system app, ShortcutService). Tags: android, samsung, at-command, privilege-escalation, usb, system-server, exploit-chain, java, apk.binaryCriticalandroidsamsungat-commandprivilege-escalationusbsystem-serverexploit-chainjavaapkhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46490-samlify-saml-attribute-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46490-samlify-saml-attribute-injection/High severity (CVSS 8.8) — web · CVE-2026-46490 / GHSA-34r5-q4jw-r36m. Status: PoC. Affects: samlify (Node.js SAML library). Tags: saml, sso, xml-injection, privilege-escalation, samlify, cwe-91, identity-provider.webHighsamlssoxml-injectionprivilege-escalationsamlifycwe-91identity-providerhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29198-rocketchat-oauth2-nosqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29198-rocketchat-oauth2-nosqli/Critical severity — web · CVE-2026-29198. Status: PoC. Affects: Rocket.Chat (OAuth2 login flow). Tags: rocket-chat, nosqli, mongodb, oauth2, privilege-escalation, python, unauthenticated.webCriticalrocket-chatnosqlimongodboauth2privilege-escalationpythonunauthenticatedhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-2005-postgresql-pgcrypto-heapoverflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-2005-postgresql-pgcrypto-heapoverflow/Critical severity — binary · CVE-2026-2005. Status: PoC. Affects: PostgreSQL pgcrypto extension (PGP session-key parsing). Tags: postgresql, pgcrypto, heap-overflow, aslr-bypass, privilege-escalation, pgp, memory-corruption.binaryCriticalpostgresqlpgcryptoheap-overflowaslr-bypassprivilege-escalationpgpmemory-corruptionhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3437-portwell-sys-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3437-portwell-sys-lpe/High severity — binary · CVE-2026-3437. Status: PoC. Affects: Portwell Engineering Toolkits driver, portwell.sys (v4.8.2). Tags: byovd, windows-driver, kernel, lpe, physical-memory, ioctl, privilege-escalation.binaryHighbyovdwindows-driverkernellpephysical-memoryioctlprivilege-escalationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25212-percona-pmm-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25212-percona-pmm-rce/Critical severity (CVSS 9.9) — web · CVE-2026-25212. Status: PoC. Affects: Percona Monitoring and Management (PMM). Tags: rce, percona-pmm, postgresql, copy-to-program, grafana, privilege-escalation, command-execution.webCriticalrcepercona-pmmpostgresqlcopy-to-programgrafanaprivilege-escalationcommand-executionhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-14459-pardus-software-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-14459-pardus-software-lpe/High severity (CVSS 8.8) — binary · CVE-2026-14459 (also covers CVE-2026-14460). Status: Weaponized. Affects: pardus-software (Pardus Software Center). Tags: linux, pardus, privilege-escalation, polkit, pkexec, apt-injection, argument-injection, local-dos.binaryHighlinuxpardusprivilege-escalationpolkitpkexecapt-injectionargument-injectionlocal-doshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41651-packagekit-toctou-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41651-packagekit-toctou-lpe/High severity — binary · CVE-2026-41651. Status: PoC. Affects: PackageKit daemon (packagekitd). Tags: linux, packagekit, toctou, race-condition, lpe, polkit, privilege-escalation, dbus.binaryHighlinuxpackagekittoctourace-conditionlpepolkitprivilege-escalationdbushttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29000-pac4j-jwt-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29000-pac4j-jwt-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-29000. Status: Weaponized. Affects: pac4j (JWT authentication module), used in Java web applications. Tags: pac4j, jwt, jwe, auth-bypass, alg-none, jwks, privilege-escalation, java.webCriticalpac4jjwtjweauth-bypassalg-nonejwksprivilege-escalationjava