https://poc.intelseclab.com/tags/ransomware/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2025-61882-oracle-ebs-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2025-61882-oracle-ebs-preauth-rce/Critical severity (CVSS 9.8) — web · CVE-2025-61882 (Oracle Security Alert, out-of-band, October 2025). Status: Patched (Oracle out-of-band Security Alert, October 2025). Affects: Oracle E-Business Suite — Oracle Concurrent Processing product, BI Publisher Integration component (reached via the /OA_HTML/ web tier: configurator/UiServlet and ieshostedsurvey.jsp). Tags: oracle-ebs, oracle-concurrent-processing, bi-publisher-integration, pre-auth, rce, ssrf, crlf-injection, request-smuggling, path-traversal, auth-bypass, xslt, java, cisa-kev, ransomware, cl0p, watchtowr.webCriticaloracle-ebsoracle-concurrent-processingbi-publisher-integrationpre-authrcessrfcrlf-injectionrequest-smugglingpath-traversalauth-bypassxsltjavacisa-kevransomwarecl0pwatchtowrhttps://poc.intelseclab.com/pocs/network/2026-08-09_cve-2023-35078-ivanti-epmm-unauth-api-access/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2023-35078-ivanti-epmm-unauth-api-access/Critical severity (CVSS 9.8) — network · CVE-2023-35078 (Ivanti advisory; CWE-287 per NVD). Status: Patched (Ivanti EPMM 11.8.1.1, 11.9.1.1, 11.10.0.2 and later). Affects: Ivanti Endpoint Manager Mobile (EPMM), previously branded MobileIron Core — the /mifs/aad/api/ administrative API surface. Tags: ivanti, epmm, mobileiron-core, mdm, authentication-bypass, cwe-287, unauthenticated, api, pii-disclosure, cisa-kev, ransomware, scanner.networkCriticalivantiepmmmobileiron-coremdmauthentication-bypasscwe-287unauthenticatedapipii-disclosurecisa-kevransomwarescannerhttps://poc.intelseclab.com/pocs/network/2026-08-09_cve-2025-22457-ivanti-connect-secure-stack-overflow/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-09_cve-2025-22457-ivanti-connect-secure-stack-overflow/Critical severity (CVSS 9) — network · CVE-2025-22457. Status: Patched. Affects: Ivanti Connect Secure, Pulse Connect Secure (end of support), Ivanti Policy Secure, Ivanti ZTA Gateways — the /home/bin/web HTTPS front-end process. Tags: ivanti, connect-secure, pulse-connect-secure, policy-secure, zta-gateway, vpn, stack-overflow, CWE-121, buffer-overflow, rce, unauthenticated, rop, heap-spray, aslr-bruteforce, x-forwarded-for, cisa-kev, ransomware, ruby, edge-device.networkCriticalivanticonnect-securepulse-connect-securepolicy-securezta-gatewayvpnstack-overflowCWE-121buffer-overflowrceunauthenticatedropheap-sprayaslr-bruteforcex-forwarded-forcisa-kevransomwarerubyedge-devicehttps://poc.intelseclab.com/pocs/web/2026-08-09_cve-2021-22205-gitlab-exiftool-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2021-22205-gitlab-exiftool-preauth-rce/Critical severity (CVSS 10) — web · CVE-2021-22205 (chains CVE-2021-22204 in ExifTool). Status: Patched (GitLab 13.8.8, 13.9.6, 13.10.3). Affects: GitLab Community Edition and Enterprise Edition (via bundled ExifTool, invoked by GitLab Workhorse). Tags: gitlab, exiftool, djvu, rce, preauth, unauthenticated, workhorse, perl, qx, reverse-shell, metadata-injection, kev, ransomware, python, cve-2021-22205, cve-2021-22204.webCriticalgitlabexiftooldjvurcepreauthunauthenticatedworkhorseperlqxreverse-shellmetadata-injectionkevransomwarepythoncve-2021-22205cve-2021-22204https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2024-51378-cyberpanel-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2024-51378-cyberpanel-preauth-rce/Critical severity (CVSS 10) — web · CVE-2024-51378. Status: Patched (commit 1c0c6cb; CyberPanel 2.3.8 and later). Affects: CyberPanel (aka Cyber Panel), by CyberPersons — Django-based hosting control panel. Tags: cyberpanel, rce, command-injection, preauth, unauthenticated, options-method, secmiddleware-bypass, statusfile, kev, ransomware, psaux, python, httpx, cve-2024-51378.webCriticalcyberpanelrcecommand-injectionpreauthunauthenticatedoptions-methodsecmiddleware-bypassstatusfilekevransomwarepsauxpythonhttpxcve-2024-51378https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-48558-simplehelp-oidc-auth-bypass/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-48558-simplehelp-oidc-auth-bypass/Critical severity (CVSS 10) — web · CVE-2026-48558. Status: Weaponized — forges valid privileged sessions with no credentials. Affects: SimpleHelp — remote support / RMM (remote monitoring and management) platform, OIDC authentication flow. Tags: simplehelp, rmm, oidc, jwt, alg-none, cwe-347, authentication-bypass, unauthenticated, remote, kev, actively-exploited, ransomware.webCriticalsimplehelprmmoidcjwtalg-nonecwe-347authentication-bypassunauthenticatedremotekevactively-exploitedransomwarehttps://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-35616-forticlient-ems-auth-bypass/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-35616-forticlient-ems-auth-bypass/Critical severity (CVSS 9.1) — network · CVE-2026-35616. Status: Weaponized. Affects: Fortinet FortiClient Endpoint Management Server (EMS). Tags: authentication-bypass, header-spoofing, Fortinet, FortiClient-EMS, FortiBleed, credential-theft, CISA-KEV, active-exploitation, ransomware.networkCriticalauthentication-bypassheader-spoofingFortinetFortiClient-EMSFortiBleedcredential-theftCISA-KEVactive-exploitationransomwarehttps://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-50751-checkpoint-ikev1-bypass/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-50751-checkpoint-ikev1-bypass/Critical severity (CVSS 9.3) — network · CVE-2026-50751. Status: PoC. Affects: Check Point Remote Access VPN / Mobile Access / Spark Firewall. Tags: auth-bypass, VPN, IKEv1, Check-Point, Remote-Access, certificate-bypass, Qilin, ransomware, CISA-KEV, unauthenticated.networkCriticalauth-bypassVPNIKEv1Check-PointRemote-Accesscertificate-bypassQilinransomwareCISA-KEVunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-05-17_toolshell-sharepoint-chain/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_toolshell-sharepoint-chain/Critical severity — web · CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706. Status: Weaponized. Affects: Microsoft SharePoint Server. Tags: RCE, SharePoint, unauthenticated, deserialization, auth-bypass, APT27, APT31, ransomware, Windows, IIS.webCriticalRCESharePointunauthenticateddeserializationauth-bypassAPT27APT31ransomwareWindowsIIShttps://poc.intelseclab.com/pocs/binary/2026-05-17_linux-nftables-uaf-lpe/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_linux-nftables-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2024-1086. Status: Weaponized. Affects: Linux kernel (netfilter nf_tables subsystem). Tags: LPE, UAF, Linux kernel, nf_tables, netfilter, CISA KEV, ransomware, x64.binaryHighLPEUAFLinux kernelnf_tablesnetfilterCISA KEVransomwarex64https://poc.intelseclab.com/pocs/web/2026-05-17_confluence-ssti-rce-cve-2023-22527/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_confluence-ssti-rce-cve-2023-22527/Critical severity (CVSS 10) — web · CVE-2023-22527. Status: Weaponized. Affects: Atlassian Confluence Data Center and Confluence Server. Tags: RCE, Confluence, SSTI, Freemarker, OGNL, unauthenticated, Java, Atlassian, ransomware.webCriticalRCEConfluenceSSTIFreemarkerOGNLunauthenticatedJavaAtlassianransomwarehttps://poc.intelseclab.com/pocs/network/2026-05-16_vmware-esxi-ad-auth-bypass/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-16_vmware-esxi-ad-auth-bypass/Medium severity (CVSS 6.8) — network · CVE-2024-37085. Status: Weaponized. Affects: VMware ESXi hosts joined to Microsoft Active Directory. Tags: auth-bypass, Active Directory, ESXi, vCenter, ransomware, unauthenticated-esxi.networkMediumauth-bypassActive DirectoryESXivCenterransomwareunauthenticated-esxi