Remote-Code-Execution — PoC Archivehttps://poc.intelseclab.com/tags/remote-code-execution/Latest proof-of-concept entries.Hugoen-usSun, 19 Jul 2026 00:00:00 +0000LLaMA-Factory WebUI Remote Code Execution via Hardcoded `trust_remote_code` (CVE-2026-58116)https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-58116-llamafactory-trust-remote-code-rce/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-58116-llamafactory-trust-remote-code-rce/Critical severity (CVSS 9.8) — web · CVE-2026-58116. Status: Weaponized — confirmed code execution via the exact sink LLaMA-Factory reaches. Affects: LLaMA-Factory ([hiyouga/LLaMA-Factory](https://github.com/hiyouga/LLaMA-Factory)) — WebUI Chat and Training interfaces. Tags: llamafactory, llm-training, webui, trust-remote-code, huggingface, transformers, cwe-94, unauthenticated-within-webui, remote-code-execution, ai-supply-chain.webCriticalllamafactoryllm-trainingwebuitrust-remote-codehuggingfacetransformerscwe-94unauthenticated-within-webuiremote-code-executionai-supply-chainStoryChief WordPress Plugin Unauthenticated Arbitrary File Upload via Webhook (CVE-2025-7441)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Critical severity (CVSS 9.8) — web · CVE-2025-7441. Status: PoC. Affects: StoryChief WordPress plugin. Tags: storychief, wordpress, wordpress-plugin, arbitrary-file-upload, ssrf, remote-code-execution, unauthenticated, webhook, hmac, cwe-434, python.webCriticalstorychiefwordpresswordpress-pluginarbitrary-file-uploadssrfremote-code-executionunauthenticatedwebhookhmaccwe-434python