https://poc.intelseclab.com/tags/reverse-shell/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-20200-cisco-imc-argument-injection-rce/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-20200-cisco-imc-argument-injection-rce/Critical severity (CVSS 9.9) — network · CVE-2026-20200 / NSIDE-SA-2026-003. Status: Patched. Affects: Cisco Integrated Management Controller (CIMC). Tags: cisco, imc, cimc, argument-injection, rce, redfish, curl, reverse-shell, arm, file-read, file-write, CVE-2026-20200.networkCriticalciscoimccimcargument-injectionrceredfishcurlreverse-shellarmfile-readfile-writeCVE-2026-20200https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2021-22205-gitlab-exiftool-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2021-22205-gitlab-exiftool-preauth-rce/Critical severity (CVSS 10) — web · CVE-2021-22205 (chains CVE-2021-22204 in ExifTool). Status: Patched (GitLab 13.8.8, 13.9.6, 13.10.3). Affects: GitLab Community Edition and Enterprise Edition (via bundled ExifTool, invoked by GitLab Workhorse). Tags: gitlab, exiftool, djvu, rce, preauth, unauthenticated, workhorse, perl, qx, reverse-shell, metadata-injection, kev, ransomware, python, cve-2021-22205, cve-2021-22204.webCriticalgitlabexiftooldjvurcepreauthunauthenticatedworkhorseperlqxreverse-shellmetadata-injectionkevransomwarepythoncve-2021-22205cve-2021-22204https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-24893-xwiki-solrsearch-groovy-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-24893-xwiki-solrsearch-groovy-rce/Critical severity (CVSS 9.8) — web · CVE-2025-24893. Status: Weaponized. Affects: XWiki (SolrSearch macro, Main.SolrSearch). Tags: xwiki, groovy, rce, unauthenticated, cwe-94, code-injection, reverse-shell, python, wiki.webCriticalxwikigroovyrceunauthenticatedcwe-94code-injectionreverse-shellpythonwikihttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-57819-freepbx-sqli-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-57819-freepbx-sqli-rce/Critical severity (CVSS 9.8) — web · CVE-2025-57819. Status: Weaponized. Affects: Sangoma FreePBX administrator web UI (admin/ajax.php, endpoint module). Tags: freepbx, sangoma, sqli, unauthenticated, ajax-php, cron-jobs, reverse-shell, voip, asterisk, cwe-89.webCriticalfreepbxsangomasqliunauthenticatedajax-phpcron-jobsreverse-shellvoipasteriskcwe-89https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14700-crafty-controller-ssti-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-14700-crafty-controller-ssti-rce/Critical severity (CVSS 9.9) — web · CVE-2025-14700. Status: Weaponized. Affects: Crafty Controller (Minecraft server management panel). Tags: crafty-controller, minecraft, jinja2, ssti, server-side-template-injection, reverse-shell, tornado, xsrf, python, cwe-1336.webCriticalcrafty-controllerminecraftjinja2sstiserver-side-template-injectionreverse-shelltornadoxsrfpythoncwe-1336https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33824-ikev2-ikeext-double-free-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33824-ikev2-ikeext-double-free-rce/Critical severity — network · CVE-2026-33824. Status: Weaponized. Affects: Windows IKEv2 IPsec driver (ikeext.dll). Tags: ikev2, windows-kernel, double-free, ikeext, rop-chain, heap-grooming, reverse-shell, anti-debug, packet-fragmentation.networkCriticalikev2windows-kerneldouble-freeikeextrop-chainheap-groomingreverse-shellanti-debugpacket-fragmentationhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-4480-samba-spoolss-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-4480-samba-spoolss-rce/Critical severity — network · CVE-2026-4480. Status: PoC. Affects: Samba (spoolss / print spooler RPC service). Tags: samba, spoolss, smb, printer, rpc, command-injection, reverse-shell.networkCriticalsambaspoolsssmbprinterrpccommand-injectionreverse-shellhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1668-mips-switch-kernel-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1668-mips-switch-kernel-rce/Critical severity — binary · CVE-2026-1668. Status: Weaponized. Affects: MIPS-based managed switch firmware (web management HTTP server), e.g. SG2005P/SG2008/SG2016P/SG2210MP/SG2218/SG2428/SG3210/SL2428/TL-SG2428 series firmware built around 2025-10-31. Tags: mips, embedded-linux, kernel-exploit, firmware, managed-switch, reverse-shell, pre-auth, shellcode.binaryCriticalmipsembedded-linuxkernel-exploitfirmwaremanaged-switchreverse-shellpre-authshellcodehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27483-mindsdb-path-traversal-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27483-mindsdb-path-traversal-rce/Critical severity — web · CVE-2026-27483. Status: Weaponized. Affects: MindsDB (version observed: 25.9.1.0). Tags: mindsdb, path-traversal, rce, reverse-shell, unauthenticated, pip-overwrite, python.webCriticalmindsdbpath-traversalrcereverse-shellunauthenticatedpip-overwritepythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23744-mcpjam-inspector-htb-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23744-mcpjam-inspector-htb-rce/Critical severity — web · CVE-2026-23744. Status: PoC. Affects: MCPJam Inspector v1.4.2. Tags: mcpjam-inspector, mcp, command-injection, rce, curl, hack-the-box, reverse-shell, chained-privesc.webCriticalmcpjam-inspectormcpcommand-injectionrcecurlhack-the-boxreverse-shellchained-priveschttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23520-mcpjam-inspector-vhost-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23520-mcpjam-inspector-vhost-rce/Critical severity — web · CVE-2026-23520. Status: PoC. Affects: Arcane v1.13.0 (MCPJam Inspector component). Tags: mcp, mcpjam-inspector, arcane, command-injection, rce, host-header, vhost-routing, reverse-shell.webCriticalmcpmcpjam-inspectorarcanecommand-injectionrcehost-headervhost-routingreverse-shellhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40897-mathjs-sandbox-bypass-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40897-mathjs-sandbox-bypass-rce/Critical severity — web · CVE-2026-40897. Status: Weaponized. Affects: Math.js expression parser (Node.js library). Tags: mathjs, nodejs, sandbox-bypass, rce, expression-parser, prototype-pollution-adjacent, reverse-shell, javascript.webCriticalmathjsnodejssandbox-bypassrceexpression-parserprototype-pollution-adjacentreverse-shelljavascripthttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33017-langflow-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33017-langflow-rce/Critical severity — web · CVE-2026-33017. Status: PoC. Affects: Langflow (flow-building / LLM pipeline platform). Tags: langflow, rce, custom-component, code-execution, flow-builder, reverse-shell, curl.webCriticallangflowrcecustom-componentcode-executionflow-builderreverse-shellcurlhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-38526-krayin-crm-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-38526-krayin-crm-file-upload-rce/Critical severity — web · CVE-2026-38526. Status: Weaponized. Affects: Krayin CRM. Tags: krayin-crm, laravel, unrestricted-file-upload, tinymce, rce, reverse-shell, authenticated.webCriticalkrayin-crmlaravelunrestricted-file-uploadtinymcercereverse-shellauthenticatedhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3102-exiftool-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3102-exiftool-command-injection/High severity — binary · CVE-2026-3102. Status: PoC. Affects: ExifTool. Tags: exiftool, command-injection, macos, metadata, reverse-shell, tagsfromfile, perl.binaryHighexiftoolcommand-injectionmacosmetadatareverse-shelltagsfromfileperlhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3300-everest-forms-code-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3300-everest-forms-code-injection/Critical severity — web · CVE-2026-3300. Status: Weaponized (includes working reverse-shell payload builder and listener). Affects: Everest Forms Pro (WordPress plugin) — Calculation Addon. Tags: wordpress, everest-forms-pro, php-code-injection, rce, reverse-shell, form-calculation, unauthenticated.webCriticalwordpresseverest-forms-prophp-code-injectionrcereverse-shellform-calculationunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23500-dolibarr-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23500-dolibarr-command-injection/Critical severity — web · CVE-2026-23500 / GHSA-w5j3-8fcr-h87w. Status: PoC. Affects: Dolibarr ERP/CRM. Tags: dolibarr, os-command-injection, rce, authenticated, php, odt-to-pdf, reverse-shell, erp.webCriticaldolibarros-command-injectionrceauthenticatedphpodt-to-pdfreverse-shellerphttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31816-budibase-auth-bypass-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31816-budibase-auth-bypass-rce/Critical severity — web · CVE-2026-31816. Status: Weaponized. Affects: Budibase (low-code platform). Tags: budibase, auth-bypass, rce, plugin-upload, reverse-shell, low-code, python, datasource-plugin.webCriticalbudibaseauth-bypassrceplugin-uploadreverse-shelllow-codepythondatasource-pluginhttps://poc.intelseclab.com/pocs/cloud/2026-05-17_ingressnightmare-k8s-ingress-nginx-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-05-17_ingressnightmare-k8s-ingress-nginx-rce/Critical severity (CVSS 9.8) — cloud · CVE-2025-1974 (primary); also CVE-2025-1097, CVE-2025-1098, CVE-2025-24514. Status: Weaponized. Affects: Kubernetes Ingress-NGINX Controller (ingress-nginx). Tags: RCE, Kubernetes, ingress-nginx, admission-controller, unauthenticated, nginx-config-injection, cluster-takeover, k8s, shared-object, reverse-shell.cloudCriticalRCEKubernetesingress-nginxadmission-controllerunauthenticatednginx-config-injectioncluster-takeoverk8sshared-objectreverse-shellhttps://poc.intelseclab.com/pocs/network/2026-05-17_erlang-otp-ssh-preauth-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_erlang-otp-ssh-preauth-rce/Critical severity (CVSS 10) — network · CVE-2025-32433. Status: Patched. Affects: Erlang/OTP SSH server daemon. Tags: RCE, pre-auth, unauthenticated, SSH, Erlang, OTP, RabbitMQ, CouchDB, ICS, OT, reverse-shell, in-the-wild.networkCriticalRCEpre-authunauthenticatedSSHErlangOTPRabbitMQCouchDBICSOTreverse-shellin-the-wild