Route-Confusion — PoC Archivehttps://poc.intelseclab.com/tags/route-confusion/Latest proof-of-concept entries.Hugoen-usSun, 19 Jul 2026 00:00:00 +0000wp2shell — WordPress Core Pre-Auth SQLi → Row Forgery → Admin Creation → RCE (CVE-2026-63030 + CVE-2026-60137)https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-63030-cve-2026-60137-wp2shell-wordpress-core-preauth-rce/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-63030-cve-2026-60137-wp2shell-wordpress-core-preauth-rce/Critical severity (CVSS 9.1) — web · CVE-2026-63030 (REST /batch/v1 route confusion, CVSS 7.5), CVE-2026-60137 (author__not_in SQL injection, CVSS 9.1); GHSA-ff9f-jf42-662q, GHSA-fpp7-x2x2-2mjf. Status: Weaponized — full pre-auth RCE confirmed against stock-default WordPress core, no plugins/misconfiguration required. Affects: WordPress core (REST API /batch/v1, WP_Query::author__not_in). Tags: wordpress, wp-core, sql-injection, route-confusion, cwe-89, cwe-436, unauthenticated, remote, privilege-escalation, rce, oembed, changeset.webCriticalwordpresswp-coresql-injectionroute-confusioncwe-89cwe-436unauthenticatedremoteprivilege-escalationrceoembedchangesetLiteLLM Proxy Unauthenticated Auth Bypass via Host-Header Route Confusion (CVE-2026-49468)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49468-litellm-host-header-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49468-litellm-host-header-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-49468. Status: PoC. Affects: LiteLLM (BerriAI) proxy. Tags: litellm, llm-proxy, auth-bypass, host-header, route-confusion, cwe-290, fastapi, starlette, python.webCriticallitellmllm-proxyauth-bypasshost-headerroute-confusioncwe-290fastapistarlettepythonDiscourse Scoped API Key Pre-Route Authorization Bypasshttps://poc.intelseclab.com/pocs/web/2026-07-03_discourse-scoped-api-key-route-bypass/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_discourse-scoped-api-key-route-bypass/High severity — web · None assigned as of 2026-07-03. Status: PoC. Affects: Discourse (forum platform). Tags: discourse, authorization-bypass, api-key-scope, rails, middleware, privilege-escalation, route-confusion.webHighdiscourseauthorization-bypassapi-key-scoperailsmiddlewareprivilege-escalationroute-confusion