https://poc.intelseclab.com/tags/self-hosted/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-60004-gitea-diffpatch-githook-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-60004-gitea-diffpatch-githook-rce/High severity (CVSS 8.8) — web · CVE-2026-60004. Status: Patched. Affects: Gitea (self-hosted Git service), diffpatch API endpoint, Git three-way merge fallback. Tags: gitea, git, diffpatch, git-hook, post-index-change, three-way-merge, bare-repository, CWE-94, authenticated-rce, self-hosted, code-hosting.webHighgiteagitdiffpatchgit-hookpost-index-changethree-way-mergebare-repositoryCWE-94authenticated-rceself-hostedcode-hostinghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26012-vaultwarden-collection-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26012-vaultwarden-collection-bypass/Medium severity (CVSS 6.5) — web · CVE-2026-26012 (GHSA-h265-g7rm-h337). Status: PoC. Affects: Vaultwarden (unofficial Bitwarden-compatible server). Tags: vaultwarden, bitwarden, password-manager, idor, access-control-bypass, api, cipher-enumeration, self-hosted.webMediumvaultwardenbitwardenpassword-manageridoraccess-control-bypassapicipher-enumerationself-hostedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35037-ech0-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35037-ech0-ssrf/High severity — web · CVE-2026-35037. Status: PoC. Affects: lin-snow/Ech0. Tags: ssrf, ech0, unauthenticated, self-hosted, cwe-918, nuclei-template.webHighssrfech0unauthenticatedself-hostedcwe-918nuclei-templatehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27626-olivetin-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27626-olivetin-command-injection/Critical severity (CVSS 9.9) — web · CVE-2026-27626 / GHSA-49gm-hh7w-wfvf. Status: PoC. Affects: OliveTin (self-hosted web UI for exposing predefined shell commands). Tags: command-injection, olivetin, rce, webhook, shell-mode, cwe-78, self-hosted.webCriticalcommand-injectionolivetinrcewebhookshell-modecwe-78self-hostedhttps://poc.intelseclab.com/pocs/web/2026-07-03_gogs-admin-csrf-git-hook-rce/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_gogs-admin-csrf-git-hook-rce/Critical severity — web · None assigned as of 2026-07-03. Status: Weaponized. Affects: Gogs (self-hosted Git service). Tags: gogs, csrf, git-hooks, privilege-escalation, rce, admin-takeover, git, self-hosted.webCriticalgogscsrfgit-hooksprivilege-escalationrceadmin-takeovergitself-hostedhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-websocket-upgrade-ssrf-self-hosted/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-websocket-upgrade-ssrf-self-hosted/High severity (CVSS 8.6) — web · CVE-2026-44578. Status: Weaponized. Affects: Next.js standalone router server (next start). Tags: SSRF, WebSocket, upgrade-request, Next.js, self-hosted, unauthenticated, metadata-service.webHighSSRFWebSocketupgrade-requestNext.jsself-hostedunauthenticatedmetadata-servicehttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-image-optimization-api-oom-dos-self-hosted/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-image-optimization-api-oom-dos-self-hosted/Medium severity (CVSS 5.9) — web · CVE-2026-44577. Status: Weaponized. Affects: Next.js Image Optimization API (/_next/image) on self-hosted deployments. Tags: DoS, OOM, image-optimizer, Next.js, self-hosted, unauthenticated.webMediumDoSOOMimage-optimizerNext.jsself-hostedunauthenticated