Ssh — PoC Archivehttps://poc.intelseclab.com/tags/ssh/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000FortiOS/FortiProxy/FortiSwitchManager/FortiWeb FortiCloud SSO Authentication Bypass Detection Tool (CVE-2025-59718)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-59718-fortios-version-detection-scanner/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-59718-fortios-version-detection-scanner/Critical severity (CVSS 9.8) — network · CVE-2025-59718 (Fortinet advisory FG-IR-25-647; related: CVE-2025-59719). Status: PoC. Affects: Fortinet FortiOS, FortiProxy, FortiSwitchManager, FortiWeb. Tags: fortinet, fortios, fortiproxy, fortiswitchmanager, fortiweb, forticloud-sso, authentication-bypass, version-detection, ssh, scanner, cwe-347.networkCriticalfortinetfortiosfortiproxyfortiswitchmanagerfortiwebforticloud-ssoauthentication-bypassversion-detectionsshscannercwe-347Zyxel VMG3625-T50B Authenticated Command Injection to Root SSH Access (CVE-2026-1459)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-1459-zyxel-router-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-1459-zyxel-router-command-injection/High severity — network · CVE-2026-1459. Status: PoC. Affects: Zyxel VMG3625-T50B (and similar) router firmware. Tags: zyxel, router, firmware, command-injection, cgi-bin, ssh, authenticated, iot.networkHighzyxelrouterfirmwarecommand-injectioncgi-binsshauthenticatediotTP-Link Archer C64 Web UI Rate-Limit Bypass via Residual Debug SSH Service (CVE-2026-8697)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-8697-tplink-archer-c64-ssh-ratelimit-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-8697-tplink-archer-c64-ssh-ratelimit-bypass/Critical severity (CVSS 9.3) — network · CVE-2026-8697. Status: PoC. Affects: TP-Link Archer C64 router firmware ("TPOS"). Tags: tplink, archer-c64, router, ssh, rate-limit-bypass, authentication-oracle, brute-force, iot.networkCriticaltplinkarcher-c64routersshrate-limit-bypassauthentication-oraclebrute-forceiotTermix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22804-termix-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22804-termix-stored-xss/High severity — web · CVE-2026-22804 (GHSA-m3cv-5hgp-hv35). Status: Weaponized. Affects: Termix (Electron-based SSH/terminal manager), File Manager component (FileViewer.tsx). Tags: termix, electron, stored-xss, svg-injection, session-hijacking, lfi, file-manager, ssh.webHightermixelectronstored-xsssvg-injectionsession-hijackinglfifile-managersshCockpit Unauthenticated Remote Code Execution via SSH Argument Injection (CVE-2026-4631)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4631-cockpit-ssh-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4631-cockpit-ssh-rce/Critical severity (CVSS 9.8) — web · CVE-2026-4631 (GHSA-m4gv-x78h-3427). Status: PoC. Affects: Cockpit (Linux web-based server admin console). Tags: cockpit, ssh, command-injection, argument-injection, cwe-78, unauthenticated-rce, proxycommand.webCriticalcockpitsshcommand-injectionargument-injectioncwe-78unauthenticated-rceproxycommandlibssh2 Unchecked SSH packet_length Integer Wrap to RCE (CVE-2026-55200)https://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-55200-libssh2-packet-length-rce/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-55200-libssh2-packet-length-rce/Critical severity — network · CVE-2026-55200. Status: Weaponized. Affects: libssh2, ssh2_transport_read() in src/transport.c. Tags: libssh2, ssh, integer-overflow, heap-overflow, packet-length, transport, rce, memory-corruption, cve-2026-55200.networkCriticallibssh2sshinteger-overflowheap-overflowpacket-lengthtransportrcememory-corruptioncve-2026-55200libssh2 Publickey Subsystem List Parser Heap Corruption to Code Executionhttps://poc.intelseclab.com/pocs/network/2026-07-03_libssh2-publickey-list-parser-oob/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_libssh2-publickey-list-parser-oob/Critical severity — network · None assigned as of 2026-07-03. Status: Weaponized. Affects: libssh2, publickey subsystem list parser (src/publickey.c). Tags: libssh2, ssh, publickey-subsystem, heap-overflow, use-after-free, integer-overflow, windows, rce, memory-corruption.networkCriticallibssh2sshpublickey-subsystemheap-overflowuse-after-freeinteger-overflowwindowsrcememory-corruptionlibssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-55200-libssh2-oob-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-55200-libssh2-oob-rce/Critical severity (CVSS 9.8) — network · CVE-2026-55200. Status: PoC. Affects: libssh2 (SSH client library). Tags: RCE, OOB-write, heap-corruption, libssh2, SSH, integer-overflow, unauthenticated, C, network.networkCriticalRCEOOB-writeheap-corruptionlibssh2SSHinteger-overflowunauthenticatedCnetworkErlang/OTP SSH Pre-Auth RCE - CVE-2025-32433https://poc.intelseclab.com/pocs/network/2026-05-17_erlang-otp-ssh-preauth-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_erlang-otp-ssh-preauth-rce/Critical severity (CVSS 10) — network · CVE-2025-32433. Status: Patched. Affects: Erlang/OTP SSH server daemon. Tags: RCE, pre-auth, unauthenticated, SSH, Erlang, OTP, RabbitMQ, CouchDB, ICS, OT, reverse-shell, in-the-wild.networkCriticalRCEpre-authunauthenticatedSSHErlangOTPRabbitMQCouchDBICSOTreverse-shellin-the-wild