Twig — PoC Archivehttps://poc.intelseclab.com/tags/twig/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Shopware Twig Rendered-View Code Injection Regression (CVE-2026-23498)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23498-shopware-twig-code-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23498-shopware-twig-code-injection/High severity — web · CVE-2026-23498. Status: PoC. Affects: Shopware (shopware/shopware, shopware/core). Tags: shopware, twig, code-injection, ssti, php, cwe-94, regression, template-sandbox-bypass.webHighshopwaretwigcode-injectionsstiphpcwe-94regressiontemplate-sandbox-bypassContact Form by Supsystic <= 1.7.36 Unauthenticated SSTI to RCE (CVE-2026-4257)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4257-supsystic-contact-form-ssti-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4257-supsystic-contact-form-ssti-rce/Critical severity — web · CVE-2026-4257. Status: PoC. Affects: Contact Form by Supsystic (WordPress plugin). Tags: wordpress, contact-form-by-supsystic, ssti, twig, rce, unauthenticated, prefill.webCriticalwordpresscontact-form-by-supsysticsstitwigrceunauthenticatedprefill