Unauth-Rce — PoC Archivehttps://poc.intelseclab.com/tags/unauth-rce/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Netflix Conductor Unauthenticated RCE via INLINE GraalVM Evaluator — CVE-2026-58138https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-58138-conductor-unauth-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-58138-conductor-unauth-rce/Critical severity (CVSS 9.8) — misc · CVE-2026-58138 ([VulnCheck advisory](https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators)). Status: PoC. Affects: Conductor (OSS / Orkes workflow orchestration engine), community API. Tags: conductor, orkes, graalvm, script-evaluator, host-access, workflow-engine, unauth-rce.miscCriticalconductororkesgraalvmscript-evaluatorhost-accessworkflow-engineunauth-rceJoomla Page Builder CK Unauthenticated Arbitrary File Upload RCE — CVE-2026-56290https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-56290-joomla-pagebuilderck-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-56290-joomla-pagebuilderck-rce/Critical severity (CVSS 9.8) — web · CVE-2026-56290. Status: PoC. Affects: Page Builder CK (com_pagebuilderck) — Joomla extension. Tags: joomla, page-builder-ck, com_pagebuilderck, file-upload, unauth-rce, csrf, cms.webCriticaljoomlapage-builder-ckcom_pagebuilderckfile-uploadunauth-rcecsrfcmsFeast Registry gRPC Unauthenticated RCE via dill.loads — CVE-2026-56121https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-56121-feast-unauth-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-56121-feast-unauth-rce/Critical severity (CVSS 9.8) — misc · CVE-2026-56121. Status: PoC. Affects: Feast (open-source feature store) registry gRPC server. Tags: feast, feature-store, dill, pickle, deserialization, grpc, unauth-rce, mlops.miscCriticalfeastfeature-storedillpickledeserializationgrpcunauth-rcemlopsControl Web Panel Pre-Auth Blind SQL Injection to RCE — CVE-2026-57517https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-57517-cwp-blind-sqli-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-57517-cwp-blind-sqli-rce/Critical severity (CVSS 9.8) — web · CVE-2026-57517. Status: PoC. Affects: Control Web Panel (CWP) — user panel (port 2083). Tags: control-web-panel, cwp, sqli, into-dumpfile, webshell, unauth-rce, hosting-panel.webCriticalcontrol-web-panelcwpsqliinto-dumpfilewebshellunauth-rcehosting-panelUbiquiti UniFi OS Unauthenticated RCE Chain (CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910)https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-34908-unifi-os-rce-chain/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-34908-unifi-os-rce-chain/Critical severity (CVSS 10) — network · CVE-2026-34908, CVE-2026-34909, CVE-2026-34910. Status: PoC. Affects: Ubiquiti UniFi OS Server. Tags: unauth-rce, nginx-bypass, path-traversal, command-injection, CISA-KEV, Mirai, Gaafgyt, chain, UniFi, Ubiquiti, network.networkCriticalunauth-rcenginx-bypasspath-traversalcommand-injectionCISA-KEVMiraiGaafgytchainUniFiUbiquitinetwork