https://poc.intelseclab.com/tags/websocket/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27778-websocket-auth-bruteforce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27778-websocket-auth-bruteforce/Medium severity — web · CVE-2026-27778. Status: PoC. Affects: Generic Node.js/Express + ws WebSocket authentication server (demonstration/simulator app). Tags: websocket, brute-force, cwe-307, rate-limiting, authentication, nodejs, simulator.webMediumwebsocketbrute-forcecwe-307rate-limitingauthenticationnodejssimulatorhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4802-cockpit-logsjournal-shell-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4802-cockpit-logsjournal-shell-injection/High severity — web · CVE-2026-4802. Status: PoC. Affects: Red Hat Cockpit — the web-based Linux system administration console (cockpit-project.org), specifically pkg/systemd/logsJournal.jsx. **Not** to be confused with the headless "Cockpit CMS".. Tags: cockpit, redhat, shell-injection, command-injection, rce, websocket, systemd, journalctl.webHighcockpitredhatshell-injectioncommand-injectionrcewebsocketsystemdjournalctlhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-28466-openclaw-gateway-websocket-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-28466-openclaw-gateway-websocket-rce/Critical severity — network · CVE-2026-28466. Status: Weaponized. Affects: OpenClaw gateway. Tags: openclaw, websocket, rce, gateway, auth-bypass, node-invoke, command-injection.networkCriticalopenclawwebsocketrcegatewayauth-bypassnode-invokecommand-injectionhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5173-gitlab-websocket-graphql-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5173-gitlab-websocket-graphql-bypass/High severity — web · CVE-2026-5173. Status: PoC. Affects: GitLab CE/EE, ActionCable WebSocket endpoint (/-/cable), GraphqlChannel. Tags: gitlab, websocket, graphql, actioncable, graphqlchannel, information-disclosure, broken-access-control.webHighgitlabwebsocketgraphqlactioncablegraphqlchannelinformation-disclosurebroken-access-controlhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-websocket-upgrade-ssrf-self-hosted/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-websocket-upgrade-ssrf-self-hosted/High severity (CVSS 8.6) — web · CVE-2026-44578. Status: Weaponized. Affects: Next.js standalone router server (next start). Tags: SSRF, WebSocket, upgrade-request, Next.js, self-hosted, unauthenticated, metadata-service.webHighSSRFWebSocketupgrade-requestNext.jsself-hostedunauthenticatedmetadata-servicehttps://poc.intelseclab.com/pocs/web/2026-05-16_fortios-fortiproxy-auth-bypass-cve-2024-55591/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-16_fortios-fortiproxy-auth-bypass-cve-2024-55591/Critical severity (CVSS 9.6) — web · CVE-2024-55591 (Fortinet FG-IR-24-535). Status: Weaponized — public PoC exploit code available, listed in CISA KEV (added 2025-01-14), confirmed used in ransomware intrusions. Affects: Fortinet FortiOS/FortiProxy management interfaces. Tags: auth-bypass, websocket, race-condition, FortiOS, FortiProxy, unauthenticated, super-admin, kev, known-ransomware-use, cwe-288.webCriticalauth-bypasswebsocketrace-conditionFortiOSFortiProxyunauthenticatedsuper-adminkevknown-ransomware-usecwe-288