Public security research archive
Curated PoCs, articles, and live CVE signals
Explore vulnerability write-ups, defender-focused blog posts, and critical alerts for WordPress, Joomla, IoT, and RCE—built for responsible research and patch validation.
Archive
57
Published PoCs
61
Blog articles
326
CVE alerts tracked
CVE Detector
NVD + Joomla VEL · WordPress, Joomla, IoT/OT, RCE · CVSS ≥ 9 · PoC badges when we have a matching write-up.
CVE-2026-109618 / CVE-2026-109619 — PHP php2shell (session.upload_progress UAF)
PHP core php2shell pair: session.upload_progress multipart timing UAF (618 trigger + 619 offset RCE). CVSS 9.2. Python stdlib PoC: check GET fingerprint + bulk JSONL; exploit smart 618 multi-path or 619 --call. Patch 8.2.35/8.3.36/8.4.27/8.5.12+.
Read write-up →Recent critical CVEs
AllLatest PoCs
View allCVE-2026-109618 / CVE-2026-109619 — PHP php2shell (session.upload_progress UAF)
PHP core php2shell pair: session.upload_progress multipart timing UAF (618 trigger + 619 offset RCE). CVSS 9.2. Python stdlib PoC: check GET fingerprint + bulk JSONL; exploit smart 618 multi-path or 619 --call. Patch 8.2.35/8.3.36/8.4.27/8.5.12+.
@admin · 10/21/2026 · 2,164 viewsCVE-2026-104736 — LearnPress ≤4.4.10 Unauthenticated PHP Object Injection (checkout-email)
LearnPress WordPress LMS ≤4.4.10: guest lp-ajax=checkout stores checkout-email in LP session → maybe_unserialize on read (CWE-502). POP/RCE if gadgets exist. Fixed 4.4.11. Python PoC: check, exploit, course discovery, CHAINS.md. CVSS 9.8 Critical unauth.
@admin · 10/18/2026 · 338 viewsCVE-2026-111823 — Mage AI OAuth Session Authentication Bypass (POST /api/sessions)
Mage OSS through 0.9.80: unknown OAuth provider on POST /api/sessions still creates session JWT from body email without token verification (CWE-390/CWE-287). Requires X-API-KEY + require_user_authentication. CVSS 3.1 9.8. Fixed 76c4f46 PR #6204. Python PoC: check, oauth-probe, exploit, bulk.
@admin · 10/17/2026 · 293 viewsBlog
View allPHP php2shell (CVE-2026-109618 / CVE-2026-109619): session.upload_progress, check vs exploit
PHP core multipart UAF pair CVSS 9.2. Emergency builds 8.2.35–8.5.12+. Inventory with GET check; armed/rce_hit only in lab. Repo murrez/php2shell.
@admin · 10/22/2026 · 90 viewsLearnPress Guest Checkout POI (CVE-2026-104736): lp-ajax checkout-email and maybe_unserialize
LearnPress WordPress LMS ≤4.4.10: unauthenticated lp-ajax=checkout stores checkout-email → LP_Helper::maybe_unserialize. CVSS 9.8. Fixed 4.4.11. WAF, upgrade, and lab validation with poc.py.
@admin · 10/22/2026 · 60 viewsHandlebars Sandbox Escape (CVE-2026-106445): constructor Own-Property and Server Preview APIs
Handlebars 4.0.0–4.7.9 with allowProtoMethodsByDefault: user templates → Function via constructor bypass. Fixed 4.7.10. Audit /render compile endpoints, not only npm audit.
@admin · 10/18/2026 · 67 views