PoC archive: CVE & exploit write-ups

PHP core php2shell pair: session.upload_progress multipart timing UAF (618 trigger + 619 offset RCE). CVSS 9.2. Python stdlib PoC: check GET fingerprint + bulk JSONL; exploit smart 618 multi-path or 619 --call. Patch 8.2.35/8.3.36/8.4.27/8.5.12+.

LearnPress WordPress LMS ≤4.4.10: guest lp-ajax=checkout stores checkout-email in LP session → maybe_unserialize on read (CWE-502). POP/RCE if gadgets exist. Fixed 4.4.11. Python PoC: check, exploit, course discovery, CHAINS.md. CVSS 9.8 Critical unauth.

Mage OSS through 0.9.80: unknown OAuth provider on POST /api/sessions still creates session JWT from body email without token verification (CWE-390/CWE-287). Requires X-API-KEY + require_user_authentication. CVSS 3.1 9.8. Fixed 76c4f46 PR #6204. Python PoC: check, oauth-probe, exploit, bulk.

Theme My Login ≤7.2.1 on WordPress multisite with network tml_user_passwords: lost-password retrieve_password() path applies attacker user_pass1 via tml_ms_filter_pre_insert_user_data → wp_update_user (CWE-269). CVSS 3.1 9.8. Not version-only. Python PoC: check, verify, exploit, bulk. Fixed 7.2.2.

Telegram Desktop through 7.2.8 (Windows): tg:// URI record-separator injection in single-instance IPC → legacy file path can exfil local files (session/tdata risk) after user opens crafted link. Not classic OS RCE. Fixed 7.2.9. Node.js 18+ research PoC (00nx): craft, lab server, npm test. Authorized lab only.

Tyche Abandoned Cart Pro ≤10.8.0: recovery checkout_link uses AES-CTR without mandatory HMAC when wcap_nonce omitted; CTR malleability swaps abandoned cart ID → wp_set_auth_cookie victim (CWE-639). CVSS 3.1 9.8 Critical. Python PoC: check, forge, exploit. Marker POCBIT-97657-OK.

Splunk Enterprise 10.2.0–10.2.6 and 10.4.0–10.4.2 on SHC members: PostgreSQL sidecar Patroni REST (typ. :8008) accepts unauth PATCH /config + POST /restart → archive_command OS exec (CWE-306). SVD-2026-1001. CVSS 3.1 9.8 Critical. Fixed 10.2.7 / 10.4.3. Python PoC: check/exploit, OOB POCBIT-76268-OK.

OrdaSoft OS CCK com_os_cck 1.0.0–8.3.15: public listing sort order_field/order_direction appended to SQL ORDER BY without column allow-list (CWE-89). Unauth error-based extract, check + mass exploit. CVSS 4.0 9.3 Critical. Fixed 8.3.16+ (same as CVE-2026-102427). Marker POCBIT-102428-OK.

handlebars 4.0.0–4.7.9: lookupProperty own-property order bypasses proto deny list → Function.prototype.constructor → sandbox escape when allowProtoMethodsByDefault:true and attacker-controlled compile (CWE-184/CWE-1289). CVSS 4.0 9.2 Critical AT:P. Fixed 4.7.10 GHSA-p8wg-vrv2-v86f. Python PoC: check/exploit, Docker lab, --render-path. Marker POCBIT-106445-OK.

0xJacky/nginx-ui >=2.3.8 <2.5.0: admin JWT can download backup, tamper app.ini TestConfigCmd in re-signed zip, POST /api/restore + /api/nginx/test → shell (CWE-94). CVSS 4.0 9.4 Critical PR:H. Not CVE-2026-42238. Fixed 2.5.0. Python PoC: check/exploit, batch url|JWT. Marker POCBIT-107806-OK.

Atlassian DC/self-managed (Jira, Confluence, Bitbucket, etc.): atlassian-plugins-webresource unescapeSlashes converts :: to / — ..:: traversal on /download/resources/ reads files under web app root (WEB-INF/web.xml, crowd.properties). CVSS 4.0 9.3 Critical, unauthenticated, read-only not RCE. Python PoC: check/exploit, --grab-crowd, mass -j. Marker POCBIT-21589-OK.

Payload CMS + @payloadcms/plugin-import-export ≥3.0.0 <3.88.0: POST /api/exports/export-preview fields __proto__.overrideAccess pollutes Object.prototype via getSelect() → overrideAccess on later REST ops, unauthenticated data leak (app-dependent RCE). CWE-1321, CVSS 4.0 9.3 Critical. Fixed 3.88.0 / 4.0.0-canary.27. Python PoC: check/exploit/mass -j, hits.txt & exploited.txt.

OrdaSoft Simple Membership (com_simplemembership) <7.4.0: task=checkLoginPass embeds unfiltered login param in SQL — unauthenticated error-based extractvalue leak (CWE-89). CVSS 4.0 9.3 Critical. Fixed 7.4.0+. Python PoC: check/exploit/mass -j, hits.txt & exploited.txt, optional --subquery. Marker POCBIT-102782-OK.

smarty-php/smarty <4.5.8 and 5.0.0–5.8.4: extends/inheritance + cache regen with null nocache_hash lets forged assign() data inject SmartyNocache markers into cache PHP → include() RCE. CWE-94, CVSS 4.0 9.2 Critical (AT:P). Fixed 4.5.8 / 5.8.5. Python PoC: check/exploit/payload, Docker lab 5.8.4, hits.txt & exploited.txt. Marker POCBIT-82531-OK.

DiviEngine Divi Membership ≤2.3.0: process_paypal_callback on init trusts base64 paypal_param GET without PayPal/IPN validation → wp_set_current_user + wp_set_auth_cookie as arbitrary user ID (incl. admin). PayPal gateway class loads even when disabled. CVSS 9.8 Critical (CWE-287). Python PoC: check/exploit, cookie export, mass scan.

WordPress DevKit Pro (dplugins) ≤2.3.0: forged original_user_id cookie + wp_footer revert_switch nonce; verify_nonce_and_capability checks manage_options for forged user, not current requester → wp_set_auth_cookie admin session. CVSS 9.8 Critical (CWE-287). Fixed 3.0.0+. Python PoC: check (footer oracle), admin exploit, mass scan 50 threads.

WordPress core 4.7.0–7.1.1: pagename from POST used in get_page_template() without validate_file(); page-templates/ traversal + PEAR gadget → RCE. GHSA-7hp8-65ch-5whp, CVSS 4.0 9.8, CWE-22. Fixed 7.1.2+ (backports 6.8.10, 7.0.6). Python mass scanner: --check, --rce, --shell. Upstream: MRdark-ops/CVE-2026-87902 (HackfutSecRoot).

LatePoint appointment booking ≤5.7.0: unauthenticated guest booking stores [shortcode] in customer first/last name (sanitize_text_field keeps brackets); Customer Cabinet block renders welcome line then the_content do_shortcode runs twice → arbitrary shortcode execution. CVSS 9.1 Critical (CWE-94). Fixed in 5.7.1. No API key. Python PoC: check, mass exploit, --lab, optional POCBIT_EXEC_SHORTCODE. Marker POCBIT-92966-OK.

SiteSkite WordPress plugin ≤2.1.8: long-lived API key acts as unauthenticated admin bearer via ?token= autologin; REST/admin-ajax MCP abilities run siteskite_execute_php (eval) and file write. CVSS 10.0 Critical (CWE-94). Fixed in 2.2.0. Python PoC: check (readme ≤2.1.8), exploit with API key, mass hits/exploited, --lab. Marker POCBIT-96349-OK.

OrdaSoft OS CCK for Joomla 1.0.0–8.3.15: unauthenticated front-end task getContent reaches site/uploader.php — GIF/PHP polyglot passes magic-byte check while .php extension from attacker filename is written under web root (CWE-434). CVSS 4.0 10.0 Critical (AT:N). Fixed in 8.3.16+. Python PoC: check, exploit (POCBIT-102427-OK), mass + interactive.

Joomcode JCTables 1.0.0–1.20.0: unauthenticated front-end JSON tasks (getdatarow, getrow) concatenate table/column names into SQL with broken escaping — arbitrary DB read/write (CWE-89/CWE-862). CVSS 4.0 10.0 Critical (AT:N). Fixed in 1.21.1+. Python PoC proves user row read (POCBIT-76570-OK); check + exploit + mass -j.

Balbooa Forms for Joomla 1.0.0–2.4.3.3: when a public form runs PHP-after-submission via eval(), field shortcodes are replaced with raw visitor input inside double-quoted PHP — classic ";breakout;// → RCE. CVSS 4.0 9.5 Critical (AT:P). Fixed in 2.4.3.4. Not CVE-2026-67364. Python PoC: version + public form detect, check/exploit, up.php drop, interactive + mass -j.

Google Merchant Center Feed (gmfeed) for PrestaShop ≤2.3.9: unauthenticated arbitrary file write on modules/gmfeed/feed.php when Save-to-file / URL export is enabled — attacker controls filename, path, extension, and body → PHP webshell → RCE. CVSS 9.3 Critical. Fixed in 2.3.10+ (2.4.1+ recommended). Python PoC: check, aggressive probe, exploit with marker stub, mass --list -j.

Hitachi Energy RTU500 Series CMU firmware: CWE-306 missing authentication on the firmware update HTTP endpoint — unauthenticated arbitrary firmware upload via crafted POST (CVSS 3.1 9.1 Critical, IoT/OT). Affected CMU lines include 9.0 and 12.0 per vendor advisory. Python PoC: RTU500 fingerprint, path probe, lab-safe upload test, check + mass exploit -j. Authorized OT/lab only.

Node.js @xhmikosr/decompress (and unmaintained decompress): read/write outside output dir via chained symlink archive entries — bypass of CVE-2026-53486 hardening. Fixed in 10.2.2 / 11.1.4; kevva decompress ≤4.2.1 unpatched. CVSS 3.1 9.1 Critical. Python PoC: --lab, lockfile check, evil.tar upload exploit, mass -j.

OrdaSoft Book Library (Free) for Joomla ≤ 6.4.6: unauthenticated SQL injection (CWE-89) in books() via field/direction sort params — weak select substring blacklist + protectInjectionWithoutQuote, unquoted ORDER BY, session prime + `-- xselect` bypass (com_booklibrary). Fixed in 6.4.7+. CVSS 4.0 9.3 Critical. Python PoC: check, exploit, mass -j.

OrdaSoft Vehicle Manager (Free) for Joomla ≤ 6.5.7: unauthenticated SQL injection (CWE-89) via order_field and order_direction concatenated into unquoted ORDER BY in site/vehiclemanager.php (com_vehiclemanager). Escaping is ineffective for sort keys. Public category, search, and all-vehicles views. Fixed in 6.5.8+. CVSS 4.0 9.3 Critical. Python PoC: check, error-based exploit, mass -j.

OrdaSoft Real Estate Manager (Free) for Joomla ≤ 6.7.8: unauthenticated SQL injection (CWE-89) via order_field concatenated into ORDER BY in site/realestatemanager.php (com_realestatemanager). Public category, search, and listing views — no auth. Fixed in 6.7.9+. Python PoC: fingerprint, check, error-based exploit, mass -j; legacy order_direction POST fallback.

Incorrect authorization (CWE-863) in vm2 npm before 3.12.2: NodeVM external allowlist and resolver path checks allow colliding package names (evil-left-pad) or prefix path tricks → host-context require and sandbox escape / host RCE when embedders run untrusted JS with require.external + custom resolve. CVSS 9.0/9.5 Critical. Python PoC: --lab (Node), check, remote exploit, mass -j.

Unauthenticated Java deserialization (CWE-502) on Apache Roller 6.1.5 legacy XML-RPC servlet: enabledForExtensions allows ex:serializable before Blogger/MetaWeblog auth; mapping stays active even when XML-RPC is disabled in UI. Pre-auth RCE via attacker-controlled serialized objects (ysoserial/classpath gadgets). Fixed in 6.1.6+. CVSS 9.8 Critical. Python PoC: check, probe-deser, exploit, mass -j.

Authenticated OS command injection (CWE-77/78) in D-Link R95 BE9500 firmware BE9500_1.00.16 (1.01B06): DHMAPI SetTimeSettings stores NTPServer unsanitized; UCI sync runs shell with backticks as root. Requires admin Login + API-AUTH HMAC (port 18443/443). CVSS 9.1 Critical. Python PoC: check/exploit, mass bulk -j, colored CLI.

Unauthenticated authentication bypass (CWE-287) in miniOrange OTP Login, Verification and SMS Notifications ≤ 5.5.5 via wp-login.php POST mo_wp_login_intent=otp with empty password — mo_by_pass_login() skip_pass_fallback skips password check when Admin OTP Bypass and related OTP login options are enabled. CVSS 3.1 9.8 Critical. Fixed in 5.5.6+. PoC: plugin scan, optional user enum, check/exploit modes.

Memory overflow in Citrix NetScaler ADC and NetScaler Gateway DTLS handling (UDP, typically 443) can lead to remote code execution or denial of service. DTLS is on by default for Gateway VPN virtual servers unless -dtls OFF. Fixed at 14.1-73.37+ and 13.1-64.23+; CTX697096 reports active exploitation of CVE-2026-88772 with sibling CVEs. CVSS 4.0 9.5 Critical. PoC fingerprints Gateway, compares build strings, optional benign DTLS probe — no overflow trigger.

Remote attestation relay (CWE-295) in Edgeless Systems Contrast before 1.16.0: cryptographically valid TEE reports matching ReferenceValues were accepted without binding to specific trusted hardware, allowing MITM relay to impersonate Coordinator or workloads in attested TLS. Fixed in 1.16.0 with AllowedChipIDs (SEV-SNP) and AllowedPIIDs (TDX). CVSS 4.0 9.1 Critical (VulnCheck). PoC audits manifests, detects versions, probes Coordinator — no MITM/TEE forgery.

Out-of-bounds write (CWE-787 / CWE-119) in D-Link DIR-895L firmware A1_102b07 L2TP tunnel_set_params() — Host Name AVP length clamped to 127 but NUL written at peer_hostname[len+1] on a 128-byte buffer. Remote attack over UDP 1701 when L2TP is active. PoC fingerprints the router, probes UDP 1701, optional lab-only --oob-send trigger. No vendor fix listed in NVD at publication.

Unauthenticated arbitrary file upload (CWE-434, CVSS 3.1 9.8 Critical) in Ultra Addons for Contact Form 7 (Themefic) ≤ 3.5.50 via uacf7_wpcf7_mail_components in the PDF Generator addon — signature field copies files to wp-content/uploads/uacf7-uploads/ with weak validation. Requires PDF Generator enabled on a form with uacf7_signature. Fixed in 3.5.51+.

Unauthenticated remote code installation in UP (Universal Plugin) for Joomla (lomart.fr) 5.0.0–5.2.0 and 6.0.0–6.0.29: mini package triggers on-demand GitHub action download into plugins/content/up/actions/ with TLS verify disabled (MITM risk). CVSS 4.0 10.0 Critical. Fixed in 5.2.1 and 6.1.0.

Unauthenticated path traversal and arbitrary file read (CWE-22, CWE-284, CVSS 4.0 9.2 Critical) in UP (Universal Plugin) for Joomla (plg_content_up, lomart.fr) 5.0.0–5.2.0 and 6.0.0–6.0.29 via AJAX file-access handlers (ajax-view). May expose configuration.php and DB credentials. Fixed in 5.2.1 and 6.1.0.

PHP code injection (CWE-94, CVSS 4.0 9.4 Critical) in UP (Universal Plugin) for Joomla (plg_content_up, lomart.fr) 5.0.0–5.2.0 and 6.0.0–6.0.29 via {up php=...} shortcodes processed with eval(). Author save/render bypass on older builds can expose execution to all visitors. Fixed in 5.2.1 and 6.1.0.

AcyMailing Enterprise for Joomla < 11.1.0 (through 11.0.5): POP3 mailbox actions save MIME attachments without extension checks to media/com_acym/upload/, enabling RCE when an attacker can email the monitored inbox. CWE-434, CVSS 4.0 9.5 Critical (AT:P). Fixed in 11.1.0.

Unauthenticated SQL injection (CWE-89, CVSS 4.0 9.3 Critical) in YouTube Gallery for Joomla (com_youtubegallery, joomlaboat.com) ≤ 5.7.2 — video search and sorting on the public yg_api=1 JSON API (ygsearchfields, ygsearchquery, sort params). Fixed in 5.7.3.

Unauthenticated arbitrary file upload on Honeywell PD45 Industrial Printer HTTPS web admin (firmware F10.19.010040 through before F10.22.030745) — CWE-306/434/78, CVSS 9.8 Critical. Attacker-controlled files may execute on the device. Fixed in firmware F10.22.030745.

Unauthenticated arbitrary file upload (CWE-434, CVSS 9.8 Critical) in Request a Quote for WooCommerce ≤ 2.9.2 via public AJAX afrfq_submit_quote_via_popup — unsafe move_uploaded_file() with attacker-controlled .php names into web-accessible RFQ temp storage. Requires popup quote rule on the storefront.

Bookly ≤ 28.2: unauthenticated IDOR on booking AJAX — bookly_get_form_id + bookly_render_complete leak any order’s bookly_order token; calendar export and rollback cancel non-completed bookings. CVSS 3.1 9.1 Critical (CWE-639).

Customer Reviews for WooCommerce (CusRev) ≤ 5.120.0: public review form AJAX accepts arbitrary Media Library attachment IDs; linked files are deleted when the review is purged. CVSS 3.1 9.1 Critical (CWE-862). Requires a /cusrev/{formId}/ link.

Unauthenticated administrator via public WAWP REST signup: unsanitized wawp_custom_fields writes wp_capabilities through update_user_meta. Automation Web Platform plugin ≤ 4.8.6 (CVSS 3.1 9.8 Critical).

Pre-authentication SQL injection in Roundcube Webmail via the virtuser_query plugin and a preg_replace() backslash escape bypass. Affects 1.6.x before 1.6.16 and 1.7.x before 1.7.1 (CVSS 3.1 8.1 HIGH).

Unauthenticated privilege escalation in the WordPress JetFormBuilder plugin (≤ 3.6.2) via the `_jet_engine_booking_form_id` handling path. Attackers may gain elevated capabilities without valid credentials.

Unauthenticated arbitrary shortcode execution in WP Recipe Maker (≤ 10.8.1) through approved recipe rating comments and **reviewBody** JSON-LD handling.

Unauthenticated SQL injection in OrdaSoft **OS Gallery** (`com_osgallery` / `com_osgallery_light` ≤ 6.2.6) via the image **search** parameter (`textsearch`).

Chained unauthenticated privilege escalation to **administrator** in Meta Box AIO (≤ 3.11.0) involving **MB Frontend Submission** (≤ 4.5.6) frontend submission logic.

Unauthenticated PHP object injection in **Give Tributes** (≤ 2.3.1) via unsanitized **eCard multi-recipient** POST data stored on donations (unsafe deserialization on read).

Unauthenticated local file inclusion in **Visual Composer Website Builder** (≤ 45.16.0) via the **`vcv-template`** parameter (public Wordfence/NVD discussion).

Unauthenticated arbitrary shortcode execution in **Forminator** (≤ 1.57.2) via **`current_url`** in quiz-related AJAX handlers.

Unauthenticated arbitrary file upload in **Gravity Forms** (≤ 3.1.0.4) abusing a hidden **File Upload** field (`upload_file`).

Unauthenticated remote code execution in REDCap ≥ 13.3.0 via public survey __passthru routing and Data Import path handling. Patched in 16.0.49, 17.3.10, and 17.4.4+. Requires a valid public survey hash (s=) for the published check/exploit tooling.

Critical WHM/cPanel issue (CVE-2026-41940): pre-authentication bypass chain described in public research, with CVSS ~9.8. Restrict WHM exposure and patch from vendor advisories.