Catálogo de exploits

MikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for authorized lab testing

CVE-2020-14008 - ManageEngine Applications Manager RCE

langz337/CVE-2026-63030

CVE-2026-15583 - Grafana MCP Server - High 8.6 - Unauthenticated POST /mcp - Unauthenticated Token Exfiltration (X-Grafana-URL Confused Deputy)

CVE-2026-48356 - Magento Open Source - Critical 9.3 - Unauthenticated POST /rest/default/V1/guest-carts/{cartId}/items - Unauthenticated Unrestricted File Upload (PolyShell)

CVE-2026-14281

CVE-2026-61500 Rejetto HFS predictable PRNG session forgery to RCE PoC and Docker lab

Tracking the QEMU CVE-2026-93834 9pfs fid-path use-after-free guest-to-host escape

OnePlus Ace 6 temporary root tool (CVE-2026-64560) - device-verified port with corrected bootidParent address

LetsDefend SOC lab investigating CVE-2024-49138 exploitation and related malicious activity.

Unauthenticated privilege escalation in WordPress WAWP (Automation Web Platform) ≤ 4.8.6 via public REST signup and unsanitized wawp_custom_fields → admin. Python check/exploit PoC (PoCbit).

CVE-2026-64560 toolkit: Go single-binary toolchain + realme RMX5010 (A16, SM8750) target port

CVE-2026-5430 - WSO2 API Manager - Critical 10.0 - Unauthenticated Account Takeover - WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, WSO2 Universal Gateway

Unauthenticated IDOR in Bookly ≤ 28.2: bookly_get_form_id + bookly_render_complete leak any order’s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC — pocbit.org/pocs/cve-2026-93399

CVE-2026-59310-POC 仅用于自测，请勿用于攻击

CVE-2026-96512 - sudo - High 7.8 - Authenticated LOCAL TZ=UTC+14 sudo -n /usr/bin/id - Local Privilege Escalation via Time-Window Bypass

Ermensonx/sudotimewarp-cve-2026-96512-

WP Plainview Activity Monitor auth RCE fix: broken manual cookie parse to stable Session handling. CVE-2018-15877 educational fix.

Unauthenticated authorization bypass in Customer Reviews for WooCommerce ≤ 5.120.0: holders of a public /cusrev/{formId}/ review link can POST cr_local_forms_submit with arbitrary Media Library attachment IDs in items[].media. Linked files are permanently deleted when the review comment is purged. Python check/exploit PoC (PoCbit catalog).

CVE-2026-62062 - WordPress - Elementor Website Builder - High 8.8 - Unauthenticated POST /?rest_route=/wp/v2/users&x=elementor... - Cross-Site Request Forgery to Administrator Account Creation

针对 OnePlus Ace6 设备的 cve-2026-64560 复现

technical research & analysis on linux process execution, SUID privilege escalation, LD_PRELOAD hooking, and CVE-2014-6271 (shellshock).

WordPress CVE-2026-87902 diagnostic check

Proof of concept for vulnerability CVE-2026-87902 in Wordpress

Samba 3.0.20 username map script command injection exploit — reverse shell via SMB authentication, built from scratch in Python using impacket. No Metasploit.

Penetration testing report and PoC on Metasploitable2 target, demonstrating CVE-2011-2523 vsFTPd v2.3.4 exploitation via Metasploit.

Lab vulnerável (Docker) + PoC Python para a CVE-2026-87902 — path traversal não autenticado no WordPress Core (page-template -> LFI -> RCE condicional). Uso educacional/autorizado.

Proof of concept for vulnerability CVE-2026-87902 in Wordpress

jvidhan/cve-2026-43687

Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker