Pinned Loading

1. CVE-2026-104711-POC CVE-2026-104711-POC Public

   POC exploit for CVE-2026-104711 - OGNL injection RCE in Apache Struts legacy REST action mapper (S2-075). Vulnerable vs fixed verification included.

   Python 2

2. CVE-2026-90436-POC CVE-2026-90436-POC Public

   POC for CVE-2026-90436 - unauthenticated remote class instantiation in Apache Axis 1.x via SOAP fault exceptionName, bypassing configured auth handlers. EOL software, no fix exists.

   Python 1

3. CVE-2026-123488-POC CVE-2026-123488-POC Public

   POC exploit for CVE-2026-123488 - unauthenticated SQL injection vulnerability in Craft CMS (MySQL/MariaDB backend). Admin takeover.

   Python 1

4. CVE-2026-73373-POC CVE-2026-73373-POC Public

   POC exploit for CVE-2026-73373 - unrestricted upload of shtml files in Joomla core leading to server-side include execution. Blocklist diff plus vulnerable vs fixed controls included.

   Python

5. CVE-2026-73663-POC CVE-2026-73663-POC Public

   POC exploit for CVE-2026-73663 - unauthenticated SQL injection in the FreePBX missedcall module via a crafted SIP From Caller-ID name, allowing admin account modification. Vulnerable 17.0.3 vs patc…

   Python

6. CVE-2026-11800-POC CVE-2026-11800-POC Public

   POC for CVE-2026-11800 - JWT algorithm confusion in Keycloak identity brokering: the IdP RSA public key DER bytes are accepted as an HMAC secret, minting tokens for federated users without any priv…

   Python