
🛡️ CVE Proof-of-Concept Hub — 4 PUBLISHED CVEs · 5 under review (VulnCheck) · SuiteCRM batch withdrawn
Working, verified PoC scripts for recent CVEs. Tested in lab environments. For security researchers, penetration testers, and CTF players.
All PoCs are for educational and authorized testing only. Each exploit has been tested in isolated lab environments. Do not use against systems without explicit permission.
CVE-PoC-Hub/
├── README.md
├── CVE-2026-XXXXX/ # Each CVE gets its own folder
│ ├── README.md # Description + steps
│ ├── exploit.py # Working PoC
│ └── screenshot.png # Proof of exploitation
├── templates/
│ └── poc-template.py # Standard PoC template
└── poc-runner.py # Bulk PoC runner
| CVE | Product | Type | CVSS |
|---|---|---|---|
| CVE-2026-66412 | Leantime ⭐10k+ | IDOR (getMilestone) | 7.5 |
| CVE-2026-66414 | Leantime ⭐10k+ | Open Redirect | 6.1 |
| CVE-2026-66415 | Leantime ⭐10k+ | SSRF + LFI | 8.8 |
| CVE-2026-66416 | Leantime ⭐10k+ | CSRF Disabled | 8.8 |
| ID | Target | Type | CVSS | Status |
|---|---|---|---|---|
| b5aa1a1a | OzonTech file.d | Unauth Mgmt API (:9000) | 8.2 | ✅ Live-verified 2026-08-13 — defending |
SuiteCRM:
| ID | Type | CVSS | Why withdrawn |
|---|---|---|---|
| SCRMBT-480 | Unauth SQLi (GeneratePassword) | 9.8 | Payload escaped in retrieve_user_id(); INSERT unreachable (MySQL general log) |
| SCRMBT-481 | File Upload Case Bypass | 8.8 | strtolower() applied since 2020; files stored under GUID name |
| SCRMBT-482 | File Upload GD Bypass RCE | 8.8 | Content regex runs before GD check; GD-missing returns false since 7.11.x |
| SCRMBT-483 | Unauth XSS (WebToLead) | 8.2 | voku AntiXSS strips on* / javascript: even entity-obfuscated |
VulnCheck:
4 CVEs published via VulnCheck CNA (Khushali Dalal). file.d live-verified and being defended. 8 findings honestly withdrawn after live re-testing.
git clone https://github.com/javokhir-sec/CVE-PoC-Hub.git
cd CVE-PoC-Hub
# List all available PoCs
python poc-runner.py --list
# Run a specific PoC (in lab environment)
python poc-runner.py --cve CVE-2026-XXXXX --target http://lab-target.local
Use this template for your own PoCs: templates/poc-template.py
#!/usr/bin/env python3
"""
CVE-YYYY-XXXXX: [Vulnerability Type] in [Product]
CVSS: X.X | Severity: Critical/High/Medium/Low
Author: @javokhir-sec
"""
import requests
import sys
TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://localhost"
def exploit(target):
"""Execute the exploit and return True if vulnerable."""
print(f"[*] Testing {target} for CVE-YYYY-XXXXX")
# Step 1: Send malicious request
payload = "<script>alert(1)</script>"
r = requests.get(f"{target}/search?q={payload}")
# Step 2: Verify exploitation
if payload in r.text:
print(f"[+] VULNERABLE! Payload reflected in response.")
return True
else:
print(f"[-] Not vulnerable.")
return False
if __name__ == "__main__":
exploit(TARGET)
# Run all XSS PoCs against a target
python poc-runner.py --category xss --target http://lab.local
# Run all SQLi PoCs
python poc-runner.py --category sqli --target http://lab.local
# Run specific severity level
python poc-runner.py --severity critical --target http://lab.local
| Category | Count |
|---|---|
| SQL Injection | 4 |
| XSS (Reflected/Stored) | 4 |
| Broken Access Control | 3 |
| CSRF | 1 |
| IDOR | 1 |
| Auth Bypass | 2 |
| SSRF + LFI | 1 |
| File Upload RCE | 1 |
| Open Redirect | 1 |
| Missing Authentication | 1 |
| Total | 4 Published + 1 Active (file.d, verified) |
Have a working PoC for a recent CVE?
CVE-YYYY-XXXXX/README.md + exploit.py + screenshotMIT © Javokhir Tursunboyev
| ID | Target | Type | CVSS | Why withdrawn |
|---|
| ad927f12 | eGov SmartCity | Struts2 RCE | 10.0 | S2-045/046 not applicable to 2.5.14.1; S2-057 = existing CVE-2018-11776 (CNA rules forbid reassignment) |
| 55c37649 | Tesla Vehicle CMD | JWT No Verify | 8.8 | By design: proxy relays token to Tesla fleet API which verifies — forged token → 401 |
| 9582b653 | Gojek Darkroom | Path Traversal | 7.5 | gorilla/mux cleanPath 301-redirects all ../ before dispatch (live tested) |
| 97d14382 | Kaspersky KLara | No Rate Limit | 6.5 | Hardening gap, not CVE-worthy; also wrong framework stated in report |