Exploits

Original CVEs, exploit PoCs and security advisories
by @kmkz · boffsec-services.com · @kmkz_security

2026

CVE-2026-22191 - Template Injection (CWE-79, CWE-1336)
CVE-2026-41468 - AngularJS Sandbox Escape (CWE-94, CWE-1104)
CVE-2026-41469 - Missing CSP / persistence (CWE-693)
-> Chain: Template Injection -> sandbox escape -> no-CSP persistence -> MITM delivery -> persistent client-side RCE (SicuroWeb / Beghelli Sicuro24)

CVE-2026-22192 - Client-side auth bypass via localStorage (CWE-306, CWE-284)
CVE-2026-22199 - Pre-auth path traversal /etc/shadow disclosure (CWE-22)
-> Chain: auth bypass + path traversal -> hash crack -> SSH root RCE (Voltronic Power SNMP Web Pro 1.1) Published April 22, 2026 - 120-day coordinated disclosure via VulnCheck - no vendor patch available
-> Full write-up

Issue #49220 - No CVE - Keycloak Admin REST API: client secrets returned in plaintext to view-clients holders (CWE-522, CWE-284)
-> Chain: admin token (assumed breach) -> client secret dump -> client_credentials grant -> manage-users scope -> full user PII dump + persistent ATO via password reset
-> Secret persists until manually rotated - admin token expiry does not close the window
-> Affected: all versions <= 26.5.6 / Fixed: 26.5.7+ (No CVE - 06/01/2026)

CVE-2026-58455 - Execution After Redirect chained with OS Command Injection (CWE-698, CWE-78)
-> Chain: missing exit() after authentication redirect -> unauthenticated session state -> composePath command injection -> container RCE -> host compromise through the mounted Docker socket
-> Affected: Dockwatch <= 0.6.567
-> Fix PR #135 closed without merge; no patched release available as of 2026-07-21
-> Lab, PoC and reproduction notes

2025

2020

2019

PUBLISURE - exploit chain: access control bypass (pre-auth) -> SQLi -> unrestricted file upload RCE -> local admin
Published September 5th, 2019

2018

CVE-2018-10682/10683 - WildFly unauthenticated RCE via anonymous access + .war auto-deployment
Published May 3rd, 2018 - with @Piosky1

2017

2016

CVE-2016-1000300 - GRR booking system, file extension-only filter bypass -> RCE + privilege escalation
Published January 7th, 2016

2014

Legacy

Older PoCs and research without a precise publication date.

Tools

Repository structure

Exploits/
2026/
CVE-2026-22191-SicuroWeb-ATI-chain.txt
CVE-2026-22191-POC.py
CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt
2025/
2020/
2019/
2018/
2017/
2016/
2014/
Legacy/
Tools/
README.md

Related repositories

• kmkz/Pentesting - Pentesting tricks and cheat sheets
• kmkz/Assembly-language - x86/ARM sources for exploit dev
• kmkz/Sources - Offensive security source code

For professional engagements: boffsec-services.com