https://pwnmi.com/labs/ Hands-on CVE labs and CTF walkthroughs from PWNMI, reproduced in isolated environments you run yourself. en Eleventy Wed, 12 Aug 2026 17:00:00 GMT https://pwnmi.com/labs/splunk-cve-2026-20253/ https://pwnmi.com/labs/splunk-cve-2026-20253/ Wed, 12 Aug 2026 17:00:00 GMT A pre-auth endpoint on Splunk's PostgreSQL Sidecar Service returns the exact signature a public detection tool checks for — CVSS 9.8, and real, verifiable signal even without triggering the underlying file write. https://pwnmi.com/labs/comfyui-cve-2026-68771/ https://pwnmi.com/labs/comfyui-cve-2026-68771/ Tue, 04 Aug 2026 00:00:00 GMT An unauthenticated upload endpoint and a node that deserializes whatever lands in a folder combine into remote code execution with no login at all. https://pwnmi.com/labs/cron-job-hijacking/ https://pwnmi.com/labs/cron-job-hijacking/ Tue, 04 Aug 2026 00:00:00 GMT Root's crontab runs a backup script every minute; it was left world-writable, so replacing it is all it takes — then waiting for the clock. https://pwnmi.com/labs/datamodel-code-generator-cve-2026-63720/ https://pwnmi.com/labs/datamodel-code-generator-cve-2026-63720/ Tue, 04 Aug 2026 00:00:00 GMT A code generator trusts a schema field enough to paste it, unescaped, into the Python module it writes — and that module runs on import. https://pwnmi.com/labs/linux-capabilities-abuse/ https://pwnmi.com/labs/linux-capabilities-abuse/ Tue, 04 Aug 2026 00:00:00 GMT A capability meant for one narrow helper binary was set on the Python interpreter itself, handing that power to every script it runs. https://pwnmi.com/labs/sudo-misconfiguration/ https://pwnmi.com/labs/sudo-misconfiguration/ Tue, 04 Aug 2026 00:00:00 GMT An unrestricted NOPASSWD sudo rule on vim, granted so config edits wouldn't need a password every time, turns into a full root shell. https://pwnmi.com/labs/suid-binary-abuse/ https://pwnmi.com/labs/suid-binary-abuse/ Tue, 04 Aug 2026 00:00:00 GMT A leftover SUID bit on find from a one-off maintenance task is all it takes — enumerate, cross-reference GTFOBins, and escalate. https://pwnmi.com/labs/writable-etc-passwd/ https://pwnmi.com/labs/writable-etc-passwd/ Tue, 04 Aug 2026 00:00:00 GMT Weak permissions on /etc/passwd let you write your own root-equivalent account directly into the file — no exploit required, just a text edit. https://pwnmi.com/labs/wordpress-formgent-cve-2026-3141/ https://pwnmi.com/labs/wordpress-formgent-cve-2026-3141/ Mon, 03 Aug 2026 14:31:07 GMT A realpath() call on a directory that hasn't been created yet returns false — and a WordPress plugin's own path-traversal guard treats that as proof a request is safe. https://pwnmi.com/labs/wordpress-sso-tng-cve-2026-15964/ https://pwnmi.com/labs/wordpress-sso-tng-cve-2026-15964/ Mon, 03 Aug 2026 14:14:22 GMT A password-reset nonce computed identically for every anonymous visitor, then printed straight into the page — turning a public value into full, unauthenticated admin account takeover. https://pwnmi.com/labs/craft-cms-cve-2025-35939/ https://pwnmi.com/labs/craft-cms-cve-2025-35939/ Wed, 29 Jul 2026 15:30:00 GMT An unauthenticated request writes arbitrary attacker content, unsanitized, into a real PHP session file on disk — a KEV-listed CVE that had no public PoC before this lab. https://pwnmi.com/labs/linux-kernel-cve-2026-53264/ https://pwnmi.com/labs/linux-kernel-cve-2026-53264/ Tue, 28 Jul 2026 15:00:00 GMT A disposable-VM lab for a real, AI-assisted Linux kernel 0-day — how a use-after-free race in net/sched's traffic-control actions turns an unprivileged shell into root. https://pwnmi.com/labs/react-server-components-cve-2025-55182/ https://pwnmi.com/labs/react-server-components-cve-2025-55182/ Tue, 28 Jul 2026 14:00:00 GMT A maximum-severity CVE — a crafted deserialization payload against React Server Components turns into remote code execution, with output smuggled back through an HTTP redirect header. https://pwnmi.com/labs/n8n-cve-2025-68613/ https://pwnmi.com/labs/n8n-cve-2025-68613/ Tue, 28 Jul 2026 01:01:05 GMT A workflow-automation platform's JavaScript expression evaluator becomes full remote code execution with no login at all — actively exploited in the wild. https://pwnmi.com/labs/wordpress-core-cve-2026-63030/ https://pwnmi.com/labs/wordpress-core-cve-2026-63030/ Tue, 28 Jul 2026 01:00:05 GMT Two chained bugs in WordPress core, no plugin involved, combine into unauthenticated administrator account creation — actively exploited right now. https://pwnmi.com/labs/laravel-livewire-cve-2025-54068/ https://pwnmi.com/labs/laravel-livewire-cve-2025-54068/ Tue, 28 Jul 2026 00:59:05 GMT A component property's type in Livewire's client-state format is all it takes for unauthenticated remote code execution. https://pwnmi.com/labs/apache-activemq-cve-2026-34197/ https://pwnmi.com/labs/apache-activemq-cve-2026-34197/ Tue, 28 Jul 2026 00:58:05 GMT A JMX management bridge in Apache ActiveMQ turns a single authenticated API call into arbitrary code execution — actively exploited in the wild. https://pwnmi.com/labs/apache-tomcat-cve-2025-24813/ https://pwnmi.com/labs/apache-tomcat-cve-2025-24813/ Tue, 28 Jul 2026 00:25:09 GMT Actively exploited in the wild — two Tomcat misconfigurations combine to let an attacker plant and trigger arbitrary Java deserialization. https://pwnmi.com/labs/grav-cms-cve-2026-65008/ https://pwnmi.com/labs/grav-cms-cve-2026-65008/ Tue, 28 Jul 2026 00:00:00 GMT What it actually takes to adapt a published PoC when it was written against an admin interface your target doesn't run. https://pwnmi.com/labs/wordpress-mec-cve-2026-11349/ https://pwnmi.com/labs/wordpress-mec-cve-2026-11349/ Mon, 27 Jul 2026 17:32:08 GMT Unauthenticated blind SQL injection in the Modern Events Calendar Lite WordPress plugin, with real data actually extracted, not just a proof-of-concept flag. https://pwnmi.com/labs/freescout-cve-2026-53595/ https://pwnmi.com/labs/freescout-cve-2026-53595/ Mon, 27 Jul 2026 17:31:08 GMT A MySQL trailing-space quirk in a hash comparison is enough to let an attacker take over any FreeScout account, no authentication required. https://pwnmi.com/labs/apache-syncope-cve-2026-62183/ https://pwnmi.com/labs/apache-syncope-cve-2026-62183/ Fri, 24 Jul 2026 16:26:37 GMT A self-service API endpoint in Apache Syncope lets any authenticated user grant themselves admin-level roles. https://pwnmi.com/labs/tryhackme-blue-walkthrough/ https://pwnmi.com/labs/tryhackme-blue-walkthrough/ Wed, 22 Jul 2026 18:26:00 GMT A methodology-focused walkthrough of TryHackMe's free Blue room — exploiting EternalBlue (MS17-010) on an unpatched Windows 7 target. https://pwnmi.com/labs/htb-lame-walkthrough/ https://pwnmi.com/labs/htb-lame-walkthrough/ Wed, 22 Jul 2026 18:25:59 GMT A methodology-focused walkthrough of HackTheBox's Lame, one of the oldest retired beginner boxes — Samba RCE from recon to root.