2865 matches found
CVE-2026-39385
CVE-2026-39385 — Frappe LMS : Open-source LMS with a vulnerability in versions ≤ 2.51.0 where a user could bypass course payment validation by using an unrelated batch. Root cause: enrollment validation did not require the batch to be linked to the corresponding course. Impact: potential unauthor...
EUVD-2026-46029
Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...
CVE-2026-39385
Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...
CVE-2026-39385 Frappe LMS enrollment bypass in paid courses via unrelated batch
Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...
Exploit for CVE-2026-63030
wp2shell-cf-bypass Independent PoC for the WordPress batch ro...
Exploit for CVE-2026-63030
CVE-2026-63030: WordPress REST API Batch Route Confusion to SQ...
Exploit for CVE-2026-63030
CVE-2026-63030: WordPress REST API Batch Route Confusion to SQ...
Exploit for CVE-2026-60137
/ / / / / / | |/ / \ / /...
Exploit for CVE-2026-63030
CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC...
PT-2026-61650
Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...
CVE-2026-39385: Authentication Bypass Using an Alternate Path or Channel
Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...
WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE
Description WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...
WordPress 5.6+ SkelerSecurity Core Security Plugin REST Batch API Mitigation
This WordPress plugin provides a temporary mitigation for the REST Batch API vulnerability chain commonly referred to as "wp2shell." It requires authentication before requests to the /wp-json/batch/v1 and ?restroute=/batch/v1 endpoints are processed, preventing unauthenticated exploitation of the...
Exploit for CVE-2026-63030
wp2shell: WordPress Batch RCE A technical breakdown of CVE-20...
Exploit for CVE-2025-9951
CVE-2025-9951 FFmpeg JPEG 2000 exploitation research This rep...
Exploit for CVE-2026-63030
wp2shell — CVE-2026-63030 + CVE-2026-60137 One-day WordPres...
Exploit for CVE-2026-63030
CVE-2026-63030 — WordPress wp2shell Exploit Unauthenticated d...
Exploit for CVE-2026-60137
wp2shell-scanner by @bahartanirhttps://github.com/baha...