CVE-2026-76867

Netcore NR255-V (firmware 1.5.130703 ) is affected by a stored cross-site scripting (XSS) vulnerability in four routing and NAT configuration CGI handlers: routing_tab_add_cgi , routing_table_list_show_cgi , route_policy_add_cgi , and route_policy_parame_show_cgi . Attackers with low privileges c...

traefik-stripprefix-auth-bypass-cve-2026-48020-path-normalization

CVE-2026-48020 — Bypass de autenticación a nivel de ruta en StripPrefix de Traefik PoC Un proof of concept autocontenido para CVE-2026-48020 , un bypass de autenticación/autorización a nivel de ruta en el middleware StripPrefix de Traefik causado por la normalización de rutas que ocurre después d...

CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Grafana Unauthorized File Read Affected versions: 8.0.0-lastest reference: - https://github.com/tangxiaofeng7/Grafana-File-Read Exploit the Grafana /public/plugins endpoint's lax URL route validation vulnerability to read arbitrary local files from the server. poc:...

wp2shell-vulnerability-scanner

WP2Shell Scanner A read-only, non-destructive security audit tool that scans WordPress installations for the wp2shell vulnerability chain. Overview WP2Shell Scanner is a bash utility that recursively searches a directory tree for WordPress installations and checks whether each site is running a...

CVE-2026-63030-POC

wp2shell — CVE-2026-63030 + CVE-2026-60137 Cadena de exploits RCE de un día para WordPress. Sin autenticación. CVSS 9.8. Cero dependencias — solo stdlib de Python 3.8+. Versiones afectadas Rama| Vulnerable| Parcheada ---|---|--- 6.9.x| 6.9.0 – 6.9.4| ≥ 6.9.5 7.0.x| 7.0.0 – 7.0.1| ≥ 7.0.2 La caden...

CVE-2025-54914-PoC

CVE-2025-54914 Azure Route Exploit Resumen Esta es una implementación mejorada de la vulnerabilidad CVE-2025-54914 de enrutamiento de Azure Networking. Esta versión mantiene la funcionalidad principal de la CVE mientras añade más características como persistencia, evasión, escaneo multiobjetivo y...

wp2shell

wp2shell-check Non-intrusive checker for CVE-2026-63030 / CVE-2026-60137 "wp2shell", a pre-authentication RCE chain in WordPress core REST API batch-route confusion → SQL injection → RCE. Affected: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1, 7.1 beta full RCE chain; 6.8.0–6.8.5 SQL injection only,...

CVE-2026-81303

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

CVE-2026-81320

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-63030

🚨 CVE-2026-63030 — WP2Shell WordPress REST API Route Confusion → Remote Code Execution A Critical WordPress Core vulnerability enabling REST API route confusion that can be chained with SQL Injection to achieve unauthenticated Remote Code Execution. 📖 Overview CVE-2026-63030 is a Critical...

EUVD-2026-78276

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-81320

hawtio-operator (used in the OpenShift ecosystem) leaks the TLS private key in PEM format when a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher . The entire Route object is serialized to JSON and written to the operator's standard output, which is typic...

CVE-2026-81303 Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

CVE-2026-81303

CVE-2026-81303 affects hawtio-operator , a Kubernetes operator. The operator holds the routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks....

EUVD-2026-78275

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

CVE-2026-81303

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

wp2shell

🔍 wp2shell - WordPress CVE-2026-63030 Vulnerability Scanner & Exploit ⚡ Fast, Real-time Vulnerability Scanner & Exploit for CVE-2026-63030 wp2shell 📌 Overview wp2shell is a comprehensive toolkit for detecting and exploiting CVE-2026-63030 , a critical vulnerability in WordPress that allows...

abdal-cve-2026-63030

English | فارسی 🛡️ Exploits PoC de Abdal CVE-2026-63030 Abdal CVE-2026-63030 es un verificador defensivo de exposición para WordPress que detecta la confusión de rutas en el endpoint por lotes de la API REST, rastreada como CVE-2026-63030. El problema puede encadenarse con CVE-2026-60137 en...

CVE-2026-73321

CVE-2026-73321 XenForo before 2.3.13 can exhaust a PHP worker through deeply nested BBCode. What I validated The public editor/to-html route sends guest-supplied BBCode through XenForo's recursive parser and renderer. It does not apply a raw-length or nesting limit before that work. The normal...

wp2shell

wp2shell - PoC de RCE en WordPress CVE-2026-63030 + CVE-2026-60137 Ejecución Remota de Código no autenticada en el núcleo de WordPress por: JohenLastGen 📌 Resumen Esta herramienta encadena dos vulnerabilidades críticas de WordPress para lograr RCE no autenticado : Vulnerabilidad| CVE| Descripción...