CVE-2026-63030

🚨 CVE-2026-63030 — WP2Shell Confusión de rutas en la API REST de WordPress → Ejecución remota de código Una vulnerabilidad crítica del núcleo de WordPress que permite la confusión de rutas en la API REST y que puede encadenarse con inyección SQL para lograr ejecución remota de código sin...

CVE-2026-8181

CVE-2026-8181 This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by using any incorrect password in a Basic Authentication header. Attackers could abuse this flaw to create a new administrator account...

WP-Bricks-Exploit-CVE-2024-25600

BricksRCE Exploiter CVE-2024-25600 — WordPress Bricks Builder RCE sin autenticación Herramienta de evaluación de seguridad autorizada para CVE-2024-25600 Autor: Sudeepa Wanigarathna · Herramienta: BricksRCE Exploiter v1.0 Script principal: cve-2024-25600.py !IMPORTANT Solo uso autorizado. Esta...

CVE-2026-63030-Wp2Shell

CVE-2026-63030 wp2shell — WordPress Core Pre-Auth RCE REST API batch route confusion chained with CVE-2026-60137 SQL injection TL;DR — An unauthenticated attacker can chain a WordPress REST API batch-routing bug with a SQL injection in WPQuery to reach full remote code execution on a stock...

wp2shell-poc

How does this work at all How this PoC differs from the public wp2shell exploits all pocs weaponize the same two bugs - the REST batch route confusion CVE-2026-63030 and the authornotin SQL injection CVE-2026-60137 - with the same double-nested batch shape. What differs between them is the RCE pa...

wp2shell

🔍 wp2shell - WordPress CVE-2026-63030 Vulnerability Scanner & Exploit ⚡ Fast, Real-time Vulnerability Scanner & Exploit for CVE-2026-63030 wp2shell 📌 Overview wp2shell is a comprehensive toolkit for detecting and exploiting CVE-2026-63030 , a critical vulnerability in WordPress that allows...

struts_rest_rce_fuzz-CVE-2017-9805-

Este repositorio no tiene un README...

abdal-cve-2026-63030

English | فارسی 🛡️ Exploits PoC de Abdal CVE-2026-63030 Abdal CVE-2026-63030 es un verificador defensivo de exposición para WordPress que detecta la confusión de rutas en el endpoint por lotes de la API REST, rastreada como CVE-2026-63030. El problema puede encadenarse con CVE-2026-60137 en...

api-scanner-docker

API Scanner - Despliegue Autogestionado API Scanner es una herramienta automatizada de pruebas de seguridad de APIs que escanea APIs REST y SOAP en busca de vulnerabilidades utilizando especificaciones OpenAPI/Swagger y archivos WSDL. Prerrequisitos Docker Engine 20.10+ Docker Compose v2 Python...

CVE-2026-97685

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

CVE-2022-45354

Download Monitor = 4.7.60 - Exposición de Información Sensible a través de la API REST CVE-2022-45354:version encontrado en http://wordpress.lan Detalles : CVE-2022-45354:version coincidió en http://wordpress.lan Protocolo : HTTP URL completa :...

CVE-2021-42559

CVE-2021-42559: Inyección de comandos mediante configuraciones en MITRE Caldera Caldera versiones =2.8.1 contiene múltiples "requisitos" de inicio que ejecutan comandos al iniciar el servidor. Debido a que estos comandos se pueden cambiar mediante la API Rest, un usuario autenticado puede inserta...

wpUsersScan

wpUsersScan Acerca de wpUsersScan Enumera la lista de usuarios de sitios WordPress a través de la API REST / CVE-2017-5487, WordPress 4.7.1 - Enumeración de nombres de usuario Uso $ python wpUsersScan.py URL Cómo instalar Clonar Clona el repositorio con: $ git clone...

CVE-2024-4898

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

wp2shell

wp2shell - PoC de RCE en WordPress CVE-2026-63030 + CVE-2026-60137 Ejecución Remota de Código no autenticada en el núcleo de WordPress por: JohenLastGen 📌 Resumen Esta herramienta encadena dos vulnerabilidades críticas de WordPress para lograr RCE no autenticado : Vulnerabilidad| CVE| Descripción...

CVE-2026-97685

In LimeSurvey Community Edition 7.3.0 , an authenticated user with survey creation privileges can perform a cross-survey object authorization bypass via the REST survey-patching endpoint . While the endpoint correctly validates permissions against the survey ID in the URL, the underlying persiste...

CVE-2026-97685 LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

MLFlow < 2.8.1 - Sensitive Information Disclosure

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API. id: CVE-2023-43472 info: name: MLFlow 2.8.1 - Sensitive Information Disclosure author: ritikchaddha severity: high description: | An issue in MLFlow versions...

drupal8-REST-RCE

drupal8-REST-RCE CVE-2019-6340 drupal8-REST-RCE /node/1 , CVE-2018-7600 drupal8 RCE /user/register Unix/Linux command - remote code Execution command "id" Usage python drupal8-REST-RCE.py user defined port python drupal8-REST-RCE.py default : 80/tcp updated! Script editted for supporting python3...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability I: Vulnerability Description ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...