52 matches found
XSS2Shell
XSS2Shell XSS2Shell is an educational proof of concept for CVE-2026-64638 , demonstrating the impact of a pre-authentication XSS issue in vulnerable WordPress installations. With an administrator's explicit participation, the PoC captures a WordPress Application Password, publishes a temporary...
XSS2Shell-CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain DOM Clobbering + Application Password Theft + REST API Plugin Activation = Full RCE ⚡ Overview CVE-2026-64638 is a critical pre-authentication Reflected XSS in WordPress wp-login.php. The vulnerability exist...
CVE-2026-64638-PoC-Exploit
🌀 CVE‑2026‑64638 – WordPress XSS2Shell Security Suite ⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse...
CVE-2026-8181
CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Description CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPre...
CVE-2026-8181
CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Bypass de Autenticación para Toma de Control de Cuenta de Administrador Resumen de la Vulnerabilidad El plugin de WordPress Burst Statistics versiones 3.4.0 a 3.4.1.1 es vulnerable a una vulnerabilidad de bypass de autenticación no autenticado qu...
CVE-2026-8181
CVE-2026-8181 Burst Statistics | Authentication Bypass to Admin Account Takeover Description : Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover The Burst Statistics – Privacy-Friendly WordPress Analytics Google Analytics Alternative plugin for WordPress is...
EUVD-2026-76810
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...
CVE-2026-77753
The Temporary Login Without Password WordPress plugin before 1.9.9 fails to prevent a temporary user from creating an Application Password and does not revoke one when the temporary access expires or is disabled. As a result, the recipient of a temporary login retains working access to the site o...
EUVD-2026-55011
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...
Exploit for CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...
Exploit for CVE-2026-64638
💥 CVE‑2026‑64638 – WordPress XSS2Shell S...
Exploit for CVE-2026-8181
CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Authenticat...
EUVD-2015-1729
Malware in sbrugna...
EUVD-2016-5503
Malware in sbrugna...
EUVD-2025-8234
Malicious code in bioql PyPI...
EUVD-2024-50993
Malicious code in bioql PyPI...
EUVD-2024-33754
Malicious code in bioql PyPI...
CVE-2025-50503
A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide ...
CVE-2024-11197
The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application password logins when user accounts are locked. This makes it possible for authenticated attackers, with existing application passwords, t...