CVE-2026-64638-PoC-Exploit

🌀 CVE‑2026‑64638 – WordPress XSS2Shell Security Suite ⚠️ SOLO USO ETICO – TEST DI SICUREZZA AUTORIZZATI Questo repository fornisce strumenti esclusivamente per professionisti della sicurezza autorizzati, blue team e penetration tester. L'accesso non autorizzato a sistemi informatici è illegale ai...

XSS2Shell

XSS2Shell XSS2Shell è una prova di concetto educativa per CVE-2026-64638 , che dimostra l'impatto di un problema XSS pre-autenticazione nelle installazioni WordPress vulnerabili. Con la partecipazione esplicita di un amministratore, la PoC acquisisce una Application Password di WordPress, pubblic...

XSS2Shell-CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain DOM Clobbering + Application Password Diebstahl + REST-API-Plugin-Aktivierung = Vollständige RCE ⚡ Übersicht CVE-2026-64638 ist eine kritische Pre-Authentifizierungs-Reflected-XSS in WordPress wp-login.php...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Descrizione CVE-2026-8181 è una vulnerabilità di Bypass di Autenticazione nel plugin WordPress Burst Statistics versione 3.4.0 fino a 3.4.1.1. Questo plugin è utilizzato da...

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Bypass dell'autenticazione per il takeover dell'account amministratore Descrizione: Burst Statistics 3.4.0 - 3.4.1.1 - Bypass dell'autenticazione per il takeover dell'account amministratore Il plugin Burst Statistics – Privacy-Friendly WordPress Analytics...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — प्रमाणीकरण बाईपास से व्यवस्थापक खाता अधिग्रहण भेद्यता सारांश वर्डप्रेस प्लगइन Burst Statistics संस्करण 3.4.0 से 3.4.1.1 एक अप्रमाणित प्रमाणीकरण बाईपास भेद्यता के लिए संवेदनशील है जो पूर्ण व्यवस्थापक खाता अधिग्रहण की ओर ले जाता है। यह गंभीर दोष एक...

EUVD-2026-55011

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...

Exploit for CVE-2026-64638

💥 CVE‑2026‑64638 – WordPress XSS2Shell S...

Exploit for CVE-2026-8181

CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Authenticat...

EUVD-2015-1729

Malware in sbrugna...

EUVD-2016-5503

Malware in sbrugna...

EUVD-2024-50993

Malicious code in bioql PyPI...

EUVD-2025-8234

Malicious code in bioql PyPI...

EUVD-2024-33754

Malicious code in bioql PyPI...

CVE-2025-50503

A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide ...

CVE-2024-11197

The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application password logins when user accounts are locked. This makes it possible for authenticated attackers, with existing application passwords, t...

CVE-2024-12603

A logic vulnerability in the the mobile application com.transsion.applock can lead to bypassing the application password...

CVE-2025-2489

Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json...

CVE-2025-2489

CVE-2025-2489 affects NTFS Tools 3.5.1 and involves insecure storage of sensitive information. The vulnerability stems from storing the application password in /Users/user/Library/Application Support/ntfs-tool/config.json, enabling an attacker with local access to read the password. Documented im...