wp2shell

wp2shell WordPress REST API 라우트 혼동 CVE-2026-63030 + SQL 인젝션 CVE-2026-60137을 배치 엔드포인트에서 악용하여 원격 코드 실행을 달성합니다. 취약점 라우트 혼동 CVE-2026-63030 WordPress REST API 배치 엔드포인트/batch/v1는 요청 라우팅을 제대로 격리하지 않습니다. 배치 요청을 서로 중첩시킴으로써 공격자는 WordPress의 일반 권한 검사를 우회하는 내부 요청을 만들 수 있습니다. 핵심 지표는 응답의 parsepathfailed +...

wp2shell-poc

wp2shell-poc Независимый доказательный концепт PoC для неаутентифицированной SQL-инъекции через путаницу маршрутов route confusion batch-эндпоинта REST API WordPress, связанной с рекомендацией wp2shell от Searchlight Cyber. Этот репозиторий не является официальным чекером Searchlight Cyber. check...

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API Time-Based Blind SQLi → RCE Proof‑of‑Concept Описание pocwptot.py — это proof‑of‑concept PoC для эксплуатации уязвимости time‑based blind SQL injection в конечной точке batch WordPress REST API, и проведения цепочки эскалации до Remote Code Execution RCE. Проверяемые...

wp2shell-lab

wp2shell-lab Образовательный PoC и лабораторный стенд для CVE-2026-63030 + CVE-2026-60137 : пред-аутентификационная SQL-инъекция в ядре WordPress через подмену маршрутов REST batch-API. Обнаружено Адамом Кьюсом Searchlight Cyber / Assetnote. Исправлено в WordPress 6.9.5 / 7.0.2. Быстрый старт...

WP2Shell

WP2Shell - CVE-2026-63030 / CVE-2026-60137 SQL-инъекция в пакетном REST API WordPress с переходом к RCE Полный инструмент для обнаружения и эксплуатации уязвимости пакетного REST API WordPress. Данный инструмент эксплуатирует критическую SQL-инъекцию в конечной точке REST API WordPress...

Exploit for SQL Injection in Wordpress

WP2Shell Scanner !Pythonhttps://img.shields.io/badge/pytho...

CVE-2026-75850

ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...

CVE-2026-75850

ArcadeDB before 26.8.1 contains a per-type ACL bypass in its batch and time-series HTTP handlers . The root cause is that the authenticated principal (setCurrentUser) is not bound on the worker thread, causing the engine's fine-grained ACL layer (LocalBucket.checkPermissionsOnFile) to be skipped ...

EUVD-2026-60611

ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...

CVE-2026-9859

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...

PT-2026-76877

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21 Mattermost versions 11.8.0 through 11.8.3 Description The Boards plugin fails to enforce the PermissionManageBoardRoles authorization on the channelId field...

CVE-2026-67342

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...

CVE-2026-67342

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...

CVE-2026-67342 ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...

CVE-2026-67342

ArcadeDB is affected in versions before 26.7.2 where an authorization bypass exists in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints, failing to validate database access permissions. Attackers can call affected endpoints with arbitrary database parameters to access and m...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 / CVE-2026-60137 — "wp2shell" WordPress Core RC...

Exploit for CVE-2026-63030

Plugin Acyber Wordpress !WARNING Temporary Emergency...

Exploit for CVE-2026-63030

CVE-2026-63030 WordPress REST Batch Route-Confusion SQL I...

WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE

Description WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...