WordPress <= 6.2 - Server Side Request Forgery

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. id: CVE-2022-3590 info: name: WordPress = 6.2 - Server Side...

pingback

Pingback C2 検出 Pingback C2 ツールによって作成された ICMP ping トンネルを検出するための Zeek パッケージと Suricata ルールです。 関連ブログ記事: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ インストール このパッケージをインストールする最も簡単な方法は、zkg を使用することです: zkg install corelight/pingback 使用方法 このサンプルPCAP を使用すると、以下のように実行できます: root@kitploit: ...

CVE-2022-3590-WordPress-Vulnerability-Scanner

CVE-2022-3590 WordPress漏洞扫描器 此Python脚本用于检查WordPress网站是否存在CVE-2022-3590漏洞。该漏洞利用了WordPress pingback功能中未经认证的盲服务端请求伪造（SSRF）。 开始 这些说明将指导您如何使用此脚本。 截图 前提条件 此脚本需要Python 3和requests库。您可以使用pip安装必要的依赖： root@kitploit: pip install -r requirements.txt 用法 您可以通过以下语法从命令行运行脚本： root@kitploit: python3 CVE-2022-3590.p...

Log4j-CVE-2021-44228

このPythonスキャナーは、Javaインスタンス内のlog4j脆弱性を検出し、応答を返します。...

WordpressPingbackPortScanner

WordpressPingbackPortScanner Wordpress 暴露了一种所谓的 Pingback API，用于链接到其他博客文章。 借助此功能，你可以通过该服务器扫描内联网或互联网上的其他主机。 你还可以将此功能用于某种分布式端口扫描： 你可以使用多个暴露了该 API 的 Wordpress 博客来扫描单个主机。 该问题已在 Wordpress 3.5.1 中修复。旧版本容易受到攻击， 如果 XML-RPC 接口处于活动状态。...

WordPress-6.9.1-Blind-SSRF

WordPress-6.9.1-Blind-SSRF このエクスプロイトにはCVEは割り当てられていません。 影響を受けるバージョン 6.8 - 6.8.3 6.9 - 6.9.1 WordPress = 6.9.1 - 認証不要のBlind SSRF（XML-RPC Pingback Discovery経由）の概念実証（PoC） 使用方法 1. requestsがまだインストールされていない場合はインストールします pip install requests 2. コード内の設定変数を変更します（例: WORDPRESSURL, TARGETPOST, CALLBACKURL） 3...

XMLRPC-Pingback-vulnerability-POC

XMLRPC-Pingback 脆弱性 POC これは、WordPress で見つかった xmlrpc-pingback 脆弱性に関する私自身が作成した POC です。CVE-2025-54352。 この脆弱性は WordPress 3.5 から 6.8.2 までのすべてのバージョンに影響します...

CVE-2022-3590-WordPress-Vulnerability-Scanner

CVE-2022-3590 WordPress 취약점 스캐너 이 Python 스크립트는 WordPress 웹사이트가 CVE-2022-3590 취약점에 취약한지 확인하기 위해 설계되었습니다. 이 취약점은 WordPress의 핑백pingback 기능에서 인증되지 않은 블라인드 서버-사이드 요청 위조SSRF를 악용합니다. 시작하기 이 지침은 이 스크립트를 사용하는 방법을 안내합니다. 스크린샷 사전 요구 사항 이 스크립트는 Python 3와 requests 라이브러리가 필요합니다. pip를 사용하여 필요한 요구 사항을 설치할 수 있습니다...

Wordpress_cve-2019-9787_defense

Wordpresscve-2019-9787defense お知らせ これは Sijia Zhanghttps://github.com/sijiahi と Bowen Zhouhttps://github.com/KonjakZhou によるプロジェクトです。 前提条件: 1 攻撃の再現: root@kitploit: - http://localhost/wp-admin/ で Wordpress5.0 を設定・インストールします。 - 管理者として Wordpress にログインし、少なくとも1つの記事を投稿します。 -...

XML-RPC-Pingback-Vulnerability

XML-RPC-Pingback-Vulnerability POC Это мой собственный написанный POC для уязвимости xmlrpc-pingback, обнаруженной в wordpress. CVE-2025-54352. Эта уязвимость затрагивает wordpress с версии 3.5 по 6.8.2...

CVE-2026-7025

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...

CVE-2026-7025

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...

CVE-2026-7025 Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...

CVE-2026-7025 Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...

CVE-2026-7025

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...

EUVD-2026-25700

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...

CVE-2026-7025

Typecho up to 1.3.0 is affected by a server-side request forgery in the Ping Back Service Endpoint: the function Service::sendPingHandle (var/Widget/Service.php). The X-Pingback/link parameter manipulation triggers SSRF, enabling remote access. Exploit publicly available; vendor not responsive to...

typecho 代码问题漏洞

Typecho is a PHP blog platform developed by Typecho’s individual developers. It’s simple yet powerful. Versions of Typecho 1.3.0 and earlier had code vulnerabilities. These vulnerabilities stemmed from improper handling of the X-Pingback/link parameter in the Service::sendPingHandle function with...

PT-2026-35206

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may...

CVE-2023-50858

Cross-Site Request Forgery CSRF vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34...