13734 matches found
CVE-2026-63030-Wp2Shell
CVE-2026-63030 wp2shell — WordPress Core Pre-Auth RCE REST API batch route confusion chained with CVE-2026-60137 SQL injection TL;DR — An unauthenticated attacker can chain a WordPress REST API batch-routing bug with a SQL injection in WPQuery to reach full remote code execution on a stock...
wp2shell-poc
How does this work at all How this PoC differs from the public wp2shell exploits all pocs weaponize the same two bugs - the REST batch route confusion CVE-2026-63030 and the authornotin SQL injection CVE-2026-60137 - with the same double-nested batch shape. What differs between them is the RCE pa...
wp2shell
🔍 wp2shell - WordPress CVE-2026-63030 Vulnerability Scanner & Exploit ⚡ Fast, Real-time Vulnerability Scanner & Exploit for CVE-2026-63030 wp2shell 📌 Overview wp2shell is a comprehensive toolkit for detecting and exploiting CVE-2026-63030 , a critical vulnerability in WordPress that allows...
struts_rest_rce_fuzz-CVE-2017-9805-
This repository does not have a README...
abdal-cve-2026-63030
English | فارسی 🛡️ Abdal CVE-2026-63030 PoC Exploits Abdal CVE-2026-63030 is a defensive WordPress exposure verifier for the REST API batch route confusion tracked as CVE-2026-63030. The issue can be chained with CVE-2026-60137 on affected WordPress releases and may lead to remote code execution...
CVE-2022-45354
Download Monitor = 4.7.60 - Sensitive Information Exposure via REST API CVE-2022-45354:version found on http://wordpress.lan Details : CVE-2022-45354:version matched at http://wordpress.lan Protocol : HTTP Full URL : http://wordpress.lan/wp-content/plugins/download-monitor/readme.txt Timestamp :...
CVE-2021-42559
CVE-2021-42559: Inyección de comandos mediante configuraciones en MITRE Caldera Caldera versiones =2.8.1 contiene múltiples "requisitos" de inicio que ejecutan comandos al iniciar el servidor. Debido a que estos comandos se pueden cambiar mediante la API Rest, un usuario autenticado puede inserta...
wpUsersScan
wpUsersScan Acerca de wpUsersScan Enumera la lista de usuarios de sitios WordPress a través de la API REST / CVE-2017-5487, WordPress 4.7.1 - Enumeración de nombres de usuario Uso root@kitploit: $ python wpUsersScan.py URL Cómo instalar Clonar Clona el repositorio con: root@kitploit: $ git clone...
CVE-2024-4898
CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...
wp2shell
wp2shell - PoC de RCE en WordPress CVE-2026-63030 + CVE-2026-60137 Ejecución Remota de Código no autenticada en el núcleo de WordPress por: JohenLastGen 📌 Resumen Esta herramienta encadena dos vulnerabilidades críticas de WordPress para lograr RCE no autenticado : Vulnerabilidad| CVE| Descripción...
drupal8-REST-RCE
drupal8-REST-RCE CVE-2019-6340 drupal8-REST-RCE /node/1 , CVE-2018-7600 drupal8 RCE /user/register Unix/Linux command - remote code Execution command "id" Usage root@kitploit: python drupal8-REST-RCE.py user defined port python drupal8-REST-RCE.py default : 80/tcp updated! Script editted for...
CVE-2021-40539
CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability I: Vulnerability Description ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...
wp2shell
wp2shell WordPress REST batch route-confusion blind SQL injection — automated exploit chain. CVE-2026-63030 / CVE-2026-60137 | ---|--- Affected| WordPress 6.9.0 – 6.9.4 and 7.0.0 – 7.0.1 Fixed| WordPress 6.9.5 / 7.0.2 Sink| authornotin SQL via desync'd authorexclude parameter Auth required| None...
CVE-2022-47615
CVE-2022-47615 LearnPress Plugin 4.2.0 - Unauthenticated LFI Description Description The plugin does not validate various parameters in the lp/v1/courses/archive-course REST endpoints before using them in include statement, which could lead to LFI issues. How to use root@kitploit: $ python3...
wp2shell-scanner
wp2shell-scanner by@bahartanir katherinepierce Fork of ZephrFish/wp2shell-scanner with additional improvements. Research by Adam Kues Assetnote and Mustafa Can İPEKÇİ nukedx. Detection and validation tooling for WordPress core exposure to wp2shell CVE-2026-63030 / CVE-2026-60137. Modes are select...
CVE-2026-92882: Insufficiently Protected Credentials
Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...
CVE-2026-95665: Improper Neutralization of Input During Web Page Generation
MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...
CVE-2024-4898-Poc
CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Autorización faltante para configuración de API no autenticada/Actualización arbitraria de opciones/Creación de usuario administrativo...
wp2shell-poc2
wp2shell-poc Prueba de concepto para una inyección SQL no autenticada en el núcleo de WordPress que encadena a ejecución remota de código, mediante confusión de ruta en el endpoint REST batch CVE-2026-63030. El exploit no requiere credenciales ni configuración más allá de un objetivo accesible...