vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-29927 Authorization Bypass reproduction This repository is a reproduction of the CVE-2025-29927 vulnerability in the next package How to reproduce 1. Follow the steps below to clone, and run the Next.js application 2. Test authorization denies access to the /api/hello endpoint...

wp2shell-poc2

wp2shell-poc Prueba de concepto para una inyección SQL no autenticada en el núcleo de WordPress que encadena a ejecución remota de código, mediante confusión de ruta en el endpoint REST batch CVE-2026-63030. El exploit no requiere credenciales ni configuración más allá de un objetivo accesible...

CVE-2026-63030-wp2r00t

wp2r00t - PoC de Inyección SQL Ciega por Confusión de Rutas en el Endpoint Batch de WordPress Una prueba de concepto autónoma para la inyección SQL ciega no autenticada alcanzable a través del endpoint batch REST de WordPress /wp-json/batch/v1. Es una implementación independiente construida a...

CVE-2025-29927_Scanner

CVE-2025-29927 Checker 📌 Introduction This script checks for the CVE-2025-29927 vulnerability in Next.js servers by testing multiple payloads in the x-middleware-subrequest header to detect unauthorized access. ❓ What is CVE-2025-29927? CVE-2025-29927 is a vulnerability that allows security...

wp2shell-lab

wp2shell-lab PoC educativo y laboratorio para CVE-2026-63030 + CVE-2026-60137 : inyección SQL sin autenticación en el núcleo de WordPress mediante confusión de rutas batch REST. Descubierto por Adam Kues Searchlight Cyber / Assetnote. Corregido en WordPress 6.9.5 / 7.0.2. Inicio rápido...

wp-cve-2026-63030-check

wp2shell-check Non-intrusive exposure checker for the WordPress "wp2shell" pre-authentication RCE chain CVE-2026-63030 + CVE-2026-60137. ⚠️ Authorized use only. Run this only against WordPress instances you own or have explicit permission to test. It is a triage aid, not an exploit. Scanning...

CVE-2026-27966

CVE-2026-27966 — Langflow Remote Code Execution Scanner Pre-Auth Route Injection + Vertex Injection → Python Code Execution Overview CVE-2026-27966 is a critical-severity CVSS 9.8 pre-authentication remote code execution vulnerability in Langflow versions prior to 1.8.0. The vulnerability stems...

CVE-2026-77518

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...

EUVD-2026-84170

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

CVE-2026-46454

camel-cometd Inbound Bayeux Header Injection Reproducer CVE-2026-46454 This project demonstrates a message-header injection in Apache Camel's camel-cometd component, tracked as CVE-2026-46454. The component maps inbound Bayeux CometD message headers into the Camel Exchange without...

WordPresShell

WordPresShell Pre-auth RCE PoC for CVE-2026-63030 + CVE-2026-60137 WordPress core. REST /batch/v1 route confusion → WPQuery authornotin SQLi → unauthenticated admin creation → webshell. Single file, Python stdlib only. Vulnerability: Adam Kues Searchlight Cyber. Affected: 6.9.0–6.9.4, 7.0.0–7.0.1...

CVE-2026-63030

CVE-2026-63030 WordPress REST API batch route confusion + SQL injection leading to unauthorized admin creation → Remote Code Execution RCE complete exploit chain PoC. For authorized security testing, vulnerability reproduction, and research only. Do not use against unauthorized targets...

wp2shell-rce

WP2Shell RCE An assessment and scanning utility designed to detect exposure to the WP2Shell exploit chain in WordPress Core installations across single endpoints or large target lists. ⚠️ Disclaimer Only scan systems you own or are authorized to assess. Unsanctioned scanning or testing of...

Urgent11-Suricata-LUA-scripts

Urgent11-Suricata-LUA-scripts Suricata LUA scripts to detect CVE-2019-12255, CVE-2019-12256, CVE-2019-12258, and CVE-2019-12260 CVE-2019-12255 The script checks for CVE-2019-12255, the packet that is checked needs to have the PSH, ACK, and URG flags set, and have a payload size that exceeds 1500...

wp2shell

wp2shell Pre-authentication Remote Code Execution against WordPress Core. Chains CVE-2026-60137 SQLi in authornotin / authorexclude parameter of WPQuery with CVE-2026-63030 REST API batch-route confusion for unauthenticated RCE. Affected Versions...

wordpress-cve-2026-63030

WordPress REST API Confusión de Rutas Batch + Inyección SQL → RCE Pre-autenticación, sin autenticación, no se requieren plugins. Funciona contra una instalación estándar de WordPress a través del endpoint batch de la API REST...

wp2shell

wp2shell por: ek0ms savi0r Ejecución remota de código no autenticada para WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell es un exploit para una cadena de vulnerabilidades críticas en el núcleo de WordPress. Encadena un fallo de confusión de rutas en el lote de la API REST con una...

cve-2026-63030-lab

CVE-2026-63030 — wp2shell Lab Pre-Authentication RCE in WordPress Core via REST API Batch Route Confusion + SQL Injection...

nextjs-vulnerable-app

Aplicación de Autenticación con Next.js Esta es una aplicación de Next.js que implementa autenticación utilizando NextAuth.js. La aplicación cuenta con rutas protegidas que requieren que los usuarios estén autenticados para acceder a ciertas páginas. Estructura del Proyecto root@kitploit:...

CVE-2026-9997-VPN-Split-Tunneling-Bypass-via-DHCP-Option-Injection

CVE-2026-9997 – VPN Split‑Tunneling Bypass via DHCP Option Injection Program Code Python simulated DHCP server + client root@kitploit: !/usr/bin/env python3 roguedhcpserver.py - Injects a static route to bypass VPN split tunnel import socket, struct, threading def senddhcpofferclientmac, offerip:...