WP2Shell

WP2Shell - WordPress Pre-Auth RCE Exploit CVE-2026-63030 + CVE-2026-60137 Version: 4.0.0 Author: G0D150NE 📌 Overview WP2Shell is a full-chain exploit tool for WordPress pre-authentication remote code execution. It combines two critical vulnerabilities: CVE-2026-63030 - SQL Injection in REST API...

CVE-2026-60137-WordPress-Core-SQL-Injection-PoC

CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destructive proof-of-concept and verification harness for CVE-2026-60137 , a blind SQL injection in WordPress core WPQuery::authornotin, reachable via the REST API's authorexclude parameter. Root Cause WPQuery::getposts builds SQL by...

CVE-2026-79303

CVE-2026-79303 Boolean-blind SQL injection Description : Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures. Impact : SQLi CVSSv3.1 vector : AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 9.9 Critical CWE : CWE-89: Improp...

CVE-2026-62849

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated...

CVE-2026-61797

CVE-2026-61797 — GLPI PDF Plugin Time-Based Blind SQL Injection Proof of Concept for CVE-2026-61797 , a time-based blind SQL Injection vulnerability affecting the GLPI PDF plugin. The vulnerability can be reached through: /marketplace/pdf/front/preference.form.php In the vulnerable implementation...

CVE-2026-44706

SQL Injection in Chatwoot FilterService A proof-of-concept exploit for CVE-2026-44706, a SQL Injection vulnerability in Chatwoot's FilterServiceltgtfiltervalues that allows any authenticated agent to read the entire PostgreSQL database including user credentials and API tokens. Read the full...

CVE-2026-34220

CVE-2026-43220 MikroORM SQL Injection ★ CVE-2026-43220 MikroORM SQL Injection PoC ★ https://github.com/user-attachments/assets/33724cfc-6151-47ff-9415-2f50c5124cd1 Overview CVE-2026-43220 is a SQL Injection vulnerability in MikroORM , a widely used TypeScript/Node.js ORM framework. When a...

CVE-2024-27956-RCE

CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage git clone...

CVE-2025-69295

CVE-2025-69295 — TeconceTheme Coven Core Blind SQL Injection Vulnerability CVE-2025-69295 is a SQL Injection vulnerability affecting the Coven Core component of the TeconceTheme Coven Core WordPress theme. The vulnerability exists due to improper neutralization of user-supplied input before it is...

Metabase-Setup-Endpoint-SQLi-Fix

CVE-2026-72898: Metabase Setup Endpoint SQLi Patch This repository contains the hotfix for CVE-2026-72898 , an unauthenticated SQL Injection vulnerability in the setup endpoint of self-hosted Metabase instances. Left unpatched, attackers can bypass the setup token validation, execute arbitrary...

CVE-2026-60137-and-CVE-2026-63030

wp2shell Lab — CVE-2026-60137 & CVE-2026-63030 WordPress Core Pre-Auth RCE lab — real exploitation, server RCE. WARNING: Lab chạy WordPress VULNERABLE. Không expose ra internet. Structure . ├── docker-compose.yml Lab: WordPress 6.9.4 + MariaDB 11 + phpMyAdmin ├── exploit/ PoC exploit cloned from...

Online-Examination-System

Online-Examination-System a full web platform with 3 roles: Ad...

EUVD-2026-114457

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated...

CVE-2026-62849

The enterprise IoT platform ThingLinks contains an unauthenticated SQL injection vulnerability in the TDengine TDS APIs prior to version 1.4.0 . The flaw exists because request-controlled JSON field values submitted to the /anyUser/tds/insertTableData endpoint reach unsafe SQL construction within...

CVE-2026-62849 ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated...

CVE-2026-62849 ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated...

WordPress WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden plugin <= 3.5.6 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin WP2LEADS versions = 3.5.6...

CVE-2026-61620

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL DSL by calling keyword or symbol on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a JDBC driver. So...

WordPress Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin <= 1.2.2 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by sermsak in WordPress Plugin Majestic Support versions = 1.2.2...

WordPress Newsletters plugin <= 4.18.1 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin Newsletters versions = 4.18.1...