43 matches found
wp2shell-lab
wp2shell lab & detector + pre-auth RCE PoC A self-contained lab, non-destructive detector , and full pre-auth RCE proof-of-concept for wp2shell — the pre-authentication vulnerability chain in WordPress core: CVE| Component| Class| CVSS ---|---|---|--- CVE-2026-60137| WPQuery::authornotin| SQL...
POC_CVE-2026-41940
POCCVE-2026-41940 Quick start python3 pocCVE-2026-41940.py -h Usage examples Scan one host python3 pocCVE-2026-41940.py -u https://target.example:2086 List accounts after successful chain python3 pocCVE-2026-41940.py -u https://target.example:2086 --action list Run a shell command python3...
wp2shell-scanner
wp2Shell Scanner – with PoC CVE-2026-63030 and CVE-2026-60137 – WordPress wp2shell vulnerability-chain scanner Authorized security-research tool with optional command-verification PoC. wp2shell-scanner detects the WordPress wp2shell vulnerability chain by validating public WordPress evidence,...
CVE-2025-53694-to-CVE-2025-53691
Sitecore CVE Chain Exploits This repository contains proof-of-concept exploits for a critical vulnerability chain in Sitecore Experience Platform XP versions up to 10.4.1. Vulnerabilities CVE-2025-53694: Information Disclosure CVE-2025-53693: Cache Poisoning CVE-2025-53691: Remote Code Execution...
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales
A year ago we wrote that we'd put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted...
CVE-2026-44103
The CVE-2026-44103 entry details an unauthenticated remote code/integrity issue where the JupiCore firmware update mechanism transmits updates without integrity or verification checks, allowing an attacker to inject malicious firmware into the internal charging module. This could compromise devic...
PT-2026-66431
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This...
WP2Shell WordPress Exploit Technical Analysis and Real Attack Data
On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a...
Exploit for Deserialization of Untrusted Data in Dataease
DataEase — Unauthenticated RCE via a 4-vulnerability chain CV...
wp2shell
wp2shell — Pre-Auth RCE in WordPress core Unauthenticated W...
vulnerability_chain_exploitation_lab_new
No d...
Exploit for Path Traversal in Tp-Link Tapo_C260_Firmware
Tapo C260 RCE Chain CVE-2026-0651 / CVE-2026-0652 / CVE-2026-...
The Hardest Fork
Mythos is real. I know a big chunk of the industry thinks it's a marketing stunt, and I get why. I get it. But I've seen the findings, and they're bad. These aren't "whoops, this line right here is wrong, and that's RCE." They're novel combinations of a few dozen issues out of thousands of things...
Linux Kernel - Local Privilege Escalation
Titles: Linux Kernel Local Privilege Escalation CVE-2026-43284 / CVE-2026-43500 / CVE-2026-46300 Author: nu11secur1ty Date: 2026-05-11 Vendor: Linux Kernel Software: Linux Kernel All major distributions Vulnerability Type: Page-Cache Write / Memory Corruption Status: HIGH / CRITICAL --- Descripti...
Exploit for CVE-2026-47102
CVE-2026-47102 – LiteLLM Privilege Escalation via /user/updat...
PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks
A pro-Ukrainian hacktivist group called PhantomCore has been attributed to attacks actively targeting servers running TrueConf video conferencing software in Russia since September 2025. That's according to a report published by Positive Technologies, which found the threat actors to be leveragin...
GHSA-37J7-56XC-C468 Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Affected Versions: Tested on current dev branch build fingerprint 505...7bd86 CVSS v4 Score: 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Privileges Required: Web application admin account for file write, any authenticated user for RCE trigger --- Summary Two separate...
📄 Sitecore Experience Manager / Experience Platform 10.1 Shell Upload / Hardcoded Credentials
Proof of concept exploit for a remote code execution vulnerability chain affecting Sitecore Experience Platform versions 10.x combining hardcoded credentials with file upload vulnerabilities for complete system compromise...