61 matches found
XSS2Shell
XSS2Shell XSS2Shell은 CVE-2026-64638 에 대한 교육용 개념 증명PoC으로, 취약한 WordPress 설치 환경에서 사전 인증 XSS 문제의 영향을 보여줍니다. 관리자의 명시적 참여 하에 PoC는 WordPress 애플리케이션 비밀번호를 캡처하고, 임시 페이지를 게시하며, 테스트 플러그인을 업로드하고, 생성된 셸 엔드포인트가 명령을 실행할 수 있는지 확인합니다. 기술 배경: WordPress 사전 인증 XSS에서 RCE로: CVE-2026-64638 교육 및 승인된 테스트 전용입니다. 이 도구는 소유하...
XSS2Shell-CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress: отражённый XSS до аутентификации → цепочка удалённого выполнения кода DOM Clobbering + кража пароля приложения + активация плагина через REST API = полный RCE ⚡ Обзор CVE-2026-64638 — это критическая отражённая XSS до аутентификации в wp-login.php WordPress...
CVE-2026-64638-PoC-Exploit
🌀 CVE‑2026‑64638 – WordPress XSS2Shell: комплекс безопасности ⚠️ ТОЛЬКО ДЛЯ ЭТИЧНОГО ИСПОЛЬЗОВАНИЯ – АВТОРИЗОВАННОЕ ТЕСТИРОВАНИЕ БЕЗОПАСНОСТИ Данный репозиторий предоставляет инструменты только для авторизованных специалистов по безопасности, blue team и пентестеров. Несанкционированный доступ к...
CVE-2026-8181
CVE-2026-8181 - Обход аутентификации в Burst Statistics CVSS 9.8 Критический — Обход аутентификации с захватом учётной записи администратора Описание CVE-2026-8181 — это уязвимость обхода аутентификации Authentication Bypass в плагине WordPress Burst Statistics версий с 3.4.0 по 3.4.1.1. Плагин...
CVE-2026-8181
CVE-2026-8181 Burst Statistics | 인증 우회를 통한 관리자 계정 탈취 설명 : Burst Statistics 3.4.0 - 3.4.1.1 - 인증 우회를 통한 관리자 계정 탈취 WordPress용 Burst Statistics – Privacy-Friendly WordPress Analytics Google Analytics Alternative 플러그인은 버전 3.4.0부터 3.4.1.1까지 인증 우회Authentication Bypass 취약점에 노출됩니다. 이는 Authorization 헤더의...
CVE-2026-8181
CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Contournement d'authentification menant à la prise de contrôle du compte administrateur Résumé de la vulnérabilité Le plugin WordPress Burst Statistics versions 3.4.0 à 3.4.1.1 est vulnérable à un contournement d'authentification non authentifié...
wp-secure-mcp
wp-secure-mcp Простыми словами: это позволяет ИИ-агенту читать и немного записывать данные на сайт WordPress через настоящий Application Password WordPress — тот же тип учётных данных, который уже выдаёт wp-admin — и ничего больше. Здесь нет формы регистрации, нет регистрации OAuth-клиента, нет...
EUVD-2026-87900
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...
EUVD-2026-76810
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...
CVE-2026-77753
The Temporary Login Without Password WordPress plugin versions prior to 1.9.9 contains an authenticated temporary access revocation bypass. The plugin fails to prevent temporary users from creating Application Passwords and does not revoke these credentials once the temporary access expires or is...
PT-2026-90562
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...
CVE-2026-77753: Improper Access Control
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...
Exploit for CVE-2026-8181
CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin...
EUVD-2026-55011
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...
CVE-2026-18960: Improper Authentication
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...
Exploit for CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...
Exploit for CVE-2026-64638
💥 CVE‑2026‑64638 – WordPress XSS2Shell S...
Exploit for CVE-2026-8181
CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Authenticat...