CVE-2026-63030

CVE-2026-63030: wp2shell Exploit de inyección SQL por desincronización de la API Batch de WordPress Herramienta de prueba de concepto para extraer usuarios y hashes de contraseñas mediante la vulnerabilidad CVE-2026-63030 wp2shell. Información de la vulnerabilidad CVE : CVE-2026-63030 wp2shell CV...

CVE-2026-63030-WP2Shell

CVE-2026-63030 | WP2Shell Explotado por gr1tx WP2Shell es una Prueba de Concepto PoC basada en Python para CVE-2026-63030. Realiza la verificación de vulnerabilidad basada en tiempo contra la API Batch de WordPress y genera informes detallados en HTML y JSON. El proyecto está destinado a...

wp2shell-checker

root@kitploit: \ \ / / \ / || | | | | | | | \ \ /\ / /| | | \ | || | | | | | | \ V V / | // / | | || || | // || ||/|| ||||| wp2shell-checker | Detector de Desincronización de la API Batch de WordPress Detector comprobador para la RCE pre-autenticación de la API REST Batch de WordPress Core...

wordpress-skelersecurity-core-security-CVE-2026-63030

SkelerSecurity Core 安全插件 一个针对性、临时性的缓解措施，用于防范对 WordPress Core REST Batch API 端点的未认证访问。 概述 SkelerSecurity Core 安全插件 要求在进行认证之后，WordPress 才能处理对 Core REST Batch API 路由的请求： /wp-json/batch/v1 /?restroute=/batch/v1 它被设计为针对常被称为 wp2shell 的 WordPress REST Batch API 漏洞链的一个有限范围内的深度防御控制措施。该插件使用 WordPress 的...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 | WP2Shell xpl0ited by gr1txhttps://gith...

WordPress 5.6+ SkelerSecurity Core Security Plugin REST Batch API Mitigation

This WordPress plugin provides a temporary mitigation for the REST Batch API vulnerability chain commonly referred to as "wp2shell." It requires authentication before requests to the /wp-json/batch/v1 and ?restroute=/batch/v1 endpoints are processed, preventing unauthenticated exploitation of the...

Exploit for CVE-2026-60137

wp2shell Pre-authentication Remote Code Execution against Wor...

WordPress vulnerabilities can be addressed through Automattic.

There are two vulnerabilities present in WordPress Core 6.8.6, 6.9.5, and 7.0.2. An unauthorized malicious individual can exploit these vulnerabilities to execute arbitrary code remotely. To do this, a malicious HTTP request must be sent to the batch API of a WordPress site. Since vulnerabilities...

InvenTree 安全漏洞

InvenTree is an open-source inventory management system developed by InvenTree. It provides robust low-level inventory control and parts tracking capabilities. Versions of InvenTree prior to 1.2.6 contained security vulnerabilities. These vulnerabilities stemmed from the batch operation API...

ipa: Batch API logging user passwords to /var/log/httpd/error_log

A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party...

RHEL 8 : idm:DL1 (RHSA-2020:1269)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1269 advisory. Red Hat Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and...

Scientific Linux Security Update : ipa on SL7.x x86_64 (20200205)

Security Fixes : - ipa: Denial of service in IPA server due to wrong use of berscanf CVE-2019-14867 - ipa: Batch API logging user passwords to /var/log/httpd/errorlog CVE-2019-10195 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

ipa: Batch API logging user passwords to /var/log/httpd/error_log

A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party...

Important: Red Hat Security Advisory: ipa security and bug fix update

An update for ipa is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

ipa: Batch API logging user passwords to /var/log/httpd/error_log

A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party...

EntityBulkDelete - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-089

EntityBulkDelete module allows you to delete entities in bulk using the Batch API. The module doesn't sufficiently sanitize user supplied text in some administration pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must be...