wp2shell

wp2shell Exploit WordPress REST API route confusion CVE-2026-63030 + SQL injection CVE-2026-60137 in the batch endpoint to achieve Remote Code Execution. Vulnerabilities Route Confusion CVE-2026-63030 The WordPress REST API batch endpoint /batch/v1 does not properly isolate request routing. By...

CVE-2025-61506

Se descubrió un problema en MediaCrush hasta la versión 1.0.1 que permite a atacantes remotos no autenticados cargar archivos arbitrarios de cualquier tamaño en el endpoint /upload. Vulnerabilidad: Carga de archivos sin restricciones CWE-434 CVE ID: CVE-2025-61506 DESCUBRIDO : 18 de septiembre...

CVE-2022-21306

CVE-2022-21306 POC, EXP, chatGPT for me, solo puedo dar algunas ideas, ninguno es funcional. code root@kitploit: import json import requests targeturl = "http://127.0.0.1:7001" headers = 'User-Agent': 'Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/58.0.3029.1...

CVE-2025-68621

CVE-2025-68621 — Trilium Notes Timing Attack on /api/login/sync Severity: HIGH CVSS 7.4 Affected Software: TriliumNext/Trilium 0.101.0 Vulnerability Type: CWE-208 – Observable Timing Discrepancy Fixed In: Trilium 0.101.0 PR 8129 Published: 2026-02-06 | Reserved: 2025-12-19 Table of Contents 1. My...

CVE-2025-12585

MxChat Basic = 2.5.1 - MxChat – Chatbot de IA para WordPress = 2.5.1 - Exposición de información no autenticada El complemento MxChat Basic no verifica la propiedad de la sesión en el endpoint AJAX mxchatfetchconversationhistory, lo que permite a usuarios no autenticados acceder al historial de...

CVE-2022-41080

CVE-2022-41080 Descripción CrowdStrike descubrió recientemente un nuevo método de explotación llamado OWASSRF que consiste en CVE-2022-41080 y CVE-2022-41082 para lograr la ejecución remota de código RCE a través de Outlook Web Access OWA. El nuevo método de explotación evade las mitigaciones de...

CVE-2025-12135

WPBookit getparam'csscode'; $jscode= $request-getparam'jscode'; updateoption 'wpbcustomcodedata', 'csscode' = $csscode, 'jscode' = $jscode ; Code execution from /core/shortcodes/class-wpbookit-shortcode-abstract.php:20-27: root@kitploit: $wpbcustomcode= getoption 'wpbcustomcod...

CVE-2025-4602

eMagicOne Store Manager para WooCommerce = 1.2.5 - Lectura Arbitraria de Archivos No Autenticada El plugin Administrador de Tienda eMagicOne para WooCommerce expone un punto final de protocolo de gestión remota ?connector=bridge que permite operaciones de eliminación de archivos en el servidor. E...

cve-2025-5781_FreePBX

cve-2025-5781FreePBX In August 2025, a critical vulnerability was disclosed in the FreePBX Endpoint module. CVE-2025–57819 allows an unauthenticated attacker to exploit SQL injection in the Endpoint module and, through a chain of database manipulation and scheduled task execution, achieve remote...

lm-fingerprint

LM-Fingerprint Fingerprints the serving stack behind an OpenAI-compatible chat endpoint. It records tokenizer accounting, hidden template offset, validation prose, JSON/SSE shape, role acceptance, named limits, and gateway headers. It does not load weights, store API keys, or ask the model who it...

CVE-2022-1388

BIG-IP iControl REST vulnerability CVE-2022-1388 PoC This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services PoC You can...

Strutshock

Strutshock Uso strutshock http://example.com/index.action...

EUVD-2026-87901

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96899

The Optima Express IDX WordPress plugin (versions 8.6.0 - 8.7.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to properly neutralise a script value submitted via a REST endpoint before storing it and subsequently echoing it into the document head ...

CVE-2024-28397-Reverse-Shell

CVE-2024-28397-Reverse-Shell Reverse shell para CVE-2024-28397. El exploit funciona para js2py = v0.74 Requisitos Librería requests pip install requests Python3 Netcat O algo que puedas usar como listener para la reverse shell Uso Para el listener root@kitploit: nc -lnvp 4444 Para el exploit...

cve-2026-23550-poc

CVE-2026-23550 PoC A small Bash tester for CVE-2026-23550. It requests the affected WordPress modular connector login endpoint, checks whether a wordpressloggedin cookie is issued, and attempts to confirm access to the admin dashboard. Warning: Use this tool only against systems you own or have...

CVE-2025-2304-POC

CVE-2025-2304-POC PoC for CVE-2025-2304 — Camaleon CMS 2.9.0 privilege escalation via mass assignment on the password change endpoint. Vulnerability The /admin/users/:id/updatedajax endpoint does not filter the role parameter before passing it to the model update, allowing any authenticated user ...

CVE-2024-8682

CVE-2024-8682 - PoC de Registro No Autenticado en JNews JNews = 11.6.6 tiene una vulnerabilidad que permite el registro de usuarios no autenticados a través del endpoint ?ajax-request=jnews, incluso cuando el registro de WordPress está desactivado. Esto funciona obteniendo primero un jnewsnonce...

CVE-2026-61946-Easy-Appointments-IDOR

CVE-2026-61946: One Appointment ID to Somebody Else's Booking I found an unauthenticated insecure direct object reference in the WordPress Easy Appointments plugin. The public reservation endpoint accepted an id from the query string and passed the resulting data into the plugin's database replac...