CVE-2022-45599

CVE-2022-45599 CVE URL:| https://vulners.com/cve/CVE-2022-45599 ---|--- Reported by:| TanYeeTat Product:| Aztech WMB250AC Wireless Mesh Routers Affected Firmware:| 2020 Release topaz-linux.lzma.img Firmware download:| closed source Product Manual: https://kylaconnect.com/download-center/...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting

NUUO NVRsolo Video Recorder 03.06.02 contains a reflected cross-site scripting vulnerability via login.php. id: CVE-2022-33119 info: name: NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting author: arafatansari severity: medium description: | NUUO NVRsolo Video Recorder 03.06.02 contains...

CVE-2026-82611

A SQL injection vulnerability exists in the Customer::cusAuthentication function of the /login.php file (Customer Login Interface) in itsourcecode Online Medicine Delivery System 1.0 . Manipulation of the U_USERNAME parameter allows a remote, unauthenticated attacker to inject SQL queries. The ex...

CVE-2026-82611 itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument UUSERNAME causes sql injection. The...

CVE-2025-47227

CVE-2025-47227 Exploit for CVE-2025-47227 - ScriptCase Password Reset Pre-Auth CVE-2025-47227 is a pre-auth authentication bypass CVSS 9.8 in the ScriptCase Production Environment ≤ 9.12.006. The login.php endpoint allows resetting the administrator password without a token, email validation, or...

xss2shell-check

xss2shell-check Non-destructive, dependency-free detector for the CVE-2026-64638 "XSS2Shell" reflection primitive in WordPress wp-login.php. Background CVE-2026-64638 is a pre-authentication reflected XSS in WordPress core , disclosed by PWN.AI on 2026-08-07 CVSS 8.9, CWE-79 and patched in 7.0.3...

XSS2Shell-CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress 预认证反射型 XSS → 远程代码执行链 DOM Clobbering + 应用密码窃取 + REST API 插件激活 = 完整 RCE ⚡ 概述 CVE-2026-64638 是 WordPress wp-login.php 中的一个严重预认证反射型 XSS 漏洞。该漏洞源于登录错误消息在回显提交的用户名时未进行正确的 HTML 编码 ，从而允许通过 进行 DOM Clobbering，绕过大多数过滤器。 当与 WordPress 的应用密码功能链式利用时，此 XSS 可成为完整远程代码执行 攻击链 ——...

CVE-2026-64638-XSS-to-Shell-PoC

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concept PoC tool for validating CVE-2026-64638 , a pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting WordPress installations versions 6.4 – 7.0.2. Overview This tool automates the process of fingerprinting,...

CVE-2026-64638-PoC-XSS2Shell-

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026-64638 · Reflected XSS on wp-login.php · CVSS 8.9 v4.0 · Patched in WordPress 7.0.3 ⚠️ AUTHORIZED TESTING ONLY. This tool is for security research and authorized penetration testing against systems you own or have explicit written...

CVE-2026-64638

CVE-2026-64638 CVE-2026-64638 prova rapida root@kitploit: import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text oppure root@kitploit: POST /wp-login.php...

POC-WP-XSS2Shell-CVE-2026-64638

XSS2Shell — PoC di CVE-2026-64638 Proof of Concept educativa della catena XSS2Shell CVE-2026-64638, vulnerabilità pre-autenticazione XSS → RCE nel WordPress Core scoperta in modo autonomo da pwn.ai e divulgata il 7 agosto 2026. Indice dei contenuti 1. Sommario esecutivo 2. Avviso legale 3...

CVE-2026-64638

CVE-2026-64638 — XSS2Shell: XSS pre-autenticazione nella pagina di login di WordPress → RCE sul server Mirror di distribuzione HackSpeak. Questo repository è un mirror distributivo del PoC didattico XSS2Shell CVE-2026-64638 pubblicato da WordSec , con codice identico all'upstream; l'upstream è MI...

CVE-2025-65881

CVE-2025-65881 Il progetto Zoo Management System v1.00 è vulnerabile a Cross-site scripting XSS su /zms/classes/Login.php?f=login a causa di: 1. Content-type non valido delle risposte JSON su /zms/classes/Login.php?f=login 2. Input utente non sanificato nelle risposte Consentendo a attaccanti non...

cve-2026-64638-banner-poc

CVE-2026-64638 — PoC Banner Universale Un generatore di PoC a file singolo, senza dipendenze, per l'iniezione HTML riflessa CVE-2026-64638 di WordPress su wp-login.php differenziale tra striptags e il parser KSES. Produce una pagina trigger auto-inviante: quando la vittima apre il file, la pagina...

CVE-2026-29861

CVE-2026-29861 🛡️ Divulgazione CVE: CVE-2026-29861 — SQL Injection in PHP-MYSQL-User-Login-System Data di divulgazione: 10 aprile 2026 ID CVE: CVE-2026-29861 Gravità: CRITICA CVSS 9.8 🧩 Riepilogo Una vulnerabilità critica di SQL Injection esiste in PHP-MYSQL-User-Login-System v1.0, in particolare...

CVE-2023-48858

CVE-2023-48858 PoC per CVE-2023-48858 Una vulnerabilità Cross-site scripting XSS nel codice PHP della pagina di login in Armex ABO.CMS 5.9 consente a utenti remoti di iniettare script web arbitrari o HTML tramite la parte URL login.php?. Proof of Concept:...

CVE-2025-60736

CVE-2025-60736: Vulnerabilità di SQL Injection nella Guida Medica Online Riepilogo Esecutivo Questo documento descrive una vulnerabilità critica di SQL injection scoperta nell'applicazione web Guida Medica Online. La vulnerabilità consente un accesso non autorizzato al database e comporta rischi...

CVE-2025-11177

Auslösen der SQLi mit einem zeitbasierten Payload im öffentlichen Login root@kitploit: curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...

TheMisfits-CVE-2024-8465-SQLi

CVE-2024-8465 – Prova de Conceito de Injeção SQL Informações da Equipe Nome da Equipe: The Misfits Membros da Equipe: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Visão Geral Este repositório contém uma aplicação web vulnerável criada como Prova de Conceito PoC para...