201 matches found
fakelogonscreen
FakeLogonScreen FakeLogonScreen は、Windows ログイン画面を偽装してユーザーのパスワードを取得するためのユーティリティです。入力されたパスワードは、Active Directory またはローカルマシンに対して検証され、正しいことが確認された後、コンソールに表示されるか、またはディスクに保存されます。 実行方法は、単に .exe ファイルを実行するか、例えば Cobalt Strike の execute-assembly コマンドを使用することもできます。 バイナリは Releases ページから入手できます。 FakeLogonScreen.ex...
CVE-2026-64638
🛡️ CVE-2026-64638 - XSS2Shell WordPress 预认证反射型 XSS 并可能升级为 PHP 代码执行 📌 概述 CVE-2026-64638 是一个影响 WordPress 登录界面的高危预认证反射型跨站脚本（XSS）漏洞。 在特定条件下，该漏洞可被串联利用，进而在服务器上实现远程代码执行（RCE） （研究人员将这一利用链称为 XSS2Shell ）。 属性| 详情 ---|--- CVE ID| CVE-2026-64638 严重性| 高危（CVSS 8.9） 攻击向量| 网络 所需权限| 无 用户交互| 需要（用于完整 RCE 链） 影响| 机密性 •...
CVE-2026-64638
CVE-2026-64638 // XSS2Shell 针对 CVE-2026-64638 （ XSS2Shell ）向量的技术分析与防御性缓解矩阵，这是 WordPress Core 身份验证界面解析过程中的一个严重不一致缺陷，可借助浏览器原语将预认证的反射型跨站脚本（XSS）链式利用，最终实现远程代码执行（RCE）。 🛠️ 执行摘要 向量 ID： CVE-2026-64638 代号： XSS2Shell 严重性： 高（CVSS 4.0: 8.9） CWE 分类： CWE-79（在生成网页时对输入的错误中和） 发现者： pwn.ai 利用状态： 已有公开详情；需要立即更新。 🔬...
Rocky Linux 8 [CIQ] Security Update: gnome-shell / gnome-shell-debuginfo / gnome-shell-debugsource (crlsa-2022_1814)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221814 advisory. gnome-shell: Password from logged-out user may be shown on login screen CVE-2020-17489 Tenable has extracted the preceding description block directly from the CIQ...
WordPress XSS2Shell 4.7.0 < 4.7.34 / 4.8.0 < 4.8.29 / 4.9.0 < 4.9.30 / 5.0.0 < 5.0.26 / 5.1.0 < 5.1.23 / 5.2.0 < 5.2.25 / 5.3.0 < 5.3.22 / 5.4.0 < 5.4.20 / 5.5.0 < 5.5.19 / 5.6.0 < 5.6.18 / 5.7.0 < 5.7.16 / 5.8.0 < 5.8.14 / 5.9.0 < 5.9.14 / 6.0.0 < 6.0.13 / 6.1.0 < 6.1.11 / 6.2.0 < 6.2.10 / 6.3.0 < 6.3.9 / 6.4.0 < 6.4.9 / 6.5.0 < 6.5.9 / 6.6.0 < 6.6.6 / 6.7.0 < 6.7.6 / 6.8.0 < 6.8.7 / 6.9.0 < 6.9.6 / 7.0.0 < 7.0.3 Login Screen XSS
The version of WordPress installed on the remote host is 4.7.x prior to 4.7.34, or 4.8.x prior to 4.8.29, or 4.9.x prior to 4.9.30, or 5.0.x prior to 5.0.26, or 5.1.x prior to 5.1.23, or 5.2.x prior to 5.2.25, or 5.3.x prior to 5.3.22, or 5.4.x prior to 5.4.20, or 5.5.x prior to 5.5.19, or 5.6.x...
Exploit for CVE-2026-64638
🛡️ CVE-2026-64638 - XSS2Shell WordPress Pre-Authentic...
CVE-2026-64638
WordPress Core suffers a pre-auth reflected XSS on wp-login.php that can escalate to RCE via an attacker-controlled page, in a chain dubbed XSS2Shell. The attack requires social engineering and explicit user interaction, and can affect all versions before the emergency 7.0.3 patch (backported to ...
CVE-2026-64638: Improper Neutralization of Input During Web Page Generation
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...
PT-2026-68882
Name of the Vulnerable Software and Affected Versions WordPress affected versions not specified Description WordPress is subject to a pre-authentication reflected cross-site scripting XSS issue on the login screen. This allows an attacker to execute arbitrary JavaScript in the site origin without...
CVE-2026-54088 File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplie...
EUVD-2009-3514
Malware in sbrugna...
EUVD-2009-1202
Malware in sbrugna...
EUVD-2016-5051
Malware in sbrugna...
EUVD-2018-10521
Malware in sbrugna...
EUVD-2006-5945
Malware in sbrugna...
EUVD-2019-15514
Malware in sbrugna...
EUVD-2009-1430
Malware in sbrugna...
EUVD-2020-12595
Malware in sbrugna...