CVE-2022-45599

CVE-2022-45599 URL de CVE:| https://vulners.com/cve/CVE-2022-45599 ---|--- Reportado por:| TanYeeTat Producto:| Aztech WMB250AC Wireless Mesh Routers Firmware afectado:| Lanzamiento 2020 topaz-linux.lzma.img Descarga de firmware:| código cerrado Manual del producto:...

CVE-2026-30252

ZenShare Suite - Vulnerability Disclosure This repository contains details regarding multiple Reflected Cross-Site Scripting XSS vulnerabilities discovered in the ZenShare Suite application. Vulnerability Overview The ZenShare Suite application is vulnerable to Reflected Cross-Site Scripting XSS...

CVE-2026-105233

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to...

EUVD-2026-92256

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to...

CVE-2026-105233

A session fixation vulnerability exists in the Login Flow component of the kishor-23 food-waste-management-system (specifically within the login.php file). The root cause involves the manipulation of the PHPSESSID argument, which allows for remote exploitation. While the exploit has been disclose...

CVE-2026-105233 kishor-23 food-waste-management-system Login Flow login.php session fixiation

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to...

CVE-2026-105233 kishor-23 food-waste-management-system Login Flow login.php session fixiation

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to...

xss2shell-check

xss2shell-check Non-destructive, dependency-free detector for the CVE-2026-64638 "XSS2Shell" reflection primitive in WordPress wp-login.php. Background CVE-2026-64638 is a pre-authentication reflected XSS in WordPress core , disclosed by PWN.AI on 2026-08-07 CVSS 8.9, CWE-79 and patched in 7.0.3...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting

NUUO NVRsolo Video Recorder 03.06.02 contains a reflected cross-site scripting vulnerability via login.php. id: CVE-2022-33119 info: name: NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting author: arafatansari severity: medium description: | NUUO NVRsolo Video Recorder 03.06.02 contains...

XSS2Shell-CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain DOM Clobbering + Application Password Theft + REST API Plugin Activation = Full RCE ⚡ Overview CVE-2026-64638 is a critical pre-authentication Reflected XSS in WordPress wp-login.php. The vulnerability exist...

CVE-2026-64638-PoC-XSS2Shell-

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026-64638 · Reflected XSS on wp-login.php · CVSS 8.9 v4.0 · Patched in WordPress 7.0.3 ⚠️ AUTHORIZED TESTING ONLY. This tool is for security research and authorized penetration testing against systems you own or have explicit written...

CVE-2026-64638-XSS-to-Shell-PoC

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concept PoC tool for validating CVE-2026-64638 , a pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting WordPress installations versions 6.4 – 7.0.2. Overview This tool automates the process of fingerprinting,...

CVE-2026-64638

CVE-2026-64638 CVE-2026-64638 fast try import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text or POST /wp-login.php HTTP/1.1 Host: 127.0.0.1:9000 Content-Typ...

CVE-2026-64638

CVE-2026-64638 — XSS2Shell: WordPress Login Page Pre-Auth XSS → Server RCE HackSpeak distribution mirror. This repository is a distribution mirror of the educational XSS2Shell PoC CVE-2026-64638 released by WordSec , with code identical to upstream; upstream is MIT License, Copyright c 2026...

POC-WP-XSS2Shell-CVE-2026-64638

XSS2Shell — PoC for CVE-2026-64638 Educational Proof of Concept for the XSS2Shell chain CVE-2026-64638, a pre-authentication XSS → RCE vulnerability in WordPress Core discovered independently by pwn.ai and disclosed on August 7, 2026. Table of contents 1. Executive Summary 2. Legal notice 3. Chai...

CVE-2025-11177

Trigger the SQLi with a time-based payload in the public login curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...

cve-2026-64638-banner-poc

CVE-2026-64638 — Universal Banner PoC A single-file, dependency-free PoC generator for the WordPress CVE-2026-64638 reflected HTML-injection on wp-login.php striptags vs. KSES parser differential. It produces a self-submitting trigger page: when the victim opens the file, the page silently POSTs...

CVE-2026-29861

CVE-2026-29861 🛡️ CVE Disclosure: CVE-2026-29861 — SQL Injection in PHP-MYSQL-User-Login-System Disclosure Date: 10 April 2026 CVE ID: CVE-2026-29861 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in PHP-MYSQL-User-Login-System v1.0, specifically within the...

CVE-2023-48858

CVE-2023-48858 PoC for CVE-2023-48858 A Cross-site scripting XSS vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part. Proof of Concept:...