SpotifyC2

SpotifyC2 — Исследование облачного командного канала Выполняйте команды через плейлист Spotify и получайте вывод команд через Telegram. Что такое SpotifyC2? SpotifyC2 — это исследовательский проект в области кибербезопасности на базе Windows, который демонстрирует, как общедоступные облачные...

WP2Shell

WP2Shell - WordPress 사전 인증 RCE 익스플로잇 CVE-2026-63030 + CVE-2026-60137 버전: 4.0.0 작성자: G0D150NE 📌 개요 WP2Shell은 WordPress 사전 인증 원격 코드 실행을 위한 전체 체인 익스플로잇 도구입니다. 두 가지 치명적인 취약점을 결합합니다: CVE-2026-63030 - REST API 일괄batch 엔드포인트의 SQL 인젝션 CVE-2026-60137 - oEmbed 캐시 중독을 통한 인증 우회 이 도구는 취약한 WordPress 설치를 어떠한 인증...

CVE-2026-63030

CVE-2026-63030 - WordPress REST API 배치 라우트 혼동 PoC 설명 CVE-2026-63030에 대한 개념 증명PoC 익스플로잇입니다. WordPress버전 6.9.0 7.0.1의 사전 인증pre-authentication 취약점으로, 다음을 연쇄적으로 사용합니다: REST API 배치 라우트 혼동검증 vs 디스패치 불일치 authorexclude 파라미터를 통한 SQL 인젝션 oEmbed 캐시 중독 + Customizer changeset 권한 상승 관리자 사용자 생성 원격 명령 실행을 위한 플러그...

CVE-2026-4361

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict requests to...

EUVD-2026-71887

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict requests to...

PT-2026-86329

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the et pb set video oembed thumbnail resolution function using wp remote get instead of wp safe remote get to fetch a remote image URL, which does not restrict...

CVE-2026-18526

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

CVE-2026-18526

HumHub CE 1.18.4 and 1.18.4-pl1 have a stored XSS flaw in the oEmbed confirmation rendering workflow; the fix is tracked in GitHub PR #8373 (https://github.com/humhub/humhub/pull/8373). No exploitation evidence is provided in the documents.

EUVD-2026-62415

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

Exploit for CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC...

Exploit for CVE-2026-60137

Compromise Scanner for wp2shell read-only A standalone, r...

CVE-2026-12002

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybeconnectiondata function. This makes it possible for...

EUVD-2026-42230

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybeconnectiondata function. This makes it possible for...

CVE-2026-12002

The CVE-2026-12002 entry concerns the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress. A CSRF vulnerability exists in all versions up to and including 6.11.1 due to missing/incorrect nonce validation in the maybe_connection_data function. This allows unauthenticated attac...

CVE-2026-12002

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybeconnectiondata function. This makes it possible for...

CVE-2026-12002 Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybeconnectiondata function. This makes it possible for...

PT-2026-56394

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Photo Feed – Easy Social Feeds Plugin versions prior to 6.11.2 Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the maybe connection data function. This allows unauthenticated...

Drupal 10.5.x < 10.5.12 / 10.6.x < 10.6.11 / 11.2.x < 11.2.14 / 11.3.x < 11.3.12 Multiple Vulnerabilities (drupal-2026-06-17)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.5.x prior to 10.5.12, 10.6.x prior to 10.6.11, 11.2.x prior to 11.2.14, or 11.3.x prior to 11.3.12. It is, therefore, affected by multiple vulnerabilities. - Drupal core contains a chain of metho...