CVE-2026-39987-POC

CVE-2026-39987 - Marimo 0.23.0 प्री-प्रमाणीकरण RCE वेबसॉकेट Marimo के 0.23.0 से पहले के संस्करणों में एक गंभीर प्री-प्रमाणीकरण रिमोट कोड निष्पादन RCE कमजोरी के लिए प्रूफ ऑफ कॉन्सेप्ट PoC एक्सप्लॉइट। यह कमजोरी एक अप्रमाणित हमलावर को वेबसॉकेट एंडपॉइंट /terminal/ws से जुड़ने और लक्ष्य सर्वर पर मनमान...

CVE-2026-59243

CVE-2026-59243: Bypass della firma JWT di Apache Airflow FAB Auth Manager Versione coreana: README.ko.md Advisory ufficiale Apache, pubblicato il 2026-07-29: https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl Record CVE: https://vulners.com/cve/CVE-2026-59243 Corretto in:...

CVE-2025-52691-PoC-SmarterMail-authentication-bypass-exploit-WT-2026-0001

استغلال CVE-2025-52691 / WT-2026-0001 SmarterMail 🚨 إشعار مهم هذه الأداة مخصصة لاختبار الأمان المصرح به والأغراض التعليمية فقط! الاستخدام غير المصرح به غير قانوني وغير أخلاقي استخدم فقط على الأنظمة التي لديها تفويض صريح استخدم على مسؤوليتك الخاصة المستخدمون مسؤولون عن الامتثال لجميع القوانين...

wp2shell-poc

Wie funktioniert das überhaupt Wie sich dieser PoC von den öffentlichen wp2shell-Exploits unterscheidet Alle PoCs nutzen dieselben zwei Schwachstellen – die REST-Batch-Routen-Verwirrung CVE-2026-63030 und die authornotin SQL-Injection CVE-2026-60137 – mit derselben doppelt verschachtelten...

CVE-2026-63030-Wp2Shell

CVE-2026-63030 wp2shell — RCE pre-autenticazione nel core di WordPress Confusione di route batch dell'API REST combinata con l'iniezione SQL CVE-2026-60137 TL;DR — Un attaccante non autenticato può combinare un bug di routing batch dell'API REST di WordPress con un'iniezione SQL in WPQuery per...

CVE-2026-42533

CVE-2026-42533 — PoC Exploit per l'Heap Buffer Overflow di nginx Esecuzione remota di codice pre-autenticazione tramite sovrascrittura dei gruppi di cattura a due passate PoC pubblico rilasciato il 2026-07-27 — Non aspettare, applica la patch ora. | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 Criti...

CVE-2026-23918

CVE-2026-23918 Double-free in Apache httpd modhttp2 stream cleanup leading to pre-auth RCE. Betroffen: httpd 2.4.66 mit modhttp2 und mehrthreadigem MPM event/worker. Behoben in: 2.4.67. Gefunden und gemeldet von Bartlomiej Dmitruk striga.ai und Stanislaw Strzalkowski isec.pl. Writeup:...

metasploitable-pentest-lab

Sfruttamento delle vulnerabilità in Metasploitable Ciclo completo di un attacco reale su un ambiente controllato e isolato: preparazione del laboratorio, riconoscimento con nmap, prioritizzazione della superficie d'attacco, mappatura a CVE, sfruttamento con Metasploit, post-sfruttamento, estrazio...

wp2shell-checker

root@kitploit: \ \ / / \ / || | | | | | | | \ \ /\ / /| | | \ | || | | | | | | \ V V / | // / | | || || | // || ||/|| ||||| wp2shell-checker | WordPress Batch API Desync Detector Rivelatore checker per la RCE pre-auth della REST Batch API del WordPress Core Creato da 0xjessie21 — Cybersecurity...

sxwp2shell

root@kitploit: / / / / / / | |/ / \ / / / / / / / / | / / / / / / / // / / / / / // | //// ///// /////|| sxwp2shell — Pre-Auth-RCE-Exploit für WordPress über REST-API-Batch-Routen-Verwirrung CVE-2026-63030 + SQL-Injection CVE-2026-60137. Betroffen: WP 6.9.0–6.9.4 / 7.0.0–7.0.1 Installation...

wp2shell-detect

wp2shell-detect Blackbox, rilevatore non intrusivo per wp2shell — la catena RCE pre-autenticazione nel core di WordPress divulgata il 2026-07-17: CVE-2026-63030 — confusione di route nell'endpoint REST batch /wp-json/batch/v1: una sub-request il cui percorso fa fallire wpparseurl finisce nell'arr...

wp2shell_scanner

wp2shellscanner हाल की WordPress कोर भेद्यताओं के लिए गैर-आक्रामक डिटेक्शन स्कैनर — जिसमें wp2shell प्री-ऑथेंटिकेशन RCE श्रृंखला भी शामिल है। wp2shellscanner.py किसी WordPress साइट के कोर संस्करण का फ़िंगरप्रिंट लेता है और उसकी सार्वजनिक रूप से विज्ञापित REST API सतह को पढ़ता है, फिर प्रत्येक ट्र...

CVE-2026-60004-POC

CVE-2026-60004 — Execução Remota de Código Pré-Autenticação no Gitea CVSS 9.8 root@kitploit: ┌──────────────────────────────────────────────────────────────┐ │ CVE-2026-60004 │ Gitea Pre-Auth RCE │ CVSS 9.8 CRIT │ │ diffpatch → git hook injection │ v1.17–1.27.0 affected │...

CVE-2026-9290

CVE-2026-9290 — Exploit de LFI para RCE no WP User Manager Path Traversal sem autenticação via parâmetro 'tab' → Inclusão Local de Arquivo Visão Geral CVE-2026-9290 é uma vulnerabilidade de Inclusão Local de Arquivo Local File Inclusion — LFI sem autenticação e de alta gravidade CVSS 7.5 no plugi...

metabase-cve-2023-38646

cd /metabase-poc cat README.md 'EOF' CVE-2023-38646 — Esecuzione di codice remoto pre-autenticazione in Metabase Riepilogo CVSS 9.8. Le versioni di Metabase precedenti a 0.46.6.1 / 1.46.6.1 e rami precedenti equivalenti espongono una RCE pre-autenticazione tramite l'endpoint /api/setup/validate,...

CVE-2026-39987

CVE-2026-39987 — Marimo RCE pre-autenticazione /terminal/ws root@kitploit: CVSS 4.0 : 9.3 CRITICAL CVSS 3.x : 9.8 CRITICAL CWE : CWE-306 Missing Authentication for Critical Function Fix : Marimo 0.23.0+ Affects : Marimo Solo laboratorio / test autorizzati HTB, CTF, engagement con scope scritto...

CVE-2025-32432

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit para execução remota de código sem autenticação no Craft CMS, escrito em Go. Inspirado no trabalho original de c0gnit00. Como funciona 1. Obtém a sessão PHP e o CSRF token via GET /admin/login 2. Envenena o arquivo de sessão PHP injetando código PHP...

wp2shell-scan

wp2shell-scan Detect and clean upwp2shell CVE‑2026‑63030 compromise across one or many WordPress sites. wp2shell is the pre‑authentication remote‑code‑execution vulnerability fixed in WordPress 7.0.2 / 6.9.5 / 6.8.6 2026‑07‑17. A public PoC appeared within a day and mass‑exploitation followed...

WordPresShell

WordPresShell PoC de RCE pré-auth para CVE-2026-63030 + CVE-2026-60137 núcleo do WordPress. Confusão de rota REST /batch/v1 → SQLi via WPQuery authornotin → criação de admin sem autenticação → webshell. Arquivo único, apenas com stdlib do Python. Vulnerabilidade: Adam Kues Searchlight Cyber...

CVE-2025-32433-Detection

Rilevamento CVE-2025-32433 Autore: te0rwx Creazione: 2025-08-27 Agg. 2026-08-16 Descrizione Una regola YARA personalizzata per il rilevamento di artefatti noti associati a CVE-2025-32433 , una vulnerabilità di esecuzione remota di codice RCE pre-autenticazione SSH in Erlang/OTP. La regola è stata...