CVE-2026-64638-WordPress-Core-XSS2Shell

CVE-2026-64638 — Nuclei Detection Template Nuclei テンプレート。WordPress Core の認証前の差分パーサー（differential parser）である XSS2Shell を非侵襲的に検出します。この脆弱性によりログインページへの DOM 要素の注入が可能になり、XSS → RCE のチェーンへの基盤となります。 ⚠️ このテンプレートは 検出のみ を行います（HTML レスポンスへのマーカーリフレクション段階）。完全なエクスプロイトチェーン（DOM clobbering、JSONP/SOME、Application...

fortios-auth-bypass-check-CVE-2024-55591

CVE-2024-55591 Fortinet FortiOS 인증 우회 취약점 탐지 탐지 실행 python CVE-2024-55591-check.py --target 192.168.1.10 --port 443 / | | |\ \ \ / / \ \ / | | \| | / \ / / \ \ \ / / | | \ \| Y | | \ / | | \ // || \\ ||| | \ / \// || \ \ \ CVE-2024-55591.py Fortinet FortiOS Authentication Bypass...

CVE-2023-20887

CVE-2023-20887 エクスプロイト VMWare vRealize Network Insight 事前認証RCE CVE-2023-20887 使用方法 usage: exploit.py -h -t TARGET -l LOCALHOST -p LOCALPORT optional arguments: -h, --help show this help message and exit -t TARGET, --target TARGET Target url, http://localhost:9000 -l LOCALHOST, --localhost LOCALHO...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT 反序列化 - Je Yiuwai's Blog CVE-2023-0669 CVE-2023-0669是一个GoAnywhere MFT反序列化漏洞，由于反序列化一个任意攻击者控制的对象，在License Response Servlet中存在一个预先认证的命令注入漏洞。攻击者可以利用该漏洞在受影响的系统上执行任意代码，从而导致系统被完全控制。该漏洞影响版本为7.1.2之前，不包括7.1.2。 CVE-2023-0669 is a GoAnywhere MFT deserialization vulnerability that...

watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260

CVE-2025-71257 및 CVE-2025-71260 BMC FootPrints 사전 인증 원격 코드 실행 체인 BMC FootPrints 사전 인증 원격 코드 실행 체인 탐지 아티팩트 생성기 도구 설명 이 탐지 아티팩트 생성기는 BMC FootPrints 인스턴스가 CVE-2025-71257 및 CVE-2025-71260에 취약한지 확인합니다. 탐지 아티팩트 생성기는 두 가지 작업을 수행합니다: CVE-2025-71257을 사용한 인증 우회 - 이 확인은 매우 정확합니다. 성공할 경우, 무작위화된 .jsp 파일을 tomc...

randy

Randy 概要 これは、Inductive Automation Ignition のバージョン = 8.1.16 に影響する、事前認証不要の RCE エクスプロイトです。Pwn2Own Miami 2022 では、粗雑なエクスプロイトとデバッグ環境の欠如によりバグを突くことができませんでしたが、その後、それを改善するための時間とエネルギーを見つけました！ 著者 Incite Team の Chris Anastasio と Steven Seeley mrme ビルド 1. mvn clean compile assembly:single -DskipTests でビルドします。...

CVE-2026-62648

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...

CVE-2026-64638

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...

CVE-2026-44986

CVE-2026-44986 affects Penpot prior to 2.14.5. The issue allows a pre-authenticated account takeover via team invitation tokens: tokens from create-team-invitations were exposed, an existing profile id was embedded in auth.clj prepare-register-profile, and auth.clj register-profile could issue a ...

CVE-2026-44986 Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teamsinvitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session base...

CVE-2026-55950

Time-of-check Time-of-use TOCTOU race condition vulnerability in Erlang/OTP ssl dtlspacketdemux module allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP...

CVE-2026-45697 Formie: Pre-authenticated server-side template injection in Hidden fields

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields with Default value → Custom that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site depending ...

CVE-2026-45697 Formie: Pre-authenticated server-side template injection in Hidden fields

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields with Default value → Custom that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site depending ...

CVE-2026-45721: Improper Input Validation

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named handler.lua to execute a...

Roundcube Webmail 安全漏洞

Roundcube Webmail is a browser-based open source IMAP client from Roundcube open source, which supports address book management, message searching, spell checking and more. A security vulnerability exists in Roundcube Webmail versions prior to 1.6.16 and 1.7.1, which originates from a poison bypa...

CVE-2026-34926

A directory traversal vulnerability in the Apex One on-premise server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex...

CVE-2026-34926

A directory traversal vulnerability in the Apex One on-premise server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex...

CVE-2026-34926

A directory traversal vulnerability in the Apex One on-premise server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex...

CVE-2026-34926

A directory traversal vulnerability in the Apex One on-premise server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex...