wp2shell

🔍 wp2shell - Escáner y Exploit de Vulnerabilidad CVE-2026-63030 de WordPress ⚡ Escáner y Exploit de Vulnerabilidad en Tiempo Real para CVE-2026-63030 wp2shell 📌 Descripción general wp2shell es un kit de herramientas integral para detectar y explotar CVE-2026-63030 , una vulnerabilidad crítica en...

WP2Shell-CVE-2026-63030-POC

WP2Shell Detector y PoC de Validación Cobertura de CVEs: CVE-2026-63030 y CVE-2026-60137 Uso previsto: Pruebas de seguridad autorizadas, validación defensiva y laboratorios locales desechables únicamente WP2Shell es una cadena de vulnerabilidades del núcleo de WordPress que combina un error de...

wp2shell-poc2

wp2shell-poc Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion CVE-2026-63030. The exploit needs no credentials and no configuration beyond a reachable target. It reaches the injection through a single...

wp2shell

wp2shell por: ek0ms savi0r Ejecución remota de código no autenticada para WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell es un exploit para una cadena de vulnerabilidades críticas en el núcleo de WordPress. Encadena un fallo de confusión de rutas en el lote de la API REST con una...

CVE-2026-63030

CVE-2026-63030 PoC de cadena de explotación completa en WordPress REST API: confusión de rutas batch + inyección SQL que conducen a creación de administrador sin autenticación → ejecución remota de código. Solo para pruebas de seguridad autorizadas, reproducción de vulnerabilidades e investigació...

WP2Shell

WP2Shell - CVE-2026-63030 / CVE-2026-60137 Inyección SQL por Lote en la API REST de WordPress a RCE Herramienta completa de detección y explotación para la vulnerabilidad del endpoint Batch de la API REST de WordPress. Esta herramienta explota una vulnerabilidad crítica de inyección SQL en el...

CVE-2026-9830

CVE-2026-9830 PoC de Evaluación de la API de BookingPress Pro Este repositorio contiene una prueba de concepto en Python para validar una exposición no autenticada reportada en la API REST de BookingPress Pro. Una respuesta exitosa puede contener información de reservas y clientes, que puede...

CVE-2024-9707

CVE-2024-9707 Hunk Companion = 1.8.4 - Falta de autorización que permite a atacantes no autenticados instalar/activar plugins arbitrarios Descripción El plugin Hunk Companion para WordPress es vulnerable a la instalación/activación no autorizada de plugins debido a una falta de comprobación de...

CVE-2024-12025

CVE-2024-12025 Collapsing Categories = 3.0.8 - Inyección SQL no autenticada Descripción El plugin Collapsing Categories para WordPress es vulnerable a Inyección SQL a través del parámetro 'taxonomy' de la API REST /wp-json/collapsing-categories/v1/get en todas las versiones hasta la 3.0.8...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST A...

CVE-2024-2771-PoC

CVE-2024-2771-PoC CVE-2024-2771 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all...

CVE-2026-82633

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-82633

Dolibarr versions 10.0.0 through 23.x fail to perform per-object authorization checks in the Users::getGroups REST API endpoint (GET /users/{id}/groups). Any authenticated user can call this endpoint with arbitrary user identifiers to retrieve group memberships, entity associations, and private n...

EUVD-2026-68201

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

WuppieFuzz

WuppieFuzz v1.7.1 TNO developed WuppieFuzz, a coverage-guided REST API fuzzer developed on top of LibAFL, targeting a wide audience of end-users, with a strong focus on ease-of-use, explainability of the discovered flaws and modularity. WuppieFuzz supports all three settings of testing black box,...

abdal-cve-2026-63030

English | فارسی 🛡️ Abdal CVE-2026-63030 PoC Exploits Abdal CVE-2026-63030 is a defensive WordPress exposure verifier for the REST API batch route confusion tracked as CVE-2026-63030. The issue can be chained with CVE-2026-60137 on affected WordPress releases and may lead to remote code execution...

vt-go

vt-go Questa è la libreria client Go ufficiale per VirusTotal. Con questa libreria puoi interagire con l'API REST v3 di VirusTotal senza dover inviare semplici richieste HTTP con il pacchetto standard "http". Esempio di utilizzo root@kitploit: package main import "flag" "fmt" "log" "os" vt...

vt-py

vt-py Questa è la libreria client Python ufficiale per VirusTotal. Con questa libreria puoi interagire con la VirusTotal REST API v3 e automatizzare il tuo workflow in modo rapido ed efficiente. Cose che puoi fare con vt-py Scansiona file e URL Ottieni informazioni su file, URL, domini, ecc. Eseg...

cve-2017-5487

Cos'è CVE-2017-5487? : Vulnerabilità nell'implementazione della REST API in wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php nelle versioni di WordPress precedenti alla 4.7.1, che non limita l'elenco degli autori, consentendo a un attaccante remoto di ottenere informazioni...