wp2shell-lab

mini-wp-rest Una reimplementación compacta y sin dependencias de una pequeña parte de la API REST de WordPress — lo justo para servir una colección pública de entradas y ejecutar varias subpeticiones en un solo viaje de ida y vuelta. Útil para enseñar cómo encajan el enrutamiento de WordPress,...

CVE-2026-23550

🧨 CVE-2026-23550 – Bypass de administración de Modular Connector Inicio de sesión de administrador de WordPress no autenticado mediante el parámetroorigin=mo Plugin Modular Connector ≤ 2.5.1 📖 Descripción El plugin Modular Connector para WordPress versiones ≤ 2.5.1 contiene una vulnerabilidad...

CVE-2026-63030

LANGZ — Herramienta de Explotación wp2shell Autor: LANGZ CVE: CVE-2026-63030 Encadenado con CVE-2026-60137 Severidad: Crítica CVSS 9.8 Tipo: Ejecución Remota de Código Pre-Autenticación RCE ⚠️ Descargo de Responsabilidad Esta herramienta se proporciona estrictamente con fines educativos y para...

Layer5 Meshery 0.5.2 - SQL Injection

Layer5 Meshery 0.5.2 contains a SQL injection vulnerability in the REST API that allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint order parameter in GetMesheryPatterns in models/mesherypatternpersister.go. id: CVE-2021-31856 info: name: Layer5 Meshe...

westone-CVE-2020-17519-scanner

westone-CVE-2020-17519-scanner Apache Flink 1.11.0, 1.11.1, 1.11.2 Hackers can read/write remote files via REST API Installation & Usage git clone https://github.com/Osyanina/westone-CVE-2020-17519-scanner.git cd westone-CVE-2020-17519-scanner cmd CVE-2020-17519.exe...

Argos

Argos — Blockchain Asset Tracing Platform Argos is a multi-language blockchain investigation platform for tracing, analyzing, and visualizing fund flows on Ethereum and Bitcoin. Built with Rust, OCaml, and TypeScript/React. Architecture +-----------------------+ | Frontend React 19 | | Vite +...

CVE-2025-43990-Magento-RCE

Magento APSB25-94 — Unauthenticated File Upload to RCE Overview Exploits unauthenticated file upload in Magento / Adobe Commerce via REST API guest cart customoptions file upload. Attack Chain 1. GraphQL → leak product SKU 2. REST API → create guest cart 3. REST API → upload PNG polyshell via...

CVE-2026-9830

CVE-2026-9830 PoC de Evaluación de la API de BookingPress Pro Este repositorio contiene una prueba de concepto en Python para validar una exposición no autenticada reportada en la API REST de BookingPress Pro. Una respuesta exitosa puede contener información de reservas y clientes, que puede...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: Bitbucket Remote Command Execution RCE Technical Analysis & Laboratory Exploitation of Null-Byte Argument Injection Vulnerability Summary CVE-2022-36804 is a high/critical Argument Injection vulnerability within the REST API of Atlassian Bitbucket Server and Data Center. While the...

CVE-2024-9707

CVE-2024-9707 Hunk Companion = 1.8.4 - Falta de autorización que permite a atacantes no autenticados instalar/activar plugins arbitrarios Descripción El plugin Hunk Companion para WordPress es vulnerable a la instalación/activación no autorizada de plugins debido a una falta de comprobación de...

CVE-2023-28121-WordPress-Privilege-Escalation

🔐 CVE-2023-28121 — WordPress Privilege Escalation Practical exploitation of a critical vulnerability in WordPress using the WooCommerce Payments plugin. 📌 Summary CVE-2023-28121 allows creating administrator users without authentication via the REST API. Severity: Critical CVSS 9.8 Impact: Full...

Exploit for Improper Authentication in Fortinet Fortiproxy

CVE-2022-40684 — FortiOS / FortiProxy / FortiSwitchManager Aut...

CVE-2024-12025

CVE-2024-12025 Collapsing Categories = 3.0.8 - Unauthenticated SQL Injection Description The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST A...

CVE-2024-2771-PoC

CVE-2024-2771-PoC CVE-2024-2771 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all...

wp2shell

wp2shell Explota la confusión de rutas de la API REST de WordPress CVE-2026-63030 + la inyección SQL CVE-2026-60137 en el endpoint por lotes para lograr la ejecución remota de código. Vulnerabilidades Confusión de rutas CVE-2026-63030 El endpoint por lotes /batch/v1 de la API REST de WordPress no...

WuppieFuzz

WuppieFuzz v1.7.1 TNO developed WuppieFuzz, a coverage-guided REST API fuzzer developed on top of LibAFL, targeting a wide audience of end-users, with a strong focus on ease-of-use, explainability of the discovered flaws and modularity. WuppieFuzz supports all three settings of testing black box,...

CVE-2026-104118

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

EUVD-2026-92075

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...

CVE-2026-104118 Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...