11327 matches found
PT-2026-88906
Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the rest authentication errors filter and therefore evaluated for every unauthenticated REST API...
struts2-rce
Demo de Exploit para CVE-2017-5638 Completamente basado en https://github.com/piesecurity/apache-struts2-CVE-2017-5638 Un escenario realista donde un proyecto de referencia para un framework se despliega en un contenedor pero con terribles consecuencias. Para familiarizarte, mira el código y...
CVE-2022-1388
CVE-2022-1388 CVE-2022-1388 Vulnerabilidad de omisión de autenticación en F5 BIG-IP iControl REST ⚠️ Descargo de responsabilidad Esta herramienta es solo para el intercambio de investigaciones de seguridad cibernética. ¡Los usuarios deben cumplir con la ley de seguridad cibernética y usarla de...
CVE-2022-2414
CVE-2022-2414 CVE-2022-2414 POC 1. Reemplaza YOURHOST con tu objetivo como en la url de abajo url = "https://example.com/ca/rest/certrequests"...
F5-BIG-IP-exploit
Exploit de F5-BIG-IP CVE-2022-1388 usage: CVE-2022-1388.py -h -u URL -c COMMAND -f FILE CVE-2022-1388 F5 BIG-IP iControl REST Bypass de Autenticación RCE Ejemplo: root@kitploit: python3 CVE-2022-1388.py -u https://127.0.0.1 python3 CVE-2022-1388.py -u https://127.0.0.1 -c 'cat /etc/passwd' python...
CVE-2026-86078
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain proto or constructor, causing nested writes t...
CVE-2026-86079
CVE-2026-86079 affects n8n , an open-source workflow automation platform. The Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths without the required toPathSegment encoding (missing in GenericFunctions.ts). An i...
CVE-2026-86079 n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...
CVE-2026-86079 n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...
CVE-2026-8181
CVE-2026-8181 - Burst Statistics Authentication Bypass Exploit Python 2.7 exploit for the Burst Statistics plugin vulnerability CVE-2026-8181 that allows unauthenticated attackers to bypass REST API authentication, retrieve application passwords, and create new administrator users on vulnerable...
CVE-2017-5487
PoC - CVE-2017-5487 - Enumeración de Usuarios de WordPress vía REST Configuración root@kitploit: git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 Uso root@kitploit: .\Enumerate-WordPressOrgMembersREST.ps1 Ruta Alternativa 1 para Evadir ...
CVE-2026-25197
CVE-2026-25197: Authorization Bypass via User-Controlled Key IDOR Advisory Field| Value ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639 Authorization Bypass Through User-Controlled Key Researcher|...
wp2shell-vulnerability-scanner
WP2Shell Scanner Una herramienta de auditoría de seguridad de solo lectura y no destructiva que escanea instalaciones de WordPress en busca de la cadena de vulnerabilidades wp2shell. Resumen WP2Shell Scanner es una utilidad bash que busca recursivamente en un árbol de directorios instalaciones de...
Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress
Acyber Wordpress 插件 !WARNING 针对 CVE-2026-60137 和 CVE-2026-63030 wp2shell 的临时紧急缓解措施 针对 wp2shell 漏洞链的临时紧急风险缓解措施 🇬🇧 英文说明 这个轻量级 WordPress 插件可作为针对关键的 wp2shell 漏洞利用链（CVE-2026-60137 和 CVE-2026-63030 ）的临时虚拟补丁（缓解措施）。 该漏洞利用链允许攻击者在未经身份验证的情况下，在标准 WordPress 安装（6.9 及以上版本）上实现远程代码执行（RCE）。 工作原理： 1. 严格净化： 它会拦截...
CVE-2026-73316 XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...
CVE-2026-73316
XenForo before 2.3.13 is affected by a payment replay vulnerability in the PayPal REST payment provider . The root cause is a missing duplicate transaction ID check , which allows an attacker to replay a valid webhook payload multiple times. This triggers duplicate payment events , resulting in r...
EUVD-2026-72753
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...
wordpress-batch-rce-lab
wp2shell: RCE por lotes en WordPress Un análisis técnico de CVE-2026-63030, un fallo lógico en el endpoint de lotes de la API REST de WordPress que permite que una solicitud anónima se envíe bajo la ruta y verificación de permisos de otra solicitud, encadenándose con CVE-2026-60137 inyección SQL...
wp2shell-scanner
wp2Shell Scanner – with PoC CVE-2026-63030 and CVE-2026-60137 – WordPress wp2shell vulnerability-chain scanner Authorized security-research tool with optional command-verification PoC. wp2shell-scanner detects the WordPress wp2shell vulnerability chain by validating public WordPress evidence,...