nextjs-vulnerable-app

Next.js Authentication App This is a Next.js application that implements authentication using NextAuth.js. The app features protected routes that require users to be authenticated to access certain pages. Project Structure root@kitploit: nextjs-auth-app ├── components │ ├── Layout.js Layout...

CVE-2026-9997-VPN-Split-Tunneling-Bypass-via-DHCP-Option-Injection

CVE-2026-9997 – VPN Split‑Tunneling Bypass via DHCP Option Injection Program Code Python simulated DHCP server + client root@kitploit: !/usr/bin/env python3 roguedhcpserver.py - Injects a static route to bypass VPN split tunnel import socket, struct, threading def senddhcpofferclientmac, offerip:...

wp2shell-poc

wp2shell 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN WordPress Core Pre-Authentication RCE Chain wp2shell is a security research Proof-of-Concept demonstrating a pre-authentication vulnerability chain in...

wp2shell

CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core REST API batch route confusion CVE-2026-63030 chained with a WPQuery authornotin SQL injection CVE-2026-60137 → pre-auth remote code execution against a default WordPress install. Discovered by Adam Kues Assetnote...

CVE-2026-86332

A flaw in the odh-dashboard component of Red Hat OpenShift AI allows any authenticated dashboard user to read Kubernetes Secrets without an authorization check. The backend-for-frontend route GET /api/nim-serving/:nimResource uses the dashboard service account to retrieve and return the full Secr...

CVE-2026-86332 Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...

WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the 'code' parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of th...

Wp2Shell

wp2shell Pre-Authentication Remote Code Execution in WordPress Core. CVE-2026-60137 SQL Injection in WPQuery chained with CVE-2026-63030 REST API Batch Route Confusion. For educational and authorised security research purposes only. Affected Versions WordPress 6.9.0 through 6.9.4 and 7.0.0 throug...

CVE-2025-29927

CVE-2025-29927 - Demo for Introdcution to Secure Programming 00960267 Background This is a demo of CVE-2025-29927, a critical vulnerability in Next.js that allowed bypassing the middleware with a certain header. The header x-middleware-subrequest was intended to prevent infinite middleware loops...

CVE-2025-32421---Race-Condition-Vulnerability---Next.js

CVE-2025-32421---Race-Condition-Vulnerability---Next.js PoC Lab for CVE-2025-32421 – Next.js Race Condition Cache Poisoning Simulation CVE-2025-32421 Lab – Next.js Race Condition Cache Poisoning Este laboratorio reproduce el comportamiento descrito en el CVE-2025-32421 mediante una simulación de...

route-sixty-sink

✏️ Contributors Dillon Franke @dillonfranke Michael Maturi @a-marionette 📝 Blog https://www.mandiant.com/resources/route-sixty-sink-launch ⚓ Route Sixty-Sink Route Sixty-Sink is an open source tool that enables defenders and security researchers alike to quickly identify vulnerabilities in any .NE...

wp2shell

wp2shell Exploit WordPress REST API route confusion CVE-2026-63030 + SQL injection CVE-2026-60137 in the batch endpoint to achieve Remote Code Execution. Vulnerabilities Route Confusion CVE-2026-63030 The WordPress REST API batch endpoint /batch/v1 does not properly isolate request routing. By...

CVE-2026-60137_CVE-2026-63030

CVE-2026-60137 + CVE-2026-63030 — WordPress Unauthenticated RCE Vulnerability: REST Batch Route Confusion + WPQuery SQL Injection → Full RCE CVSS v3.1: 10.0 / 10.0 — CRITICAL | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affected: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1 | Patched: 6.9.5, 7.0.2 root@kitploit:...

CVE-2026-63030-CVE-2026-60137

CVE-2026-63030 & CVE-2026-60137 — wp2shell WordPress Core Pre-Auth RCE — Route Confusion + SQL Injection chained to Remote Code Execution...

Linux Distros Unpatched Vulnerability : CVE-2026-57161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing...

CVE-2026-63030

CVE-2026-63030 + CVE-2026-60137 — WP2Shell WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi Overview CVE-2026-63030 CVSS 9.8 and CVE-2026-60137 CVSS 9.1 form a critical pre-authentication remote code execution chain in WordPress Core. The vulnerabilities affect all default...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows...

CVE-2026-86184

Lara Dashboard before 1.3.0 is affected by an authentication bypass in the screenshot-login route. When APP_ENV is not set to production, an unauthenticated attacker can request GET /screenshot-login/{email} with any registered email address to obtain a fully authenticated session. This grants ac...

EUVD-2026-71993

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered emai...

CVE-2026-84926 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...