98 matches found
WordPress Integrator 1.32 - Cross-Site Scripting
A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...
XSS2Shell-CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress: отражённый XSS до аутентификации → цепочка удалённого выполнения кода DOM Clobbering + кража пароля приложения + активация плагина через REST API = полный RCE ⚡ Обзор CVE-2026-64638 — это критическая отражённая XSS до аутентификации в wp-login.php WordPress...
CVE-2026-64638-PoC-XSS2Shell-
XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026-64638 · Reflected XSS on wp-login.php · CVSS 8.9 v4.0 · Patched in WordPress 7.0.3 ⚠️ AUTHORIZED TESTING ONLY. This tool is for security research and authorized penetration testing against systems you own or have explicit written...
CVE-2026-64638-XSS-to-Shell-PoC
CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concept PoC tool for validating CVE-2026-64638 , a pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting WordPress installations versions 6.4 – 7.0.2. Overview This tool automates the process of fingerprinting,...
CVE-2026-64638
CVE-2026-64638 CVE-2026-64638 быстрая проверка import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text или POST /wp-login.php HTTP/1.1 Host: 127.0.0.1:9000...
CVE-2026-64638
CVE-2026-64638 — XSS2Shell: пред-авторизованный XSS на странице входа WordPress → RCE на сервере Зеркало дистрибутива HackSpeak. Этот репозиторий является зеркалом образовательного PoC XSS2Shell CVE-2026-64638, опубликованного WordSec , код идентичен оригиналу; оригинал — MIT License, Copyright c...
POC-WP-XSS2Shell-CVE-2026-64638
XSS2Shell — PoC для CVE-2026-64638 Образовательное Proof of Concept цепочки XSS2Shell CVE-2026-64638, уязвимость XSS → RCE до аутентификации в ядре WordPress, обнаруженная независимо pwn.ai и опубликованная 7 августа 2026 года. Содержание 1. Краткое описание 2. Правовое уведомление 3. Архитектура...
CVE-2025-11177
Déclencher le SQLi avec une charge utile temporelle sur la page de connexion publique curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...
cve-2026-64638-banner-poc
CVE-2026-64638 — Универсальный PoC-баннер Одностраничный генератор PoC без зависимостей для отражённой HTML-инъекции в WordPress CVE-2026-64638 на wp-login.php расхождение между striptags и парсером KSES. Он создаёт страницу-триггер с автоматической отправкой формы: когда жертва открывает файл,...
xss2shell-check
xss2shell-check Неразрушающий детектор без зависимостей для примитива отражения CVE-2026-64638 "XSS2Shell" в WordPress wp-login.php. Предыстория CVE-2026-64638 — это пред-аутентификационная отражённая XSS-уязвимость в ядре WordPress , раскрытая PWN.AI 2026-08-07 CVSS 8.9, CWE-79 и исправленная в...
CVE-2026-93368
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
EUVD-2026-85169
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-93368
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the existing SQL query for the 'log' (Username) parameter. Beca...
WordPress Rename wp-login.php to anything you want plugin <= 2.0.1 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Rename wp-login.php to anything you want versions = 2.0.1...
PT-2026-97241
Name of the Vulnerable Software and Affected Versions Rename wp-login.php to anything you want versions prior to 2.0.2 Description The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before...
CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
