94 matches found
WordPress Integrator 1.32 - Cross-Site Scripting
A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...
xss2shell-check
xss2shell-check Non-destructive, dependency-free detector for the CVE-2026-64638 "XSS2Shell" reflection primitive in WordPress wp-login.php. Background CVE-2026-64638 is a pre-authentication reflected XSS in WordPress core , disclosed by PWN.AI on 2026-08-07 CVSS 8.9, CWE-79 and patched in 7.0.3...
XSS2Shell-CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress XSS Reflejado Pre-Auth → Cadena de Ejecución Remota de Código DOM Clobbering + Robo de Contraseñas de Aplicación + Activación de Plugins vía API REST = RCE Completo ⚡ Resumen CVE-2026-64638 es un XSS Reflejado pre-autenticación crítico en wp-login.php de...
CVE-2026-64638-PoC-XSS2Shell-
XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026-64638 · Reflected XSS on wp-login.php · CVSS 8.9 v4.0 · Patched in WordPress 7.0.3 ⚠️ AUTHORIZED TESTING ONLY. This tool is for security research and authorized penetration testing against systems you own or have explicit written...
CVE-2026-64638-XSS-to-Shell-PoC
CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concept PoC tool for validating CVE-2026-64638 , a pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting WordPress installations versions 6.4 – 7.0.2. Overview This tool automates the process of fingerprinting,...
CVE-2026-64638
CVE-2026-64638 CVE-2026-64638 prueba rápida import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text o POST /wp-login.php HTTP/1.1 Host: 127.0.0.1:9000...
CVE-2026-64638
CVE-2026-64638 — XSS2Shell: XSS de preautenticación en la página de inicio de sesión de WordPress → RCE en el servidor Espejo de distribución de HackSpeak. Este repositorio es un espejo de distribución del PoC educativo XSS2Shell CVE-2026-64638 publicado por WordSec , con el código idéntico al...
POC-WP-XSS2Shell-CVE-2026-64638
XSS2Shell — PoC for CVE-2026-64638 Educational Proof of Concept for the XSS2Shell chain CVE-2026-64638, a pre-authentication XSS → RCE vulnerability in WordPress Core discovered independently by pwn.ai and disclosed on August 7, 2026. Table of contents 1. Executive Summary 2. Legal notice 3. Chai...
CVE-2025-11177
Dispara el SQLi con un payload basado en tiempo en el login público curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...
cve-2026-64638-banner-poc
CVE-2026-64638 — PoC de Banner Universal Un generador de PoC de un solo archivo y sin dependencias para la inyección de HTML reflejada CVE-2026-64638 de WordPress en wp-login.php diferencial entre striptags y el analizador KSES. Produce una página de activación con autoenvío: cuando la víctima ab...
CVE-2026-93368
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-93368
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the existing SQL query for the 'log' (Username) parameter. Beca...
WordPress Rename wp-login.php to anything you want plugin <= 2.0.1 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Rename wp-login.php to anything you want versions = 2.0.1...
CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
Exploit for CVE-2026-64638
CVE-2026-64638 // XSS2Shell Análisis técnico y matriz de mi...
Exploit for CVE-2026-64638
xss2shell-check Non-destructive, dependency-free detector for...
Exploit for CVE-2026-12345
CVE-2026-64638 - WordPress wp-login.php Reflected XSS "XSS2...
The vulnerability of the wp-login.php file within the WordPress content management system allows a hacker to execute arbitrary code.
The vulnerability of the wp-login.php file in the WordPress content management system is related to the lack of security measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
