xmlrpc-brute

Инструмент для брутфорса XML-RPC WordPress Инструмент для тестирования сайтов WordPress на уязвимости XML-RPC путем подбора учетных данных пользователей через интерфейс XML-RPC. Описание Этот инструмент проверяет установки WordPress на уязвимости аутентификации XML-RPC. Он может выполнять...

WordPress-6.9.1-Blind-SSRF

WordPress-6.9.1-Blind-SSRF Эксплойту не присвоен CVE. Затронутые версии 6.8 - 6.8.3 6.9 - 6.9.1 WordPress = 6.9.1 - Неаутентифицированная слепая SSRF через обнаружение обратных ссылок XML-RPC, доказательство концепции PoC Использование 1. Установите requests, если еще не установлено pip install...

Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467

Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467 Apache OFBiz는 오픈 소스 전사적 자원 관리ERP 시스템입니다. 이 시스템은 기업의 많은 비즈니스 프로세스를 통합하고 자동화하는 엔터프라이즈 애플리케이션 제품군을 제공합니다. CVE-2023-49070 는 Apache OFBiz 18.12.09에서 확인된 사전 인증 원격 코드 실행RCE 취약점입니다. 이 문제는 더 이상 유지보수되지 않지만 시스템에 남아 있는 XML-RPC로 인해 발생합니다...

CVE-2017-11610

Скрипт для эксплуатации уязвимости удаленного выполнения команд в Supervisord CVE-2017-11610 Описание уязвимости Supervisor — это инструмент управления процессами, написанный на Python, который позволяет легко запускать, перезапускать автоматически перезапускать программы и останавливать процессы...

CVE-2026-82384

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82377

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

EUVD-2026-88137

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82384

Apache Roller 6.1.5 is vulnerable to an unauthenticated remote code execution (RCE) flaw due to the deserialization of untrusted data (CWE-502). The XmlRpcServlet accepts vendor extension types (e.g., ex:serializable) which are deserialized during request parsing before any authentication occurs....

CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82377

Apache Roller version 6.1.5 is vulnerable to a missing authorization flaw in the legacy XML-RPC Blogger and MetaWeblog APIs . While the handlers authenticate the caller, they fail to verify if the caller has specific permissions for the target weblog or entry. This allows an authenticated user to...

CVE-2026-82377 Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

CVE-2026-82377 Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

EUVD-2026-88134

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

CVE-2026-82377 Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

CVE-2026-88828 Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or...

CVE-2026-88828

The Blacklist Manager for WooCommerce WordPress plugin, affecting versions 1.3.0 through 2.3.1 , contains a vulnerability where user blocking is not enforced across all authentication paths. Specifically, an account blocked by a site owner can continue to authenticate and maintain account privile...

CVE-2026-88828 Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or...

CVE-2026-82384: Deserialization of Untrusted Data

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...