XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain — PoC exploit + defensive audit tool + nuclei template
☆130Aug 21, 2026Updated 2 months ago
Alternatives and similar repositories for CVE-2026-64638-PoC-XSS2Shell-
Users that are interested in CVE-2026-64638-PoC-XSS2Shell- are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- CVE-2026-34910/34909 — UniFi OS unauth RCE + file read via ..%2f auth bypass (CVSS 10.0, KEV, Mirai ITW)☆13Aug 21, 2026Updated 2 months ago
- Keycloak reset-credentials flow bypass☆19Sep 28, 2026Updated last month
- CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress☆31Oct 28, 2026Updated 2 weeks ago
- The home to the popular script named Voidware☆18Feb 10, 2025Updated last year
- GitLab Unauthenticated Arbitrary File Read☆29Sep 28, 2026Updated last month
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE☆196Oct 26, 2026Updated 2 weeks ago
- This tool utilizes the Java Instrumentation API for runtime bytecode manipulation. Functioning as an agent, it employs the ASM framework …☆22Jun 8, 2026Updated 5 months ago
- wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with bat…☆10Jul 18, 2026Updated 3 months ago
- Working RCE PoCs: php2shell-8512 on FULLY-PATCHED PHP 8.5.12 (session-gaps, one-shot+interactive, demo video) + session poisoning -> LFI …☆25Oct 23, 2026Updated 2 weeks ago
- CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)☆52Oct 25, 2026Updated 2 weeks ago
- Anti-cheat plugin for CTFd: tracks the activity of players and teams and catches AI agents, scripts, shared accounts, shared flags, flag …☆22Oct 30, 2026Updated last week
- High fidelity detection mechanism for node2shell (CVE-2026-111497)☆86Oct 25, 2026Updated 2 weeks ago
- Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP e…☆1,079Oct 22, 2026Updated 2 weeks ago
- ☆45Oct 21, 2026Updated 3 weeks ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain☆814Aug 11, 2026Updated 3 months ago
- ☆99Oct 22, 2026Updated 2 weeks ago
- php2shell WordPress RCE proof of concept (PHP 8.3.35 / WordPress 7.1.2)☆35Oct 23, 2026Updated 2 weeks ago
- cve-2026-48907 scanner☆64Jun 27, 2026Updated 4 months ago
- **CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.☆121Sep 6, 2026Updated 2 months ago
- Free, keyless TikTok account lookup: creation date and stats, honest OSINT (real accounts off their own link-in-bio, plus reverse-image a…☆49Oct 17, 2026Updated 3 weeks ago
- Autonomous agentic network penetration-testing tool (authorized use only)☆82Updated this week
- ☆53Oct 4, 2026Updated last month
- Exploit for CVE-2025-29927 (Next.js) - Authorization Bypass☆14Apr 15, 2025Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- A powerful subdomain enumeration tool that aggregates data from multiple sources to create comprehensive lists of root subdomains.☆70Oct 8, 2026Updated last month
- A simple script that pushes a file to the Android device and hooks the relevant functions with Frida to override the application's behavi…☆15Oct 9, 2024Updated 2 years ago
- Run CobaltStrike aggressorscript over TCP☆16Feb 9, 2026Updated 9 months ago
- A bug bounty tool for bypassing 401/403 access restrictions and testing endpoint accessibility.☆55Sep 28, 2026Updated last month
- CTFd plugin allowing for individual Docker containers per user or team☆12Oct 14, 2024Updated 2 years ago
- A Sliver C2 module for NetExec☆14Nov 3, 2026Updated last week
- ☆19Aug 23, 2026Updated 2 months ago
- Ghidra plugin to identify obfuscated code and other interesting code constructs☆20Jul 1, 2026Updated 4 months ago
- CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit rese…☆1,962Oct 28, 2026Updated 2 weeks ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection☆511May 1, 2026Updated 6 months ago
- PandaCrypter is a C#-based tool designed to convert PowerShell scripts into obfuscated batch files (.bat) with encryption and additional …☆55Aug 16, 2025Updated last year
- a Curated list of Grafana Security Vulnerabilities, CVE & exploit☆13Sep 2, 2022Updated 4 years ago
- An agentic mobile security research system built as a Claude Code project. An orchestrator spawns focused sub-agents, each with one narro…☆43Sep 1, 2026Updated 2 months ago
- Mobile Helper Framework (mhf) is a tool that automates the process of identifying the framework/technology used to create a mobile applic…☆28Dec 23, 2025Updated 10 months ago
- Pre-auth RCE via FilteredObjectInputStream MarshalledObject bypass in Apache Log4j 2☆39Aug 26, 2026Updated 2 months ago
- Jenkins Security Research or Hacking Jenkins ;)☆12Dec 10, 2024Updated last year
Are these results useful?