Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker
☆65Oct 6, 2026Updated last month
Alternatives and similar repositories for Comment2Shell
Users that are interested in Comment2Shell are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opport…☆38Oct 27, 2026Updated last week
- CVE-2026-34910/34909 — UniFi OS unauth RCE + file read via ..%2f auth bypass (CVSS 10.0, KEV, Mirai ITW)☆13Aug 21, 2026Updated 2 months ago
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆112Oct 27, 2026Updated last week
- CVE-2026-54121 - CertiGhost AD CS Multi-Exploit Framework | Rogue DC + LDAP spoofing, certificate abuse, PKINIT hash extraction, auto DCS…☆30Sep 29, 2026Updated last month
- https://heyitsas.im/posts/ovswrap☆20Jul 28, 2026Updated 3 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- CVE-2026-32475 The Elementor Pro Forms File Upload field handles validation and file processing in two separate loops with different han…☆13Aug 21, 2026Updated 2 months ago
- Automated HTTP/HTTPS simulation for Cobalt Strike Malleable C2 profiles☆29Sep 3, 2026Updated 2 months ago
- Ditto is a Windows Mythic Agent for Chroimium Browsers that utilizes Chromium extensions as its base agent with optional sidecar attachme…☆34Oct 15, 2026Updated 3 weeks ago
- ☆15Sep 24, 2026Updated last month
- A tool to automatically create Edges for BloodHound☆10Feb 17, 2023Updated 3 years ago
- ☆11Apr 8, 2024Updated 2 years ago
- NextForge — unified Next.js exploitation framework. RCE · SSRF · middleware · authorized lab only.☆18Sep 23, 2026Updated last month
- JaelesFuzzer is a Powerful Automation tool for detecting XSS, SQLi, SSRF, Open-Redirect, etc.. Vulnerabilities in Web Applications☆22May 1, 2024Updated 2 years ago
- Linux Kernel LPE☆17Sep 28, 2026Updated last month
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- Crystal Palace PICO loader for Sliver C2 dual-layer AMSI bypass, ETW silencing, AES-256-CBC encrypted payloads, 6 delivery variants☆48Aug 20, 2026Updated 2 months ago
- Deterministic PyGhidra extraction, triage, and local LLM compiler-backend pipeline for C reimplementation.☆11Oct 18, 2026Updated 2 weeks ago
- ☆15Nov 15, 2025Updated 11 months ago
- ☆15Oct 19, 2026Updated 2 weeks ago
- Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.…☆45Sep 11, 2026Updated last month
- Tools for CES abuse☆50Sep 29, 2026Updated last month
- Cobalt Strike BOF to obtain location data☆30Jul 4, 2026Updated 4 months ago
- ☆14Feb 7, 2024Updated 2 years ago
- ☆16Jun 28, 2026Updated 4 months ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- RunPE implementation with multiple evasive techniques (2)☆15Sep 25, 2025Updated last year
- Distributed Multi-Node Mesh C2 Framework☆11Sep 19, 2026Updated last month
- RepShot · Generate professional security finding cards directly from Burp Suite Repeater.☆109May 31, 2026Updated 5 months ago
- Exploit for CVE-2025-61882 (do not use without any written permission).☆11Oct 6, 2025Updated last year
- A workshop about core UDRL mechanics by Joris Ignoul & Mickey De Baets☆23Jun 12, 2026Updated 4 months ago
- CVE-2021-40438 Apache <= 2.4.48 SSRF exploit☆11Dec 12, 2023Updated 2 years ago
- Qt GUI application for downloading videos, playlists and monitoring streams.☆19Mar 17, 2026Updated 7 months ago
- One-pass anonymous Active Directory enumeration over SAMR and LSARPC — null session, no credentials, with structured reusable output.☆68Sep 17, 2026Updated last month
- Backup☆23Sep 24, 2026Updated last month
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Handle Redirect via BYOVD Kernel Read/Write☆22Sep 13, 2026Updated last month
- ☆35Jun 12, 2026Updated 4 months ago
- Cloud dead-drop C2 framework — RSA-4096 + AES-256-GCM, 5 cloud providers, Rust-only agents, P2P mesh, persistence engine, credential harv…☆50Oct 27, 2026Updated last week
- Contains materials for my technical presentation exploring Linux malware tradecraft—from userland and fileless techniques to kernel rootk…☆115Oct 30, 2026Updated last week
- CVE-2025-68428 Proof of Concept☆24Jan 8, 2026Updated 9 months ago
- cve-2026-48907 scanner☆64Jun 27, 2026Updated 4 months ago
- An advanced Out-of-Band and In-Band SSRF fuzzing scanner with dynamic request tracking.☆39Jun 18, 2026Updated 4 months ago