attack_type:sql_injection × has_exploit:true × limpar

Resultados

2 casos · pág. 1/1

f5.com · há 1d exploit público critical

Drupal Core CVE-2026-9082 JSON:API pre-auth SQL injection actively exploited within days of disclosure

CVE-2026-9082 is a critical (CVSS 9.8) pre-authentication SQL injection in the JSON:API module of Drupal Core. It was published on May 20, 2026 and added to the CISA KEV catalog the same month, with a remediation deadline of May 27. F5 sensors recorded 576 exploitation attempts from 9 source IPs between May 20 and May 31, 2026. The earlie…

CVE-2026-9082

hacktron.ai · há 1d · 2 fontes · 2 atualizações exploit público critical

wp2shell: WordPress core REST batch route confusion (CVE-2026-63030) and WP_Query SQLi (CVE-2026-60137) chain into unauthenticated RCE

Hacktron analyzes wp2shell, an unauthenticated RCE chain in WordPress core found by Searchlight Cyber. It combines CVE-2026-63030, a route handler confusion in the REST API batch endpoint, with CVE-2026-60137, an SQL injection in WPQuery. Affected versions are WordPress 6.9.0-6.9.4, 7.0.0-7.0.1 and the 7.1 beta, fixed in 6.9.5, 7.0.2 and …

CVE-2026-63030 CVE-2026-60137 CVE-2018-14028