Загрузка видео...

Не удалось загрузить видео

На главную

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

HacktronAI's profile picture

Hacktron AI

4,692 subscribers

39,685 просмотров • 2 месяцев назад •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

Комментарии: 4

Фото профиля YogSotho
YogSotho2 месяцев назад

@assetnote *uninstall your wordpress

Фото профиля ddddddddddd
ddddddddddd2 месяцев назад

@assetnote nice to see sql injection still going strong in 2026

Фото профиля Lilith Datura
Lilith Datura2 месяцев назад

@assetnote SQL

Фото профиля Sakir
Sakir2 месяцев назад

@assetnote where php script ?

Похожие видео

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote
0:38

One missing array entry started it all. then two WordPress core bugs chained through SQL injection, cache poisoning and an administrator identity switch -> ending in unauthenticated RCE. We reconstructed the path. CVE-2026-63030 kudos for discovering hashkitten Assetnote

BugBunny.ai - Continuous AI Pentesting System

15,935 просмотров • 2 месяцев назад

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!
0:44

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch! Shoutout to hashkitten at Assetnote for catching such an awesome bug!

Calif

63,835 просмотров • 2 месяцев назад

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇
0:53

Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇

0xSha

28,781 просмотров • 2 месяцев назад

Watch us open the camera and uncover the anonymous identity behind Tor browser: We published the writeup for the browser RCE in IonStack. Mythos reported 271 bugs in Firefox 150 but still missed this one. And the Tor Browser is also affected by CVE-2026-10702. Update your Tor!
1:04

Watch us open the camera and uncover the anonymous identity behind Tor browser: We published the writeup for the browser RCE in IonStack. Mythos reported 271 bugs in Firefox 150 but still missed this one. And the Tor Browser is also affected by CVE-2026-10702. Update your Tor!

NebuSec

74,105 просмотров • 1 месяц назад

The hallmark of our Government is to find long lasting and people-friendly solutions to challenges that have affected our nation for decades.
9:54

The hallmark of our Government is to find long lasting and people-friendly solutions to challenges that have affected our nation for decades.

Narendra Modi

708,363 просмотров • 3 лет назад

Yvonne: Where was Sakaja’s Green army all week to help the people at Grogan and other affected areas to clear the mud and water? Telling us about how you were affected by El nino is not what we want to hear; this is not about you Sakaja. Whilst we empathize with your experience, it is rather pointless #CitizenNewsGang Yvonne Okwara
1:45

Yvonne: Where was Sakaja’s Green army all week to help the people at Grogan and other affected areas to clear the mud and water? Telling us about how you were affected by El nino is not what we want to hear; this is not about you Sakaja. Whilst we empathize with your experience, it is rather pointless #CitizenNewsGang Yvonne Okwara

Citizen TV Kenya

40,702 просмотров • 6 месяцев назад

We just received a bounty reward from UniFi for reporting a vulnerability affecting UniFi OS devices. As part of the Hakai Labs (Hakai Offsec) research team at QuimeraX Intelligence, we independently identified a Path Traversal vulnerability (CVE-2026-34911) that allowed an attacker with network access to access internal routes on the underlying system without a valid token, exposing a sensitive information. Our research was conducted independently, but the vulnerability we reported could be chained with other vulnerabilities disclosed during the same period, including Improper Access Control and Command Injection flaws reported by other researchers. When combined, these issues lead to a pre-auth RCE affecting multiple UniFi OS products. Affected products include UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, and several other UniFi OS devices. We strongly recommend updating affected systems to the latest available version. Technical details remain under coordinated disclosure, and the only public information currently available is UniFi’s Security Advisory Bulletin.
1:13

We just received a bounty reward from UniFi for reporting a vulnerability affecting UniFi OS devices. As part of the Hakai Labs (Hakai Offsec) research team at QuimeraX Intelligence, we independently identified a Path Traversal vulnerability (CVE-2026-34911) that allowed an attacker with network access to access internal routes on the underlying system without a valid token, exposing a sensitive information. Our research was conducted independently, but the vulnerability we reported could be chained with other vulnerabilities disclosed during the same period, including Improper Access Control and Command Injection flaws reported by other researchers. When combined, these issues lead to a pre-auth RCE affecting multiple UniFi OS products. Affected products include UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, and several other UniFi OS devices. We strongly recommend updating affected systems to the latest available version. Technical details remain under coordinated disclosure, and the only public information currently available is UniFi’s Security Advisory Bulletin.

Carlos Vieira

37,588 просмотров • 3 месяцев назад

Kariba yarangarirwa 🔥🔥🔥🔥 This is the temporary vessel to service the route that has been affected by the recent tragedy. This is a small step while we wait for the arrival of a much bigger ferry. Our thoughts and prayers are still with the affected families 🙏🏿 #AsakhiZim
0:26

Kariba yarangarirwa 🔥🔥🔥🔥 This is the temporary vessel to service the route that has been affected by the recent tragedy. This is a small step while we wait for the arrival of a much bigger ferry. Our thoughts and prayers are still with the affected families 🙏🏿 #AsakhiZim

Shumbakadzi👑

19,931 просмотров • 28 дней назад

Visited traders affected by fire incidents at Toi Market and later at Umoja 2. Poleni sana to all affected and condolences to the bereaved. Sadly, we lost 4 souls in the Toi inferno. We will support their families during this trying time. For the traders, we will rebuild and help you get back to your feet. Thanks to the first responders and all who tried to help salvage the situation. We had a total of 7 fires across the city last night, and all affected will get support. For those who caused incitement, it is well, nothing will stop us from supporting our people.
0:47

Visited traders affected by fire incidents at Toi Market and later at Umoja 2. Poleni sana to all affected and condolences to the bereaved. Sadly, we lost 4 souls in the Toi inferno. We will support their families during this trying time. For the traders, we will rebuild and help you get back to your feet. Thanks to the first responders and all who tried to help salvage the situation. We had a total of 7 fires across the city last night, and all affected will get support. For those who caused incitement, it is well, nothing will stop us from supporting our people.

Sakaja Arthur Johnson

335,398 просмотров • 2 лет назад

Omo! This is quite relatable. The things that Japa has done! At least 75% of my friends have Japa’d, and making new friends now feels like a full-time job—where do you even start? In 2024 alone, I can’t count how many times my friends told me they were leaving Nigeria 🥲 Has Japa ever affected your friendships? Let’s really discuss what Japa does to relationships. How has Japa affected you and your loved ones? — Uncolored Podcast
0:50

Omo! This is quite relatable. The things that Japa has done! At least 75% of my friends have Japa’d, and making new friends now feels like a full-time job—where do you even start? In 2024 alone, I can’t count how many times my friends told me they were leaving Nigeria 🥲 Has Japa ever affected your friendships? Let’s really discuss what Japa does to relationships. How has Japa affected you and your loved ones? — Uncolored Podcast

Pamilerin Adegoke

143,198 просмотров • 1 год назад

The Flemish activist Dries Van Langenhove gave a great speech at @resum25. He summarized our proposal for remigration: -Who is affected? -How does remigration work? Share the speech and follow him!
19:36

The Flemish activist Dries Van Langenhove gave a great speech at @resum25. He summarized our proposal for remigration: -Who is affected? -How does remigration work? Share the speech and follow him!

Remigration Summit

20,956 просмотров • 1 год назад

Full Screen Friday 🔦⚡️ Vol. 16 #TezQuakeAid TezQuakeAid 💔 A community initiative to support those affected by the recent earthquake in Turkey and Syria. Shoutout to my friends for the live improv 🎙️ List of artists below 👇
1:24

Full Screen Friday 🔦⚡️ Vol. 16 #TezQuakeAid TezQuakeAid 💔 A community initiative to support those affected by the recent earthquake in Turkey and Syria. Shoutout to my friends for the live improv 🎙️ List of artists below 👇

Strano

27,882 просмотров • 3 лет назад

Anthony Jushua finally decided to retire from Boxing due to th3 recent acc¡d£nt that happened and took two of his best friends at the spot 😢😢😢. This is really a hard time for him and the families affected
1:04

Anthony Jushua finally decided to retire from Boxing due to th3 recent acc¡d£nt that happened and took two of his best friends at the spot 😢😢😢. This is really a hard time for him and the families affected

𝓞𝓫𝓼𝓮𝓻𝓿𝓪𝓽𝓲𝓸𝓷 𝓷𝓸 𝓫𝓮 𝓬𝓻𝓲𝓶𝓮

1,083,799 просмотров • 8 месяцев назад

Our thoughts are with all our friends around the world who were affected by community violence this weekend. You are not alone. When little ones hear about violent events on the news, it can be hard to help them understand and cope with what happened. Limiting media exposure and making space for them to express big feelings can help children feel safer and more secure. Check here for more free resources supporting families affected by violence:
2:18

Our thoughts are with all our friends around the world who were affected by community violence this weekend. You are not alone. When little ones hear about violent events on the news, it can be hard to help them understand and cope with what happened. Limiting media exposure and making space for them to express big feelings can help children feel safer and more secure. Check here for more free resources supporting families affected by violence:

Sesame Street

189,594 просмотров • 9 месяцев назад

The aftermath of a natural disaster is not the time for political games. We are working together with both Republican and Democratic officials to bring relief to those affected by Hurricanes Milton and Helene.
2:49

The aftermath of a natural disaster is not the time for political games. We are working together with both Republican and Democratic officials to bring relief to those affected by Hurricanes Milton and Helene.

Kamala Harris

522,319 просмотров • 1 год назад

For production, a stronger cedi is a disadvantage. The appreciation of the cedi from 14 to 10 was not a good thing. It has affected our prices for export. - Mike Oquaye Jnr, Former NPP Parliamentary Candidate, Dome Kwabenya #TheKeyPoints #TV3GH
3:15

For production, a stronger cedi is a disadvantage. The appreciation of the cedi from 14 to 10 was not a good thing. It has affected our prices for export. - Mike Oquaye Jnr, Former NPP Parliamentary Candidate, Dome Kwabenya #TheKeyPoints #TV3GH

#TV3GH

55,870 просмотров • 2 месяцев назад

Day 3 of supporting Nairobi flood victims. The Sonko Rescue Team continues to work around the clock to assist affected families by facilitating the release of bodies from mortuaries and providing some financial support for burial expenses. We are still receiving and verifying cases at our offices to ensure that every family can give their loved ones a dignified send-off.Once we conclude handling the Nairobi cases, we shall extend our helping hand to other parts of the country to support families affected by floods who are facing similar challenges. Our thoughts and prayers remain with all the families affected during this difficult time. 🙏
18:17

Day 3 of supporting Nairobi flood victims. The Sonko Rescue Team continues to work around the clock to assist affected families by facilitating the release of bodies from mortuaries and providing some financial support for burial expenses. We are still receiving and verifying cases at our offices to ensure that every family can give their loved ones a dignified send-off.Once we conclude handling the Nairobi cases, we shall extend our helping hand to other parts of the country to support families affected by floods who are facing similar challenges. Our thoughts and prayers remain with all the families affected during this difficult time. 🙏

Mike Sonko

49,870 просмотров • 6 месяцев назад

The world of snooker acknowledging long-term issues following a Covid jab. Now it's time for the government to have an open discussion and to find ways to support those affected. Medical, psychological, and financial support is sadly lacking. Time for change.
0:25

The world of snooker acknowledging long-term issues following a Covid jab. Now it's time for the government to have an open discussion and to find ways to support those affected. Medical, psychological, and financial support is sadly lacking. Time for change.

VIBUK Official

24,058 просмотров • 1 год назад

Indonesia’s government is resisting growing pressure to declare the devastating floods and landslides in Sumatra a national disaster, even as hundreds have died and thousands remain affected. Officials say the response is being handled at a national level, but the formal “national disaster” label has not been applied. Deaths: 824 Missing: 521 Injured: 2,700 Affected: 3.1 million Displaced: 592,800 Public Facilities Damaged: 536 Places of Worship Damaged: 185 Healthcare Facilities Damaged: 25 Buildings/Offices Damaged: 115 Educational Facilities Damaged: 326 Bridges Damaged: 295 Houses Damaged: 10,500 Regencies/Cities Affected: 51
0:26

Indonesia’s government is resisting growing pressure to declare the devastating floods and landslides in Sumatra a national disaster, even as hundreds have died and thousands remain affected. Officials say the response is being handled at a national level, but the formal “national disaster” label has not been applied. Deaths: 824 Missing: 521 Injured: 2,700 Affected: 3.1 million Displaced: 592,800 Public Facilities Damaged: 536 Places of Worship Damaged: 185 Healthcare Facilities Damaged: 25 Buildings/Offices Damaged: 115 Educational Facilities Damaged: 326 Bridges Damaged: 295 Houses Damaged: 10,500 Regencies/Cities Affected: 51

Volcaholic 🌋

138,899 просмотров • 9 месяцев назад