tag
Pre-Auth
WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell")
CVE-2026-64638 — nicknamed XSS2Shell by its discoverers at pwn.ai — is a pre-authentication reflected XSS in the WordPress login page that chains through five to seven stages into full remote code execution on the server. It is one of the most impactful…
Oracle E-Business Suite Pre-Authentication RCE Chain (CVE-2025-61882)
CVE-2025-61882 is an unauthenticated remote code execution chain in Oracle E-Business Suite 12.2.3 through 12.2.14. An attacker POSTs an XML document to the unauthenticated /OAHTML/configurator/UiServlet endpoint; the servlet extracts a returnurl element from…
XSpeeder SXZOS Pre-Auth eval() Remote Code Execution (CVE-2025-54322)
XSpeeder SXZOS firmware exposes a Django-based web endpoint that passes a base64-decoded, attacker-controlled chkid query parameter into Python's eval(). Because there is no authentication check on this endpoint and no sanitization of the decoded payload, an…
SmarterMail Auth Bypass via Password Reset to Pre-Auth RCE (CVE-2025-52691 / WT-2026-0001)
This PoC chains two SmarterMail vulnerabilities into a single pre-authentication-to-RCE exploit. First (WT-2026-0001), the /api/v1/auth/force-reset-password endpoint accepts a password-reset request that sets a new password for an arbitrary (including…
Monsta FTP Pre-Authentication Remote Code Execution via Arbitrary File Upload (CVE-2025-34299)
Monsta FTP versions up to and including 2.11.2 contain a pre-authentication, unrestricted arbitrary file upload vulnerability (CWE-434) in the downloadFile action of its /mftp/application/api/api.php endpoint. The endpoint accepts a user-supplied FTP…
Langflow Pre-Auth RCE Mass Scanner (CVE-2026-27966)
Langflow versions prior to 1.8.0 hardcode allowdangerouscode=True in the CSV Agent component, exposing LangChain's pythonreplast tool to prompt injection. Independently, several Langflow REST API endpoints (customcomponent, build/{uuid}/vertices,…
strongSwan RADIUS Attribute-Iterator Pre-Auth Infinite Loop / Remote DoS (CVE-2026-35333)
strongSwan's attributeenumerate() in src/libradius/radiusmessage.c accepts RADIUS attributes whose length byte is smaller than sizeof(rattrt) (2 bytes). When length == 0, the remaining-data counter underflows to a huge value and the loop's decrement condition…
OpenAM Pre-Authentication RCE via `jato.clientSession` Deserialization (CVE-2026-33439)
OpenAM's unauthenticated Password Reset pages accept a jato.clientSession parameter that is passed to Encoder.deserialize() without any class allowlist/filtering, allowing an attacker to submit an arbitrary serialized Java object graph. The PoC builds a…
NVIDIA Triton Inference Server SageMaker Auth Bypass to Unauthenticated RCE (CVE-2026-24207)
NVIDIA Triton Inference Server exposes separate HTTP endpoints for SageMaker and Vertex AI multi-model integration. These endpoints bypass the operator-configured --http-restricted-api access control, meaning the model-management surface…
MIPS-Based Managed Switch Firmware Pre-Auth Kernel RCE — CVE-2026-1668
The switch's embedded web management HTTP server contains a memory-corruption flaw reachable via a crafted request to the /data/login.json endpoint, exploitable before the device's first legitimate HTTP request after boot. The PoC builds a raw MIPS shellcode…
GNU InetUtils telnetd LINEMODE SLC Pre-Auth Buffer Overflow (CVE-2026-32746)
GNU InetUtils telnetd's addslc() function in telnetd/slc.c appends 3 bytes per SLC (Set Local Characters) triplet into a fixed 108-byte buffer (slcbuf) with no bounds checking. During telnet option negotiation, before any login prompt is shown, an…
Discuz! X5.0 Race Condition + CAPTCHA-Solving Pre-Auth to RCE Chain (CVE-2026-49952)
This is a multi-stage, pre-auth-to-RCE exploit chain against Discuz! X5.0 that combines several bugs: an authcode-based DB export/import feature is abused to leak the admin's username and MD5 password hash from a database backup; the exploit then registers a…
Splunk Enterprise Pre-Auth RCE via PostgreSQL Sidecar (CVE-2026-20253)
CVE-2026-20253 is a critical unauthenticated RCE vulnerability in Splunk Enterprise arising from a missing authentication check on the PostgreSQL sidecar service endpoint /v1/postgres/recovery/backup. An unauthenticated attacker can reach this endpoint and…
Ivanti Sentry Pre-Auth RCE + Auth Bypass (CVE-2026-10520 / CVE-2026-10523)
Two critical vulnerabilities in Ivanti Sentry enable unauthenticated root-level RCE and arbitrary admin account creation. CVE-2026-10520 is an OS command injection in the MICS API at /mics/api/v2/sentry/mics-config/handleMessage (CVSS 10.0). CVE-2026-10523 is…
Next.js RSC Server-Action DoS via Flight Deserialization (CVE-2026-23870)
CVE-2026-23870 is a pre-authentication Denial of Service against any Next.js deployment using the App Router. An attacker sends crafted HTTP POST requests to any App Router server function endpoint with a deeply-cyclic or wide fan-out React Flight protocol…
Ivanti Connect Secure Pre-Auth RCE (Stack Overflow)
CVE-2025-0282 is a pre-authentication stack-based buffer overflow in the IFT (IF-T) TLS protocol handling code of Ivanti Connect Secure VPN appliances. Discovered and disclosed by Sina Kheirkhah of watchTowr Labs, this zero-day was confirmed by Mandiant as…
Erlang/OTP SSH Pre-Auth RCE - CVE-2025-32433
CVE-2025-32433 is a critical pre-authentication remote code execution vulnerability in the Erlang/OTP SSH server with a CVSS score of 10.0. An attacker with network access to any service built on Erlang/OTP's SSH daemon can execute arbitrary OS commands…
Apache httpd mod_http2 Double-Free Pre-Auth RCE - CVE-2026-23918
CVE-2026-23918 is a pre-authentication double-free vulnerability in Apache httpd's modhttp2 stream cleanup path. Under affected configurations, a remote attacker can trigger memory corruption over HTTP/2 before authentication. The upstream PoC demonstrates…