https://vulnerability.circl.lu/sightings/feed 2026-08-10T11:14:02.555490+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c2545914-be1f-44f8-b5d7-4aedc2628f62/export 2026-08-10T11:14:02.576195+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c2545914-be1f-44f8-b5d7-4aedc2628f62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/117070225471896503", "content": "Dans la suite de wp2shell, encore une jolie cha\u00eene WordPress : #XSS2Shell \u2014 CVE-2026-64638.\nAu d\u00e9part, on a \u201cjuste\u201d une Reflected XSS pr\u00e9-auth sur wp-login.php.\nSauf qu\u2019en la cha\u00eenant avec plusieurs briques d\u00e9j\u00e0 pr\u00e9sentes dans WordPress, on arrive \u00e0 quelque chose de beaucoup moins sympa :\nXSS \u2192 contexte admin \u2192 Application Password \u2192 REST API \u2192 upload de plugin \u2192 RCE \ud83d\udc1a\n\u26a0\ufe0f \u00c0 noter quand m\u00eame : ce n\u2019est pas du pre-auth zero-click. Il faut qu\u2019un admin d\u00e9j\u00e0 connect\u00e9 clique sur un lien contr\u00f4l\u00e9 par l\u2019attaquant.\nEncore un bon rappel : une \u201csimple XSS\u201d peut devenir franchement m\u00e9chante une fois mise dans la bonne cha\u00eene.\n\ud83e\ude79 Corrig\u00e9 dans WordPress 7.0.3.\ud83d\udc47 https://wordpress.org/news/2026/08/wordpress-7-0-3-release/\nEn cas de doute sur une exploitation pass\u00e9e : petit coup d\u2019\u0153il aux Application Passwords, aux plugins r\u00e9cemment ajout\u00e9s et aux fichiers PHP inhabituels.\n\"XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)\"\ud83d\udc47 https://pwn.ai/blog/xss2shell\n#WordPress #XSS2Shell #CyberVeille", "creation_timestamp": "2026-08-10T08:17:56.883432Z"} 2026-08-10T08:17:56.883432+00:00 https://vulnerability.circl.lu/sighting/19cd1e47-8036-4f2d-9da7-ac5ec9cbcb5f/export 2026-08-10T11:14:02.578292+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "19cd1e47-8036-4f2d-9da7-ac5ec9cbcb5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mspingo232cq", "content": "XSS2Shell\uff1aWordPress\u306e\u65b0\u305f\u306a\u8106\u5f31\u6027\u304cPHP\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u6050\u308c\uff08CVE-2026-64638\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47150/", "creation_timestamp": "2026-08-10T06:42:03.535219Z"} 2026-08-10T06:42:03.535219+00:00 https://vulnerability.circl.lu/sighting/c492b5d6-54d5-4df5-8887-e38687b08930/export 2026-08-10T11:14:02.578431+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c492b5d6-54d5-4df5-8887-e38687b08930", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3msp5uswgt52v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-18577: 45 interactions\nCVE-2026-64564: 28 interactions\nCVE-2026-64638: 18 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-64564: 7 interactions\nCVE-2026-64638: 7 interactions\nCVE-2023-32243: 4 interactions\n", "creation_timestamp": "2026-08-10T03:29:18.604265Z"} 2026-08-10T03:29:18.604265+00:00 https://vulnerability.circl.lu/sighting/5fbe07b2-3a0d-4028-8799-e51f092d6cf6/export 2026-08-10T11:14:02.578543+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5fbe07b2-3a0d-4028-8799-e51f092d6cf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "Telegram/klaEVSfV6aFwjbDiRhEG7k8uR6-Adg0fEsHVri5VAdnsPw", "content": "", "creation_timestamp": "2026-08-10T00:00:34.524375Z"} 2026-08-10T00:00:34.524375+00:00 https://vulnerability.circl.lu/sighting/66b0fbca-fe43-451c-b907-c0a5aa48acb1/export 2026-08-10T11:14:02.578645+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "66b0fbca-fe43-451c-b907-c0a5aa48acb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "Telegram/gC-Feyj_NVtKkRh3sp4R5nqV2dNmCCpxvHNUuyELSqfYxZQ", "content": "", "creation_timestamp": "2026-08-10T00:00:33.293546Z"} 2026-08-10T00:00:33.293546+00:00 https://vulnerability.circl.lu/sighting/381ad205-b927-4ce1-ae11-64d79344e8af/export 2026-08-10T11:14:02.578739+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "381ad205-b927-4ce1-ae11-64d79344e8af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "Telegram/EBJN8d2aRKvKAqc3bkxcH9oSfFJLXSc1tQsfrZ3JhWDZfCM", "content": "", "creation_timestamp": "2026-08-10T00:00:33.237974Z"} 2026-08-10T00:00:33.237974+00:00 https://vulnerability.circl.lu/sighting/0ebfd238-b21d-4f0a-8674-251886a43d5b/export 2026-08-10T11:14:02.578831+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0ebfd238-b21d-4f0a-8674-251886a43d5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97267", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a XSS2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ahmall-sec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-09 07:04:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nXSS2Shell ULTIMATE v3.0** is a powerful exploitation tool that chains **Cross-Site Scripting (XSS)** vulnerabilities in **WordPress** to achieve **Remote Code Execution (RCE)**. This tool exploits CVE-2026-64638 to gain full control over vulnerable WordPress installations.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-10T00:00:26.861293Z"} 2026-08-10T00:00:26.861293+00:00 https://vulnerability.circl.lu/sighting/09c9814c-6e85-40e8-8ce8-1b2cf04a145e/export 2026-08-10T11:14:02.578938+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "09c9814c-6e85-40e8-8ce8-1b2cf04a145e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "Telegram/kcVUlPhm9COtDyePMz7jQW_5f8bBmQRRiBk1RIm5X-5VhGQ", "content": "", "creation_timestamp": "2026-08-10T00:00:09.239273Z"} 2026-08-10T00:00:09.239273+00:00 https://vulnerability.circl.lu/sighting/800da309-5c4d-4144-86a7-8e7e32d2c29b/export 2026-08-10T11:14:02.579035+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "800da309-5c4d-4144-86a7-8e7e32d2c29b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97307", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Nuclei #template #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-PoC-XSS2Shell-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 12 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 3\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-09 14:03:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nXSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain \u2014 PoC exploit + defensive audit tool + nuclei template\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-10T00:00:09.123223Z"} 2026-08-10T00:00:09.123223+00:00 https://vulnerability.circl.lu/sighting/6ca31afb-3cd9-4b6f-ba0e-8efddb4d1d66/export 2026-08-10T11:14:02.579214+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6ca31afb-3cd9-4b6f-ba0e-8efddb4d1d66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97310", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a xss2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xlipon\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-09 14:59:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udd25 XSS2Shell \u2014 CVE-2026-64638 Scanner & PoC Toolkit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-10T00:00:09.006692Z"} 2026-08-10T00:00:09.006692+00:00