🚨Search for all leaked keys/secrets using one regex!
✅regex: https://gist.github.com/h4x0r-dz/be69c7533075ab0d3f0c9b97f7c93a59
#BugBounty #bugbountytip
✅regex: https://gist.github.com/h4x0r-dz/be69c7533075ab0d3f0c9b97f7c93a59
#BugBounty #bugbountytip
🤨6❤4🔥3🗿2
This media is not supported in your browser
VIEW IN TELEGRAM
🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below.
⚠️ https://pwn.ai/blog/click2shell
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥6❤2😱2👏1
Brut Security
🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's…
11 new vulnerabilities in WordPress, no CVE assigned yet ❗️
WordPress 7.1.1 security release patches 11 vulnerabilities including stored XSS, path traversal, and other security flaws.
Search at Netlas.io:
👉 Link: https://nt.ls/s3kOE
👉 Dork: tag.name:"wordpress"
WordPress 7.1.1 security release patches 11 vulnerabilities including stored XSS, path traversal, and other security flaws.
Search at Netlas.io:
👉 Link: https://nt.ls/s3kOE
👉 Dork: tag.name:"wordpress"
❤6
This media is not supported in your browser
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
❤5🔥5🗿2
Media is too big
VIEW IN TELEGRAM
FOFA UNLIMITED
🔹 100 Fresh fofa Accounts
🔹 3,000 Credits per Account / Month
🔹 100 × 3,000 = 300,000 Credits / Month
🔹 Chrome Extension with Auto Login
💰 Price: Only $30
All account details and extension are provided together.
Interested?
📩 DM on Telegram: @fofaseller
#AD
🔹 100 Fresh fofa Accounts
🔹 3,000 Credits per Account / Month
🔹 100 × 3,000 = 300,000 Credits / Month
🔹 Chrome Extension with Auto Login
💰 Price: Only $30
All account details and extension are provided together.
Interested?
📩 DM on Telegram: @fofaseller
#AD
🤣5❤4
🚨Bypass-403 - A simple script just made for self use for bypassing 403.
https://github.com/iamj0ker/bypass-403
#bugbounty #pentesting
https://github.com/iamj0ker/bypass-403
#bugbounty #pentesting
❤9🔥4😁2
Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)
https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858
https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858
Cyera
Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)
Cyera Research Labs has discovered a "worst-case scenario" flaw in n8n, the industry-leading platform for AI and workflow automation. Dubbed "Ni8mare," this vulnerability (CVE-2026-21858) allows an unauthenticated remote attacker to gain full administrative…
❤6
Please open Telegram to view this post
VIEW IN TELEGRAM
🤣17😁5❤3
The new RCE exploit is 100% effective; it has already generated 48 shells in just 10 minutes. ⚡
It involves 5 combined exploits affecting over 900,000 sites. 🎯
Affecting +970k websites
DM me to buy 👉 @Mm_fit
Channel: https://t.me/fox_security_cve
#AD
It involves 5 combined exploits affecting over 900,000 sites. 🎯
Affecting +970k websites
DM me to buy 👉 @Mm_fit
Channel: https://t.me/fox_security_cve
#AD
🤣9❤3🔥2🗿2
Did you know some exposed Google Maps API keys may also have access to Gemini models? 👀
Try geminiHunter to hunt for exposed Gemini API keys across:
* JS/source maps
* Wayback snapshots
* Android APKs
* Web assets
It also deduplicates and validates keys, helping you identify which exposed keys are actually usable.
🔗 https://github.com/devploit/geminiHunter
Please open Telegram to view this post
VIEW IN TELEGRAM
❤2
Please open Telegram to view this post
VIEW IN TELEGRAM
❤2
🚨 CVE-2026-87902 - WordPress Core - PHP Template Path Traversal
Nuclei Template - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml
Reference: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
#hackwithautomation #bugbounty #wordpress
Nuclei Template - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml
Reference: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
#hackwithautomation #bugbounty #wordpress
❤6🔥2
CVE-2026-88804: Unauthenticated update of public UI settings leading to stored XSS in Rancher, 9.4 Rating 🔥
An unauthenticated attacker can plant malicious content that runs in the browser of anyone visiting the Rancher login page. This can leak the local administrator bootstrap password or hijack an active admin session, leading to complete control of the Rancher installation and its managed downstream clusters.
Search at Netlas.io:
👉 Link: https://nt.ls/dtxM5
👉 Dork: http.favicon.hash_sha256:2d7adbc74e7c8941927d04e702acbff577d219fef8617c8c3014d34ae395525b OR http.body:"<title>Rancher</title>" OR http.unknown_headers.key:"x_api_cattle_auth"
Vendor's advisory:
https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f
An unauthenticated attacker can plant malicious content that runs in the browser of anyone visiting the Rancher login page. This can leak the local administrator bootstrap password or hijack an active admin session, leading to complete control of the Rancher installation and its managed downstream clusters.
Search at Netlas.io:
👉 Link: https://nt.ls/dtxM5
👉 Dork: http.favicon.hash_sha256:2d7adbc74e7c8941927d04e702acbff577d219fef8617c8c3014d34ae395525b OR http.body:"<title>Rancher</title>" OR http.unknown_headers.key:"x_api_cattle_auth"
Vendor's advisory:
https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f
❤7
/etc/passwd ==> WAF restriction? Use these:
/e?c/?asswd
/e*c/*asswd
/??c/?asswd
/??c/?assw?
Doesn't work always, just give it a try. 🎯
#bugbountytip #bugbountytips #bugbounty
/e?c/?asswd
/e*c/*asswd
/??c/?asswd
/??c/?assw?
Doesn't work always, just give it a try. 🎯
#bugbountytip #bugbountytips #bugbounty
❤20👎3