[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":80,"vulnerability-29971":87,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":116,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":122},[4,15,24,31,38,45,65,70],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"priority":13,"campaign_id":14},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan","https:\u002F\u002Fpentest-tools.com\u002Fpricing",true,[11],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan","See pricing options","secondary","php2shell-rce",{"title":16,"slug":17,"text":18,"link":19,"external":20,"targets":21,"cta":23,"variant":13,"priority":13,"campaign_id":17},"Node2Shell - Exploit on Sniper: Auto-Exploiter page","node2shell-exploit","🚨 Exclusive exploit for Node2Shell now live","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-sniper",false,[22],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan",{"title":25,"slug":17,"text":26,"link":27,"external":9,"targets":28,"cta":30,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - Exploit on the NS page","🚨 Go beyond Node2Shell detection: exploit it with our exclusive module","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-network",[29],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":32,"slug":33,"text":34,"link":35,"external":9,"targets":36,"cta":30,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - CVE page","node2shell-exploit-1","🚨 Detect + prove Node2Shell with our exclusive Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-vulndb",[37],"\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",{"title":39,"slug":17,"text":40,"link":35,"external":9,"targets":41,"cta":44,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - Vuln DB homepage, product","🚨 CISA reports active Node2Shell exploitation. Use our exclusive exploit to get proof",[42,43],"\u002Fvulnerabilities-exploits","\u002Fproduct","Get the Exploit plan",{"title":46,"slug":17,"text":47,"link":8,"external":9,"targets":48,"cta":12,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - top pages, pricing CTA","Detect PHP2Shell & Node2Shell with every paid plan. Prove Node2Shell with the Exploit plan.",[49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams",{"title":66,"slug":17,"text":47,"link":67,"external":20,"targets":68,"cta":67,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - pricing page",null,[69],"\u002Fpricing",{"title":71,"slug":72,"text":73,"link":74,"external":9,"targets":75,"cta":78,"variant":13,"priority":13,"campaign_id":79},"Office Hours #14 recording","office-hours-14-recording","[Office Hours recording] PHP2Shell and HTTP2Shell, check to proof","https:\u002F\u002Fyoutu.be\u002FNewX2xofWgE",[76,77],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Watch the recording","office-hours-14",["Island",81],{"key":82,"params":83,"result":85},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":84},"{}",{"head":86},{},{"id":88,"detectable_with":89,"vuln_details":96,"vuln_id":113,"name":114,"published":115,"updated":67},29971,{"tool":90,"engine":93},{"id":91,"name":92},1,"Network Scanner",{"id":94,"name":95},2,"Nuclei",{"id":88,"codename":67,"description":67,"severity":97,"risk_description":98,"public_description":99,"public_recommendation":100,"recommendation":67,"references":101,"cvssv3":105,"epss_score":106,"epss_percentile":107,"cve":108,"in_cisa_catalog":20,"date":110,"software_type":67,"vendor":111,"product":112,"ptt_exploit_capabilities":67},"critical","An anonymous guest who owns a draft cart may reach an order administration\nroute that should require Commerce administration access. The advisory also\nreports possible financial impact; this template only reads the confirmation\nform and does not submit the transition or complete checkout.","Drupal Commerce Core before 3.3.13 on the 3.x branch and before 8.x-2.41 on the 2.x branch does not sufficiently protect certain order administration routes. This template finds a public product using a bounded set of 63 canonical product IDs, adds one item to a fresh guest cart, and checks whether the guest can read that cart order's administrative state-transition form. No account, prior order ID, JSON:API, or checkout is required. The guest draft order persists. Sites without a usable product among the sampled IDs produce no finding, which is inconclusive.","Upgrade Commerce Core 3.x to 3.3.13 or the earlier branch to 8.x-2.41. Review orders for inconsistencies as advised by Drupal.",[102,103,104],"https:\u002F\u002Fwww.drupal.org\u002Fsa-contrib-2026-254","https:\u002F\u002Fwww.drupal.org\u002Fproject\u002Fcommerce\u002Freleases\u002F3.3.13","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-118539",6.5,0.00305,0.23406,[109],"CVE-2026-118539","2026-10-30T00:00:00Z","drupal","commerce_core","NETSCAN-NUCLEI-CVE-CVE-2026-118539","Drupal Commerce Core \u003C 3.3.13 \u002F \u003C 8.x-2.41 - Guest Cart Admin Access Bypass","2026-11-04T00:00:00Z",["Island",117],{"key":118,"params":119,"result":120},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":84},{"head":121},{},["Island",123],{"key":124,"params":125,"result":127},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":126},"{\"text-color\":\"gray\"}",{"head":128},{}]