[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":57,"vulnerability-29943":64,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":96,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":102},[4,13,23,35,43,50],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":8,"variant":12,"priority":12,"campaign_id":6},"PHP2Shell, Node2Shell, *sshole detections - pricing page","node2shell-exploit","Detect PHP2Shell, Node2Shell & *sshole with every paid plan.",null,false,[11],"\u002Fpricing","secondary",{"title":14,"slug":15,"text":16,"link":17,"external":18,"targets":19,"cta":22,"variant":12,"priority":12,"campaign_id":15},"Office Hours #15","office-hours-15","[Live Office Hours, Wed Nov 18] Behind the login, beyond the scan","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_BUp1qET2THa_5h65whpx9g",true,[20,21],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":24,"slug":25,"text":26,"link":27,"external":9,"targets":28,"cta":34,"variant":12,"priority":12,"campaign_id":25},"*sshole, PHP2Shell & Node2Shell - HP, Vuln DB, product page","sshole-detect-exploit","🚨 Detect *sshole & Node2Shell with any paid plan. Get proof with our Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[29,30,31,32,33],"\u002F","\u002Fvulnerabilities-exploits","\u002Fvulnerabilities-exploits\u002Fopenssh-musl-authentication-bypass-cve-2026-123158-sshole_29981","\u002Fvulnerabilities-exploits\u002Fnode2shell-http2shell-brotli-decoder-remote-code-execution_29896","\u002Fproduct","See pricing options",{"title":36,"slug":37,"text":38,"link":27,"external":9,"targets":39,"cta":41,"variant":12,"priority":12,"campaign_id":42},"*sshole - Exploit on Sniper: Auto-Exploiter page","sshole-exploit-sniper","🚨 Exclusive exploit for *sshole now live",[40],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan","sshole-exploit",{"title":44,"slug":45,"text":46,"link":27,"external":18,"targets":47,"cta":49,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - Exploit on the NS page","sshole-exploit-ns","🚨 Go beyond *sshole detection: get proof of exploitation",[48],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":51,"slug":52,"text":53,"link":27,"external":18,"targets":54,"cta":34,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - WS, free tools","sshole-exploit-mainpw","Detect *sshole with every paid plan. Prove it with Exploit.",[55,56],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffor\u002Ffree",["Island",58],{"key":59,"params":60,"result":62},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":61},"{}",{"head":63},{},{"id":65,"detectable_with":66,"vuln_details":72,"vuln_id":93,"name":94,"published":95,"updated":95},29943,{"tool":67,"engine":70},{"id":68,"name":69},1,"Network Scanner",{"id":68,"name":71},"Sniper",{"id":65,"codename":8,"description":73,"severity":74,"risk_description":75,"public_description":76,"public_recommendation":77,"recommendation":78,"references":79,"cvssv3":83,"epss_score":84,"epss_percentile":85,"cve":86,"in_cisa_catalog":18,"date":88,"software_type":89,"vendor":90,"product":90,"ptt_exploit_capabilities":91},"We found that the target server is vulnerable to CVE-2026-60004, a remote code execution affecting Gitea versions from 1.17 up to and including 1.27.0. The flaw is a code injection (CWE-94) in the diffpatch API endpoint (POST \u002Fapi\u002Fv1\u002Frepos\u002F{owner}\u002F{repo}\u002Fdiffpatch): the endpoint applies an attacker-supplied patch inside a bare temporary clone with git apply --index --cached, but submitting the same patch twice triggers an add\u002Fadd collision whose three-way merge fallback checks the indexed path out to disk. A patch that creates an executable file at hooks\u002Fpost-index-change therefore writes a live Git hook into the bare repository's GIT_DIR, which Git then executes as the Gitea OS service account during the same operation. A repository write is all that is required, and when open registration is enabled an attacker can self-register and create a repository, making the issue exploitable without prior credentials. We confirmed the vulnerability by reading the version the appliance advertises on the unauthenticated \u002Fapi\u002Fv1\u002Fversion endpoint.","critical","This vulnerability permits full compromise of the Gitea server with no pre-existing credentials on instances that allow open registration, letting attackers read every hosted repository, steal the service configuration and database credentials, deploy ransomware or coin miners, establish persistent backdoors, and pivot into the internal network; the impact and scope are critical and exploitation has been observed in the wild.","Gitea versions from 1.17 through 1.27.0 contain a remote code execution vulnerability stemming from code injection (CWE-94) in the diffpatch API endpoint. By applying a crafted patch twice, an attacker with write access to a repository can write an executable Git hook into the repository's bare Git directory, which is then executed as the Gitea service account. Because exploitation only requires repository write access, and Gitea's default open registration lets anyone register and create a repository, a remote attacker can achieve arbitrary command execution without pre-existing credentials.","Upgrade Gitea to version 1.27.1 or later immediately.","We recommend upgrading Gitea to version 1.27.1 or later immediately. As additional mitigations, disable open registration (set service.DISABLE_REGISTRATION or restrict it to trusted users), limit repository creation and public write access, restrict network access to the Gitea interface, and audit hosted repositories for unexpected hook files and unknown refs.",[80,81,82],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-60004","https:\u002F\u002Fgithub.com\u002Fgo-gitea\u002Fgitea\u002Fsecurity\u002Fadvisories\u002FGHSA-rcr6-4jqh-j84m","https:\u002F\u002Fgithub.com\u002FEQSTLab\u002FCVE-2026-60004",9.8,0.23988,0.97856,[87],"CVE-2026-60004","2026-07-28T00:00:00Z","Version Control System","Gitea",[92],"RCE","NETSCAN-SNIPER-CVE-2026-60004","Gitea - Remote Code Execution","2026-10-13T00:00:00Z",["Island",97],{"key":98,"params":99,"result":100},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":61},{"head":101},{},["Island",103],{"key":104,"params":105,"result":107},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":106},"{\"text-color\":\"gray\"}",{"head":108},{}]