[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":80,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":87,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":93,"vulnerability-29981":100},[4,15,24,31,38,45,65,70],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"priority":13,"campaign_id":14},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan","https:\u002F\u002Fpentest-tools.com\u002Fpricing",true,[11],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan","See pricing options","secondary","php2shell-rce",{"title":16,"slug":17,"text":18,"link":19,"external":20,"targets":21,"cta":23,"variant":13,"priority":13,"campaign_id":17},"Node2Shell - Exploit on Sniper: Auto-Exploiter page","node2shell-exploit","🚨 Exclusive exploit for Node2Shell now live","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-sniper",false,[22],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan",{"title":25,"slug":17,"text":26,"link":27,"external":9,"targets":28,"cta":30,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - Exploit on the NS page","🚨 Go beyond Node2Shell detection: exploit it with our exclusive module","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-network",[29],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":32,"slug":33,"text":34,"link":35,"external":9,"targets":36,"cta":30,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - CVE page","node2shell-exploit-1","🚨 Detect + prove Node2Shell with our exclusive Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-vulndb",[37],"\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",{"title":39,"slug":17,"text":40,"link":35,"external":9,"targets":41,"cta":44,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - Vuln DB homepage, product","🚨 CISA reports active Node2Shell exploitation. Use our exclusive exploit to get proof",[42,43],"\u002Fvulnerabilities-exploits","\u002Fproduct","Get the Exploit plan",{"title":46,"slug":17,"text":47,"link":8,"external":9,"targets":48,"cta":12,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - top pages, pricing CTA","Detect PHP2Shell & Node2Shell with every paid plan. Prove Node2Shell with the Exploit plan.",[49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams",{"title":66,"slug":17,"text":47,"link":67,"external":20,"targets":68,"cta":67,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - pricing page",null,[69],"\u002Fpricing",{"title":71,"slug":72,"text":73,"link":74,"external":9,"targets":75,"cta":78,"variant":13,"priority":13,"campaign_id":79},"Office Hours #14 recording","office-hours-14-recording","[Office Hours recording] PHP2Shell and HTTP2Shell, check to proof","https:\u002F\u002Fyoutu.be\u002FNewX2xofWgE",[76,77],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Watch the recording","office-hours-14",["Island",81],{"key":82,"params":83,"result":85},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":84},"{}",{"head":86},{},["Island",88],{"key":89,"params":90,"result":91},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":84},{"head":92},{},["Island",94],{"key":95,"params":96,"result":98},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":97},"{\"text-color\":\"gray\"}",{"head":99},{},{"id":101,"detectable_with":102,"vuln_details":108,"vuln_id":130,"name":131,"published":124,"updated":124},29981,{"tool":103,"engine":106},{"id":104,"name":105},1,"Network Scanner",{"id":104,"name":107},"Sniper",{"id":101,"codename":109,"description":110,"severity":111,"risk_description":112,"public_description":113,"public_recommendation":114,"recommendation":115,"references":116,"cvssv3":119,"epss_score":120,"epss_percentile":121,"cve":122,"in_cisa_catalog":20,"date":124,"software_type":125,"vendor":126,"product":127,"ptt_exploit_capabilities":128},"sshhole","We found that the target server is vulnerable to an Authentication Bypass in OpenSSH running on a musl libc system without PAM. A remote attacker can log in to accounts that are supposed to be locked or key-only (their \u002Fetc\u002Fshadow password field disables interactive login) by supplying any password between 257 and 1024 characters long. The root cause is that musl's crypt() returns the account's locked token for over-long inputs, which sshd then accepts as a matching hash. The outcome is an authentication bypass that yields an interactive session for accounts that should reject password logins, and command execution whenever the bypassed account has a usable shell.","high","The risk exists that a remote unauthenticated attacker can log in as locked or key-only system accounts, steal confidential information, execute commands when the account has a shell, or pivot into the internal network.","OpenSSH built against musl libc and running without PAM is vulnerable to an Authentication Bypass. A remote attacker can authenticate to locked or key-only accounts by supplying a password between 257 and 1024 characters long, because musl's crypt() returns the account's locked token for over-long inputs and sshd treats it as a password match. This grants access to accounts whose password login should be disabled.","Update OpenSSH to 10.6p2 or later, or disable SSH password authentication.","We recommend upgrading OpenSSH to 10.6p2 or a vendor-provided patched build. As a mitigation, disable password authentication by setting 'PasswordAuthentication no' in sshd_config on musl-based systems that run sshd without PAM.",[117,118],"https:\u002F\u002Fsshhole.com\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-123158",8.1,0.00976,0.6228,[123],"CVE-2026-123158","2026-11-05T00:00:00Z","Application","OpenSSH","OpenSSH Portable",[129],"RCE","NETSCAN-SNIPER-CVE-2026-123158","OpenSSH musl - Authentication Bypass (CVE-2026-123158 - *sshole)"]