[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"vulnerability-29950":57,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":90,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":97,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":103},[4,13,23,35,43,50],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":8,"variant":12,"priority":12,"campaign_id":6},"PHP2Shell, Node2Shell, *sshole detections - pricing page","node2shell-exploit","Detect PHP2Shell, Node2Shell & *sshole with every paid plan.",null,false,[11],"\u002Fpricing","secondary",{"title":14,"slug":15,"text":16,"link":17,"external":18,"targets":19,"cta":22,"variant":12,"priority":12,"campaign_id":15},"Office Hours #15","office-hours-15","[Live Office Hours, Wed Nov 18] Behind the login, beyond the scan","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_BUp1qET2THa_5h65whpx9g",true,[20,21],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":24,"slug":25,"text":26,"link":27,"external":9,"targets":28,"cta":34,"variant":12,"priority":12,"campaign_id":25},"*sshole, PHP2Shell & Node2Shell - HP, Vuln DB, product page","sshole-detect-exploit","🚨 Detect *sshole & Node2Shell with any paid plan. Get proof with our Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[29,30,31,32,33],"\u002F","\u002Fvulnerabilities-exploits","\u002Fvulnerabilities-exploits\u002Fopenssh-musl-authentication-bypass-cve-2026-123158-sshole_29981","\u002Fvulnerabilities-exploits\u002Fnode2shell-http2shell-brotli-decoder-remote-code-execution_29896","\u002Fproduct","See pricing options",{"title":36,"slug":37,"text":38,"link":27,"external":9,"targets":39,"cta":41,"variant":12,"priority":12,"campaign_id":42},"*sshole - Exploit on Sniper: Auto-Exploiter page","sshole-exploit-sniper","🚨 Exclusive exploit for *sshole now live",[40],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan","sshole-exploit",{"title":44,"slug":45,"text":46,"link":27,"external":18,"targets":47,"cta":49,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - Exploit on the NS page","sshole-exploit-ns","🚨 Go beyond *sshole detection: get proof of exploitation",[48],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":51,"slug":52,"text":53,"link":27,"external":18,"targets":54,"cta":34,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - WS, free tools","sshole-exploit-mainpw","Detect *sshole with every paid plan. Prove it with Exploit.",[55,56],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffor\u002Ffree",{"id":58,"detectable_with":59,"vuln_details":65,"vuln_id":87,"name":88,"published":89,"updated":89},29950,{"tool":60,"engine":63},{"id":61,"name":62},1,"Network Scanner",{"id":61,"name":64},"Sniper",{"id":58,"codename":8,"description":66,"severity":67,"risk_description":68,"public_description":69,"public_recommendation":70,"recommendation":71,"references":72,"cvssv3":76,"epss_score":77,"epss_percentile":78,"cve":79,"in_cisa_catalog":9,"date":81,"software_type":82,"vendor":83,"product":84,"ptt_exploit_capabilities":85},"We found that the target server is vulnerable to CVE-2026-76581, an unauthenticated Authentication Bypass, affecting the WPMU DEV Dashboard plugin (wpmudev-updates) for WordPress in versions up to and including 5.0.1. The root cause of this vulnerability is an HMAC canonicalization confusion in the Hub SSO flow: the step1 handler signs the concatenation token.state.redirect.domain while the step2 handler verifies token.state.redirect, omitting the domain. We managed to detect this vulnerability by requesting the wdpsso_step1 admin-ajax action with an empty-style redirect, then replaying the returned HMAC to the wdpsso_step2 action with the domain folded into the redirect field, which validates the forged signature and issues a WordPress administrator session. We confirmed the takeover by loading \u002Fwp-admin\u002F as the administrator and enumerating the site accounts.","critical","The risk exists that a remote unauthenticated attacker can take over an administrator account in order to steal confidential information, install malicious plugins to achieve remote code execution, or pivot to the internal network.","The WPMU DEV Dashboard plugin for WordPress is affected by an unauthenticated Authentication Bypass vulnerability. The root cause is a cryptographic signature canonicalization confusion in the Hub SSO login flow, where the signature generated in the first step is verified over a different, overlapping set of fields in the second step. By folding the site domain into the redirect parameter, a remote unauthenticated attacker can make the first-step signature validate in the second step and obtain a WordPress administrator session, fully taking over the site.","Update the WPMU DEV Dashboard plugin to version 5.0.2 or later.","We recommend to update the WPMU DEV Dashboard plugin to version 5.0.2 or later. If an immediate upgrade is not possible, disable the Hub SSO feature of the plugin.",[73,74,75],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76581","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Fc09f0c03-da61-4e3e-b45c-54426b2d7824\u002F","https:\u002F\u002Fwww.rapid7.com\u002Fdb\u002Fvulnerabilities\u002Fcve-2026-76581\u002F",9.8,0.00435,0.38065,[80],"CVE-2026-76581","2026-08-27T00:00:00Z","WordPress Plugin","WPMU DEV","WPMU DEV Dashboard",[86],"CUSTOM","NETSCAN-SNIPER-CVE-2026-76581","WordPress WPMU DEV Dashboard - Authentication Bypass","2026-10-25T00:00:00Z",["Island",91],{"key":92,"params":93,"result":95},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":94},"{}",{"head":96},{},["Island",98],{"key":99,"params":100,"result":101},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":94},{"head":102},{},["Island",104],{"key":105,"params":106,"result":108},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":107},"{\"text-color\":\"gray\"}",{"head":109},{}]