pip install -r requirements.txt

git clone https://github.com/Zierax/Grafana-Final-Scanner.git
cd Grafana-Final-Scanner
python scanner.py -u https://grafana.example.com

python scanner.py -u https://grafana.example.com

id: wp2shell-batch-exposure

info:
  name: WordPress wp2shell Exposure (CVE-2026-63030, CVE-2026-60137)
  author: zephrsec
  severity: critical
  reference:
    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
  classification:
    cve-id: CVE-2026-63030,CVE-2026-60137
  tags: wordpress,cve2026,rce,sqli,wp2shell

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /?rest_route=/batch/v1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    req-condition: true
    redirects: true

    extractors:
      - type: regex
        name: wp_version
        part: body_1
        group: 1
        regex:
          - 'name="generator" content="WordPress ([0-9.]+)"'

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - >-
            compare_versions(wp_version, ">=6.9.0", "<6.9.5") ||
            compare_versions(wp_version, ">=7.0.0", "<7.0.2") ||
            compare_versions(wp_version, ">=6.8.0", "<6.8.6")
      - type: word
        part: body_2
        words:
          - '"rest_missing_callback_param"'
          - '"rest_invalid_param"'
        condition: or

Недеструктивные эксплойты для удалённого выполнения кода (RCE) в Redis версий 6.2.22, 7.4.9 и 8.6.4 через двойное освобождение памяти (double free), связанное с shared-NACK в группах потребителей потоков; это семейство уязвимостей с неполным исправлением CVE-2026-25589.