imXur
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubimXur/CVE-2026-48908-Joomla-SP-Page-Builder-RCE
Repository PoCStars: 2Created 2026-07-25WriteupCVE-2026-489082 files
Analysis
Technical assessment
A technical writeup describing payload withheld, an unauthenticated arbitrary file upload vulnerability in JoomShaper SP Page Builder. The document provides a vulnerability analysis, metrics, root cause explanation, and mitigation guidance but contains no exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a README.md file containing a technical vulnerability analysis and mitigation guidance for payload withheld. No executable code, scripts, commands, or deceptive payloads are present. The content is purely informational and does not exhibit any backdoor or harmful behavior.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file containing a vulnerability analysis, diagrams, and mitigation advice. It does not include any executable code, proof-of-concept script, or scanner logic. The content is purely descriptive and educational, fitting the definition of a writeup.
README.md:1-129Requirements
- Target must be running a vulnerable version of JoomShaper SP Page Builder (1.0.0-6.6.1).
README.md:21
Observed behavior
- Describes an unauthenticated POST request to an upload controller that writes a malicious file to a public web directory, followed by a GET request to execute the uploaded code.
README.md:69-75 - Explains that the upload endpoint lacks authorization checks and relies on permissive extension validation.
README.md:83-85
Behaviors behind the backdoor verdict
Observables
- Vulnerability Report
- Payload withheldThe artifact is a documentation-only repository describing an unauthenticated file upload vulnerability in JoomShaper SP Page Builder.
README.md:1-129
What the analysis did not establish
- Only one of two text files in the repository (README.md) was included; the second file (likely a license or similar) was omitted, but its absence does not affect classification as no exploit or scanner code is indicated.
- The analysis is based solely on the supplied text content; no dynamic execution or verification was performed.
- One additional file (total 2 files in artifact) was omitted from the text evidence packet; its metadata indicates it is a non-text file (likely an image or binary) and was not analyzed. Its content could not be reviewed.
- The review is limited to the static content of the provided evidence; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimXur/WordPress-CVE-2026-63030-Analysis
Repository PoCStars: 3Created 2026-07-25WriteupCVE-2026-630302 files
Analysis
Technical assessment
A defensive technical analysis and mitigation guide for CVE-2026-63030, a REST API route confusion vulnerability in WordPress. The document describes the vulnerability's logic flaw, provides passive verification steps using curl, and offers WAF hardening rules. It contains no exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a single README.md file that provides a defensive analysis and mitigation guide for CVE-2026-63030. The document contains no executable code, no concealed payloads, and no instructions for the reviewer to perform harmful actions. It describes passive verification steps and WAF rules, all consistent with defensive research.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file containing a technical analysis, vulnerability description, and mitigation guidance. It does not contain any executable code, exploit scripts, or automated scanning tools. The provided curl command is a manual diagnostic check, not a scanner. The content is a substantive technical writeup.
README.md:1-157Requirements
- Target must be running a vulnerable version of WordPress (6.9.x before 6.9.5 or 7.0.x before 7.0.2) with the REST API batch endpoint exposed.
README.md:39
Observed behavior
- Describes a logical desynchronization flaw in unauthenticated REST API endpoint handlers that allows unauthenticated requests to reach internal handlers.
README.md:39 - Provides a passive verification method using a curl GET request to /wp-json/batch/v1 and interprets the response code to determine vulnerability status.
README.md:99-111 - Recommends remediation steps including updating WordPress core and deploying a WAF rule to block unauthenticated access to /wp-json/batch/v1.
README.md:120-140
Behaviors behind the backdoor verdict
Observables
- Defensive Documentation
- Payload withheldThe entire file is a markdown document with no executable code or hidden payloads. It includes a disclaimer stating the material is for authorized educational and defensive purposes.
README.md:1-157
What the analysis did not establish
- Only one of two text files in the repository (README.md) was included in the evidence packet. The second file (LICENSE) was omitted, but its absence does not affect the classification as it is unlikely to contain PoC code.
- The evidence packet reports complete_artifact_coverage as false, but the selected text coverage is complete for the README.md file.
- One file (unclassified, 1070 bytes) was present in the repository but not included in the evidence packet; its content is unknown.
- Binary files were flagged as metadata-only and not analyzed; no binary files were reported, but the policy leaves a small residual uncertainty.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.