d3kc4rt1
Source-scoped identity with 5 associated PoCs and 5 linked vulnerabilities.
Exploit catalog results
Showing 5 PoCs on this page
GitHubd3kc4rt1/CVE-2025-14893
Repository PoCStars: 0Created 2026-04-09WriteupCVE-2025-148931 file
Analysis
Technical assessment
The artifact is a technical writeup describing a stored XSS vulnerability (CVE-2025-14893) in the IndieWeb WordPress plugin. It includes a root cause analysis, a vulnerable code snippet, and manual exploitation steps, but contains no executable exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a single README.md file that documents a known Stored XSS vulnerability (CVE-2025-14893) in the IndieWeb WordPress plugin. It contains a description, root cause analysis, a proof-of-concept payload, and remediation advice. No concealed executable behavior, backdoor, or deceptive payload targeting the person running the PoC is present.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file that provides a technical analysis, root cause explanation, and manual exploitation steps for CVE-2025-14893. It does not contain any executable code, scripts, or automated tools that would classify it as an exploit or scanner. It is a substantive technical writeup.
README.md:1-79Requirements
- WordPress installed with IndieWeb <= 4.0.5 activated.
README.md:36 - An attacker account with the Author role.
README.md:37 - The 'Author Profile H-Card Widget' added to a visible frontend area.
README.md:38
Observed behavior
- Describes injecting a crafted payload into the Telephone profile field to break out of an href attribute and inject an onclick event handler.
README.md:44-47 - Describes that the injected script executes when an Administrator visits a post page and clicks the manipulated link.
README.md:50
Behaviors behind the backdoor verdict
Observables
- Vulnerability Documentation
- Payload withheldThe README describes a legitimate vulnerability with a standard PoC payload that exploits the target plugin, not the reviewer.
README.md:1-79
What the analysis did not establish
- The evidence packet contains only a single README.md file; no other source code, scripts, or configuration files from the repository are included.
- The analysis_scope reports complete_artifact_coverage as false, indicating that not all files from the repository snapshot are present in the evidence.
- Only the README.md file was provided; no other repository files were inspected.
- Binary files were flagged as metadata-only and not analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubd3kc4rt1/CVE-2026-3516
Repository PoCStars: 0Created 2026-04-09WriteupCVE-2026-35161 file
Analysis
Technical assessment
A technical writeup describing a stored XSS vulnerability (CVE-2026-3516) in the Contact List WordPress plugin. It explains the root cause, provides exploitation steps and an example HTTP request, but contains no executable exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The repository contains only a single README.md file that documents a known Stored XSS vulnerability (CVE-2026-3516) in the Contact List WordPress plugin. The text describes the vulnerability, its root cause, exploitation steps, and remediation. No executable code, obfuscated payloads, or concealed backdoor behavior is present. The PoC steps describe standard XSS exploitation using an onload event handler, which is consistent with the disclosed vulnerability and does not indicate hidden malicious functionality targeting the person running the PoC.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file containing a vulnerability description, root cause analysis, and manual exploitation steps. It does not include any executable code, script, or automated tool. The analysis_routing classification is NO_POC_CODE_IDENTIFIED, and the content is purely a technical writeup.
README.md:1-72Requirements
- WordPress with Contact List (<= 3.0.17) installed
README.md:35 - A published page containing the [contact_list] shortcode
README.md:36 - Attacker logged in with an Author account
README.md:37
Observed behavior
- Describes how to inject a malicious iframe via the _cl_map_iframe parameter in a POST request to store an XSS payload
README.md:44-46 - Explains that visiting the public directory page triggers the stored XSS payload
README.md:47
Behaviors behind the backdoor verdict
Observables
- Vulnerability Description
- Payload withheldThe README documents a legitimate vulnerability with a standard XSS payload; no backdoor or deceptive payload is included.
README.md:1-72
What the analysis did not establish
- Only one file (README.md) is provided; no source code or exploit scripts are included.
- The artifact is a static description; no dynamic behavior can be observed.
- Only the README.md file was reviewed; no other files exist in the repository snapshot. The analysis is limited to the supplied text content and does not verify the actual plugin code or the described vulnerability.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubd3kc4rt1/CVE-2026-1657
Repository PoCStars: 0Created 2026-04-09WriteupCVE-2026-16571 file
Analysis
Technical assessment
A technical writeup describing an unauthenticated arbitrary file upload vulnerability (CVE-2026-1657) in the EventPrime WordPress plugin. It details the root cause, provides a curl command as a proof-of-concept example, and discusses remediation.
Backdoor review
No backdoor observed in reviewed code
The artifact is a single README.md file documenting CVE-2026-1657. It contains no executable code, no concealed payload, and no instructions for the reader to perform harmful actions. The described PoC is a standard curl command demonstrating the reported vulnerability.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file containing a detailed technical analysis of CVE-2026-1657. It includes a curl command as a PoC example, but the primary content is explanatory text describing the vulnerability, its root cause, impact, and remediation. It does not contain executable exploit or scanner code.
README.md:1-77Requirements
- Target running a vulnerable version of the EventPrime plugin (<= 4.2.8.1)
README.md:6
Observed behavior
- Describes the vulnerability's root cause: insecure AJAX endpoint registration, missing authorization/nonce checks, and flawed file validation.
README.md:17-30 - Provides a curl command as a proof-of-concept example to upload a file to the vulnerable endpoint.
README.md:46-49 - Discusses business impact including storage exhaustion, media library spam, and potential for further exploitation.
README.md:32-35
Behaviors behind the backdoor verdict
Observables
- Documentation Only
- Payload withheldNo executable behavior can be present; the artifact is purely informational.
README.md:1-77 - Curl Command
- Payload withheldThe PoC command uploads a file to a target WordPress site to demonstrate the vulnerability. It does not instruct the reader to download or execute anything locally.
README.md:46-49
What the analysis did not establish
- Evidence consists of a single README.md file; no executable source code is present.
- The curl command is provided as an illustrative example within the writeup, not as a standalone functional script.
- Only one file (README.md) was supplied; no other repository files were inspected.
- Binary files were flagged as metadata-only and not analyzed, though none were identified in this packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubd3kc4rt1/CVE-2026-1375
Repository PoCStars: 0Created 2026-04-09WriteupCVE-2026-13751 file
Analysis
Technical assessment
A technical writeup describing an IDOR vulnerability (payload withheld) in the Tutor LMS WordPress plugin. It details the root cause, affected functions, and manual exploitation steps, but contains no executable exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The artifact is a single README.md file documenting payload withheld, an IDOR vulnerability in the Tutor LMS WordPress plugin. It contains no executable code, no obfuscated payloads, no instructions to run software, and no concealed behavior. The content is a standard vulnerability disclosure with manual exploitation steps that describe normal exploit behavior against the stated target.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file containing a vulnerability summary, root cause analysis, and manual exploitation steps. It does not include any executable code, scripts, or automated checks; it is purely a technical description, making it a writeup.
README.md:1-67Requirements
- Authenticated as a Tutor Instructor on a WordPress site with the vulnerable Tutor LMS plugin (<= 3.9.5).
README.md:7 - Knowledge of a target course ID belonging to another instructor.
README.md:49
Observed behavior
- Describes intercepting a bulk action request and modifying the 'id' and 'status' parameters to affect a course not owned by the attacker.
README.md:50-55 - States the server responds with success and the victim's course is moved to trash.
README.md:56
Behaviors behind the backdoor verdict
Observables
- Vulnerability Disclosure
- Payload withheldThe README documents an IDOR vulnerability in Tutor LMS plugin, including manual PoC steps.
README.md:1-67
What the analysis did not establish
- The evidence consists of a single README.md file; no source code, exploit scripts, or scanner code is present.
- The manual exploitation steps describe a process but do not constitute executable code.
- Only the README.md file was provided; no other repository files were inspected. The analysis scope confirms complete coverage of the selected text but no other files were available.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubd3kc4rt1/CVE-2025-15260
Repository PoCStars: 0Created 2026-04-09WriteupCVE-2025-152601 file
Analysis
Technical assessment
A technical writeup detailing a missing authorization vulnerability (CVE-2025-15260) in the MyRewards WordPress plugin. It explains the root cause, provides a conceptual proof-of-concept with a curl command, and describes the impact, but does not include executable exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a single README.md file that documents a known CVE (CVE-2025-15260) in the MyRewards WordPress plugin. It describes a missing authorization vulnerability, provides a technical explanation, and includes a proof-of-concept (PoC) curl command that exploits the vulnerability by sending a crafted AJAX request to modify loyalty point multipliers. The PoC targets the vulnerable plugin's own admin-ajax.php endpoint and performs the exact unauthorized action described in the CVE. No concealed executable behavior, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the documented exploit is present. The artifact is purely informational and contains no executable code.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file that provides a technical analysis of CVE-2025-15260, including a root cause analysis, a conceptual proof-of-concept with a curl command, and remediation steps. It does not contain a standalone, executable script designed to automatically exploit or scan for the vulnerability; the curl command is illustrative within the writeup. Therefore, it is classified as a writeup.
README.md:1-103Requirements
- Target running WooCommerce with MyRewards v5.6.0.
README.md:52 - Valid credentials for a subscriber level account.
README.md:53 - A pre-configured reward system with an enumerable rule ID.
README.md:54
Observed behavior
- The writeup describes how an authenticated subscriber can send a crafted POST request to the admin-ajax.php endpoint to modify loyalty point multipliers.
README.md:77-80 - The server is expected to return a JSON status confirming the update.
README.md:84
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldThe PoC curl command targets the WordPress admin-ajax.php endpoint of the vulnerable plugin, which is the expected target for the described missing authorization exploit.
README.md:77 - Base64 Encoded Payload
- Payload withheldThe base64-encoded payload decodes to JSON that modifies a loyalty rule multiplier, consistent with the documented vulnerability. It is used in the PoC to demonstrate the exploit.
README.md:70
What the analysis did not establish
- The evidence consists of a single README.md file; no executable source code files (e.g., .py, .sh) were provided.
- The curl command is presented as an illustrative example within the writeup and is not a functional, self-contained exploit or scanner script.
- Only the README.md file was provided; no other repository files were inspected. The analysis scope confirms no executable source code was identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.