Boreas37
Source-scoped identity with 8 associated PoCs and 8 linked vulnerabilities.
Exploit catalog results
Showing 8 PoCs on this page
GitHubBoreas37/CVE-2026-41452-PoC
Repository PoCStars: 1Created 2026-08-12ExploitCVE-2026-414522 files
Analysis
Technical assessment
Python script that exploits CVE-2026-41452 in Krayin CRM by sending an AJAX POST request to bypass installer middleware and overwrite the primary admin account, then logs in to confirm takeover.
Backdoor review
No backdoor observed in reviewed code
The PoC consists of a README and a Python script that demonstrate the CVE-2026-41452 authentication bypass. The script sends HTTP requests to overwrite the admin account and then logs in to confirm access. No backdoor, deceptive payload, or concealed harmful behavior is present. The code performs only the advertised exploit steps against the target CRM instance.
Classification basis and observed behavior
Classification basis
The Python script actively sends crafted HTTP requests to overwrite the admin account and then authenticates to confirm access, which constitutes exploitation rather than mere detection or scanning.
poc_cve-2026-41452.py:71-81poc_cve-2026-41452.py:84-103poc_cve-2026-41452.py:106-116Requirements
- Target Krayin CRM instance (≤2.2.0 or 2.2.4) with installer endpoint accessible
poc_cve-2026-41452.py:4
Observed behavior
- Sends a non-AJAX POST to /install/api/admin-config-setup to confirm the middleware blocks normal requests
poc_cve-2026-41452.py:57-68 - Sends an AJAX POST with X-Requested-With: XMLHttpRequest header to bypass CanInstall middleware and overwrite admin user (id=1) with attacker-supplied credentials
poc_cve-2026-41452.py:71-81 - Extracts CSRF token from /admin/login page and logs in with the overwritten credentials
poc_cve-2026-41452.py:84-103 - Accesses /admin/dashboard to confirm successful admin takeover
poc_cve-2026-41452.py:106-116
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented CVE exploit behavior; it targets the vulnerable CRM, not the PoC operator.
poc_cve-2026-41452.py:71-77 - Exploit Behavior
- Payload withheldStandard proof-of-exploit verification; no unrelated actions.
poc_cve-2026-41452.py:84-116
What the analysis did not establish
- Only the two text files (README.md and poc_cve-2026-41452.py) were reviewed; no binary files were present or analyzed.
- The review does not assess whether the exploit works as claimed, only whether the supplied evidence contains backdoor or deceptive behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBoreas37/CVE-2026-73034-PoC
Repository PoCStars: 1Created 2026-08-12ExploitCVE-2026-730343 files
Analysis
Technical assessment
A bash script that exploits CVE-2026-73034, an unauthenticated path traversal vulnerability in DB-GPT v0.8.1, by sending crafted HTTP requests with directory traversal sequences in the 'user-id' header to write arbitrary files to the server.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a bash PoC script for CVE-2026-73034. Both files describe and demonstrate the path traversal vulnerability in DB-GPT v0.8.1. The script sends crafted HTTP requests to a target server to write files outside the intended directory, and then verifies the file placement via docker exec. No concealed executable behavior, persistence, credential theft, or unrelated payload delivery is present. The script's actions are consistent with a legitimate proof-of-concept for the stated CVE.
Classification basis and observed behavior
Classification basis
The script actively sends crafted HTTP requests to a vulnerable endpoint to write files to arbitrary locations on the server, which is the definition of an exploit. It includes verification steps to confirm successful exploitation.
poc_cve-2026-73034.sh:48-50poc_cve-2026-73034.sh:55-57poc_cve-2026-73034.sh:63-68Requirements
- A running, vulnerable instance of DB-GPT v0.8.1 or earlier.
poc_cve-2026-73034.sh:6 - Network access to the target's /api/v1/python/file/upload endpoint.
poc_cve-2026-73034.sh:35 - Docker must be installed and accessible for the verification steps.
poc_cve-2026-73034.sh:63-65
Observed behavior
- Sends a normal upload request with a safe 'user-id' header as a control test.
poc_cve-2026-73034.sh:42-44 - Sends an exploit request with a 'user-id' header containing directory traversal sequences to write a file to /tmp/pwned/.
poc_cve-2026-73034.sh:48-50 - Sends a second exploit request to write a file to /root/.
poc_cve-2026-73034.sh:55-57 - Verifies the exploit by executing commands inside the target Docker container to list and read the written files.
poc_cve-2026-73034.sh:63-68 - Tests a fixed build of the application to confirm the vulnerability is patched and the exploit is blocked.
poc_cve-2026-73034.sh:72-76
Behaviors behind the backdoor verdict
Observables
- Vulnerability Exploit
- Payload withheldThe PoC demonstrates the core vulnerability described in CVE-2026-73034 by injecting directory traversal sequences into the user-id header to write files to arbitrary locations.
poc_cve-2026-73034.sh:48-50poc_cve-2026-73034.sh:55-57 - Verification Command
- Payload withheldThe script uses docker exec to verify that the uploaded files were written to the traversal target directories, which is standard for a PoC that validates the exploit.
poc_cve-2026-73034.sh:62-68
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating one file (likely a license or similar) was omitted from the text content, but the two provided files (README.md and poc_cve-2026-73034.sh) are complete and sufficient for classification.
- One file (unclassified, 2411 bytes) was omitted from text analysis per binary policy; its metadata was flagged but not inspected. No evidence suggests it contains harmful content, but it was not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBoreas37/CVE-2026-33267-PoC
Repository PoCStars: 1Created 2026-08-12ScannerCVE-2026-332672 files
Analysis
Technical assessment
The artifact contains a Python script that sends a raw HTTP request with '@'-prefixed headers to a target Apache Traffic Server and prints the response. It is designed to verify whether the server is vulnerable to CVE-2026-33267 by checking if the headers are leaked to plugins or stripped. It does not exploit the vulnerability to achieve any impact beyond detection.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README and a Python PoC script for CVE-2026-33267. The script sends a raw HTTP request with '@'-prefixed headers to demonstrate the vulnerability. No backdoor, deceptive payload, or concealed harmful behavior is present. The code performs only the advertised network test and prints the response.
Classification basis and observed behavior
Classification basis
The Python script sends a crafted request to trigger the vulnerability but only observes the response; it does not perform any action that exploits the metadata spoofing to achieve unauthorized access, data modification, or other impact. The README explicitly states the script 'demonstrates and verifies the primitive (leak vs. strip)' and that the practical RCE chain depends on target plugins, which this code does not implement.
README.md:47-51at_headers_spoof.py:2-19Requirements
- Target must be running a vulnerable version of Apache Traffic Server (9.2.0-9.2.14 or 10.1.0-10.1.3) with a plugin that logs or acts on '@' headers.
README.md:9-10
Observed behavior
- Sends a raw HTTP GET request containing '@Ats-Internal: pwned' and '@Another-At: test' headers to a specified host and port.
at_headers_spoof.py:50-57 - Receives and prints the first 400 bytes of the HTTP response.
at_headers_spoof.py:63-75
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe PoC connects to a target specified by the user to send a crafted HTTP request, which is the expected behavior for a vulnerability demonstration.
at_headers_spoof.py:59-61 - Http Request
- Payload withheldThe script constructs and sends an HTTP request containing the spoofed internal headers to trigger the vulnerability.
at_headers_spoof.py:50-57
What the analysis did not establish
- The analysis is based solely on the provided source code and documentation; the code was not executed, and its effectiveness or safety is not verified.
- The artifact relies on an external custom plugin ('at_probe') for full verification, which is not included in the provided files.
- Only the two text files (README.md and at_headers_spoof.py) were reviewed; no other files exist in the repository.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBoreas37/CVE-2026-17544-PoC
Repository PoCStars: 1Created 2026-08-12ScannerCVE-2026-175442 files
Analysis
Technical assessment
A PHP script that calls bccomp() with crafted arguments to trigger CVE-2026-17544. It reports whether the PHP build is vulnerable (stack smashing detected) or patched (returns int(1)). The code does not attempt to gain code execution or perform any post-crash exploitation; it only validates the presence of the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README and a PHP trigger script for CVE-2026-17544. The trigger script constructs a crafted input and calls bccomp() to demonstrate the vulnerability. No backdoor, deceptive payload, or concealed harmful behavior is present. The code is a straightforward proof-of-concept exploit trigger.
Classification basis and observed behavior
Classification basis
The artifact's primary operation is to detect the vulnerability by triggering a crash and reporting the outcome. It does not contain any payload, shellcode, or logic to exploit the out-of-bounds write for code execution or privilege escalation. The README explicitly states RCE is 'not demonstrated' and the script only prints whether the build is patched or crashes.
trigger.php:31-36README.md:60-64Requirements
- PHP 8.4.* < 8.4.24 or 8.5.* < 8.5.9 with bcmath extension enabled
README.md:13-14 - Ability to execute PHP code that calls bccomp() with attacker-controlled operands and scale
trigger.php:31-34
Observed behavior
- Constructs a crafted string '1.9' followed by 300 zeros and a '1', then calls bccomp() with scale 300
trigger.php:31-34 - On vulnerable builds, the process crashes with 'stack smashing detected' and exits with code 133 (SIGABRT)
README.md:38-39 - On patched builds, bccomp() returns int(1) and the script prints 'NO CRASH (patched)'
trigger.php:35-36
Behaviors behind the backdoor verdict
Observables
- Exploit Trigger
- Payload withheldThe trigger.php script constructs a specific input to trigger the out-of-bounds write in bccomp(). This is the documented PoC for CVE-2026-17544.
trigger.php:31-34 - Vulnerability Description
- Payload withheldThe README explains the root cause, affected versions, and provides a trigger. This matches the CVE context and the trigger script.
README.md:1-70
What the analysis did not establish
- Evidence is limited to two text files; no binary or compiled artifacts are present.
- The analysis treats the code as untrusted data and does not execute it; classification is based solely on static review of the supplied source.
- Only the two text files (README.md and trigger.php) were reviewed. No binary files were present or analyzed.
- The review is limited to the supplied evidence and does not assess the safety of executing the PoC in a vulnerable environment.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBoreas37/CVE-2026-64824-PoC
Repository PoCStars: 1Created 2026-08-10ExploitCVE-2026-648244 files
Analysis
Technical assessment
A Python script that injects a symlink path traversal payload into a legitimate Home Assistant backup archive and then uploads it to a target instance via the API, achieving remote code execution as root.
Backdoor review
No backdoor observed in reviewed code
The PoC demonstrates the described CVE-2026-64824 path traversal vulnerability. The Python script builds a malicious backup archive containing a symlink and a payload file, and optionally uploads it to a Home Assistant instance. The payload (lines 60-64) writes 'id' output to /tmp/HA_PWNED_64824, which is consistent with the stated proof-of-concept goal. No concealed, unrelated, or operator-directed harmful behavior (e.g., credential theft, persistence, unrelated remote access) was observed in the supplied text.
Classification basis and observed behavior
Classification basis
The artifact is a Python script that actively constructs a malicious backup archive and uploads it to a vulnerable server to achieve remote code execution. The code includes functions to inject a symlink and payload into a backup (inject_backup), upload it via the API (api, multipart), and provides instructions for triggering the restore. This constitutes an exploit as it is code intended to exercise the vulnerability.
CVE-2026-64824.py:67-110CVE-2026-64824.py:160-180Requirements
- A valid Home Assistant backup archive (.tar) to inject the payload into.
CVE-2026-64824.py:46 - A long-lived access token (LLAT) for an authenticated admin user on the target Home Assistant instance.
CVE-2026-64824.py:45-46 - Network access to the target Home Assistant instance's API.
CVE-2026-64824.py:46
Observed behavior
- Reads a legitimate Home Assistant backup archive and identifies the inner 'homeassistant.tar.gz' file.
CVE-2026-64824.py:70-75 - Creates a new inner archive containing a symlink entry ('data/evil_link') pointing to an absolute path (e.g., Python's site-packages) and a regular file entry ('data/evil_link/sitecustomize.py') containing a Python payload.
CVE-2026-64824.py:85-95 - Repackages the modified inner archive into a new outer backup archive.
CVE-2026-64824.py:99-109 - Uploads the crafted backup archive to the target Home Assistant instance via a multipart POST request to '/api/backup/upload'.
CVE-2026-64824.py:161-163 - Instructs the user to trigger a restore via the Home Assistant websocket API using the returned backup_id, which will write the payload to the filesystem.
CVE-2026-64824.py:179-180
Behaviors behind the backdoor verdict
Observables
- Payload
- Payload withheldThe payload executed upon successful exploitation writes the output of 'id' to a fixed file, demonstrating root execution. This is the advertised PoC behavior.
CVE-2026-64824.py:60-64 - Network Activity
- Payload withheldThe script uploads the crafted backup to the target Home Assistant instance using the documented API endpoint, consistent with the exploit chain.
CVE-2026-64824.py:161-163 - File Creation
- Payload withheldThe script creates a malicious backup archive containing the symlink and payload, as described in the exploit documentation.
CVE-2026-64824.py:99-110
What the analysis did not establish
- The restore step is not fully automated in the provided code; the script prints instructions for the user to trigger it manually via websocket.
- The evidence does not include the execution output or verification of the exploit's success, only the code and a writeup claiming verification.
- Two files (likely a sample backup archive and a LICENSE file) were present in the repository but not included as text in the evidence packet; their content was not reviewed.
- The websocket restore function is not implemented (raises NotImplementedError), so the full automated exploit chain is not present in the reviewed code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBoreas37/CVE-2026-69084-PoC
Repository PoCStars: 1Created 2026-08-09ExploitCVE-2026-690843 files
Analysis
Technical assessment
Python script that exploits CVE-2026-69084 by sending arbitrary SQL statements to the /api/search/searchEmbedBlock endpoint of SiYuan. It includes a --proof mode that creates a table and inserts a row to demonstrate write access, and a --check mode for non-destructive probing.
Backdoor review
No backdoor observed in reviewed code
The PoC script and README demonstrate the documented CVE-2026-69084 SQL injection exploit against SiYuan. The Python code performs only the described actions: session login, sending attacker-supplied SQL to the vulnerable endpoint, and displaying results. No hidden, deceptive, or unrelated behavior is present.
Classification basis and observed behavior
Classification basis
The script is designed to exercise the vulnerability by sending arbitrary SQL statements to the vulnerable endpoint, including destructive write operations (CREATE TABLE, INSERT) in --proof mode. This constitutes exploit code.
CVE-2026-69084.py:85-109CVE-2026-69084.py:118-127Requirements
- Target SiYuan instance <= v3.7.2 with the /api/search/searchEmbedBlock endpoint reachable.
CVE-2026-69084.py:6 - If publish authentication is enabled, a valid auth code is required; otherwise, the endpoint is accessible anonymously.
CVE-2026-69084.py:14-16
Observed behavior
- Performs a session login via /api/system/loginAuth if an auth code is provided.
CVE-2026-69084.py:74-82 - Sends a POST request to /api/search/searchEmbedBlock with a client-supplied SQL statement in the 'stmt' parameter.
CVE-2026-69084.py:85-95 - In --proof mode, executes CREATE TABLE and INSERT statements to write to the database.
CVE-2026-69084.py:118-127 - In --check mode, executes a non-destructive SELECT sqlite_version() query.
CVE-2026-69084.py:112-115
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldTarget host used in usage examples and verification output; standard for local testing.
CVE-2026-69084.py:31README.md:52 - Sql Statement
- Payload withheldProof-of-concept SQL payload that creates a table to demonstrate write capability; matches the documented exploit.
CVE-2026-69084.py:121 - Sql Statement
- Payload withheldProof-of-concept SQL payload that inserts a row to demonstrate write capability; matches the documented exploit.
CVE-2026-69084.py:122
What the analysis did not establish
- One file (LICENSE) was omitted from the evidence; it is unlikely to affect classification.
- The evidence does not include the execution output or verification that the script successfully exploited a live target.
- One file (LICENSE, 1036 bytes) was classified as binary and not analyzed for text content; it is a standard license file and unlikely to contain executable behavior.
- The review is limited to the supplied text evidence; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBoreas37/CVE-2026-34910-PoC
Repository PoCStars: 3Created 2026-08-09ExploitCVE-2026-349104 files
Analysis
Technical assessment
Python script that exploits CVE-2026-34910 (command injection) and CVE-2026-34909 (path traversal) in UniFi OS. It sends crafted HTTP requests to achieve unauthenticated remote code execution and arbitrary file read.
Backdoor review
No backdoor observed in reviewed code
The PoC script CVE-2026-34910.py and its README.md describe and implement an exploit for CVE-2026-34910 (command injection) and CVE-2026-34909 (path traversal) against UniFi OS. The Python code sends crafted HTTP requests to a user-supplied target to trigger the vulnerabilities. No backdoor, concealed payload, or operator-directed harm beyond the stated exploit behavior was observed. The script does not exfiltrate data, establish persistence, or contact unrelated hosts.
Classification basis and observed behavior
Classification basis
The Python script contains functions (exploit_rce, exploit_write_proof, exploit_read) that construct and send malicious HTTP requests to execute arbitrary commands and read files on a vulnerable target, which is the definition of an exploit.
CVE-2026-34910.py:86-105CVE-2026-34910.py:108-113CVE-2026-34910.py:116-128Requirements
- Target must be a vulnerable UniFi OS Server instance (pre-SAB-064).
CVE-2026-34910.py:6 - Network access to the target's HTTPS port (e.g., 8443 or 11443).
CVE-2026-34910.py:35-36
Observed behavior
- Sends an HTTP GET request with a URL-encoded path traversal to bypass authentication and reach an internal API endpoint.
CVE-2026-34910.py:46-47CVE-2026-34910.py:75 - Injects a semicolon-delimited command into the 'pkg_name' parameter to execute arbitrary shell commands on the target.
CVE-2026-34910.py:94-95 - Reads arbitrary files from the target's filesystem by exploiting a path traversal in the '/app-assets/' alias.
CVE-2026-34910.py:119-120 - Provides a non-destructive check mode to probe for the authentication bypass vulnerability.
CVE-2026-34910.py:73-83
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe script's sole purpose is to demonstrate the vulnerabilities; it does not perform any hidden actions.
CVE-2026-34910.py:54-70CVE-2026-34910.py:86-105CVE-2026-34910.py:116-128 - User Agent
- Payload withheldThe script identifies itself with a custom User-Agent header, which is typical for PoC scripts and does not indicate malicious intent.
CVE-2026-34910.py:59 - Ssl Configuration
- Payload withheldThis is a common practice in PoC scripts to simplify connections to targets with self-signed certificates; it does not constitute a backdoor.
CVE-2026-34910.py:49-51
What the analysis did not establish
- Evidence includes only two of four repository files; two files (likely binary or non-text) are omitted.
- The artifact's complete_artifact_coverage is false, meaning not all files in the repository are represented in the evidence.
- Two files (total 4 files in repository) were omitted from the text evidence and not analyzed; their content is unknown.
- Binary content was not analyzed per the evidence envelope policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBoreas37/CVE-2026-64638-PoC-XSS2Shell-
Repository PoCStars: 30Created 2026-08-07ScannerCVE-2026-646384 files
Analysis
Technical assessment
The artifact is a Nuclei template that detects the CVE-2026-64638 reflected XSS vulnerability in WordPress by sending a crafted POST request to wp-login.php and checking for reflected parser-differential payloads in the response. It does not exploit the vulnerability or execute the XSS-to-RCE chain.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README.md and a nuclei-CVE-2026-64638.yaml template. The README describes a legitimate proof-of-concept (PoC) for CVE-2026-64638, a reflected XSS vulnerability in WordPress. It outlines a five-stage attack chain, provides usage instructions for defensive auditing and exploitation, and includes references to public disclosures. The Nuclei template is a standard detection template that sends a POST request to wp-login.php and matches the reflected payload in the response. No concealed executable behavior, backdoor, credential theft, persistence mechanisms, or unrelated payloads are present in the reviewed text. The evidence is consistent with a security research PoC intended for authorized testing.
Classification basis and observed behavior
Classification basis
The primary artifact is a Nuclei template (nuclei-CVE-2026-64638.yaml) that sends a single HTTP request and uses matchers to detect the presence of the vulnerability. It does not contain code to exploit the XSS, escalate to RCE, or interact with a victim's browser. The README describes an exploit chain but the supplied code is limited to detection logic.
nuclei-CVE-2026-64638.yaml:1-66README.md:1-120Requirements
- Target must be running a vulnerable version of WordPress (< 7.0.3) with wp-login.php accessible.
nuclei-CVE-2026-64638.yaml:1-66
Observed behavior
- Sends a POST request to /wp-login.php with a crafted username containing a parser-differential payload (e.g., '< area id=ajaxurl href=/?rest_route=/>').
nuclei-CVE-2026-64638.yaml:40-44 - Checks the response body for the presence of 'id="ajaxurl"', '<area', and 'Error:' to confirm the payload was reflected and parsed into a DOM element.
nuclei-CVE-2026-64638.yaml:55-61 - Checks the response header for 'text/html' content type.
nuclei-CVE-2026-64638.yaml:63-66
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldPublic disclosure blog post referenced in the README.
README.md:18 - Url
- Payload withheldNews coverage referenced in the README.
README.md:91 - Url
- Payload withheldNHS cyber alert referenced in the README.
README.md:92 - Url
- Payload withheldSocRadar coverage referenced in the README.
README.md:93 - Url
- Payload withheldNVD reference in the Nuclei template.
nuclei-CVE-2026-64638.yaml:26 - Command
- Payload withheldExample command for a non-destructive check.
README.md:45 - Command
- Payload withheldExample command for a defensive audit.
README.md:48 - Command
- Payload withheldExample command to generate the XSS trigger HTML.
README.md:54 - Command
- Payload withheldExample command for the RCE stage requiring an admin application password.
README.md:57 - Command
- Payload withheldExample command to emit the plugin zip without uploading.
README.md:60 - Command
- Payload withheldExample command to scan a single target with the Nuclei template.
README.md:101 - Command
- Payload withheldExample command to scan a list of targets with the Nuclei template.
README.md:104
What the analysis did not establish
- The evidence packet includes only two of four repository files; the Python script xss2shell.py and LICENSE file are omitted. The README describes exploit functionality in xss2shell.py, but the script itself is not provided for analysis.
- The analysis is based solely on static review of the provided text; no code was executed.
- The evidence includes only the README.md and nuclei-CVE-2026-64638.yaml files. The Python script xss2shell.py, LICENSE file, and any other files in the repository are not provided and were not reviewed. The analysis is based solely on the documentation and the detection template.
- Two files (LICENSE and xss2shell.py) are reported in the inventory but their content is not included in the evidence packet. The behavior of xss2shell.py cannot be confirmed from the provided text alone.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.