shinthink

Classification basis

The primary artifact is a Python script that actively uploads a malicious PHP file to a target server and executes arbitrary commands, which is the definition of an exploit. The README describes it as a PoC and provides usage examples for exploitation, including single-target and mass-scan modes.

Requirements

• Target must be running CodeIgniter 4 < 4.7.4 with a file upload endpoint that uses is_image or mime_in validation without ext_in.cve_2026_63223.py:6-12
• Uploaded files must be stored in a web-accessible directory where PHP files can execute.README.md:15-17

Observed behavior

• Detects CodeIgniter 4 by checking HTTP response headers and body for PHP and framework indicators.cve_2026_63223.py:182-235
• Builds a PHP webshell payload prepended with image magic bytes (GIF, JPEG, or PNG) and a unique verification token.cve_2026_63223.py:98-126
• Uploads the payload via multipart POST to the target endpoint, then attempts to locate the uploaded file URL from the response or by guessing common paths.cve_2026_63223.py:241-326
• Verifies PHP execution by checking for the unique token in the response, then executes a supplied system command via the webshell.cve_2026_63223.py:287-324
• Supports mass scanning of multiple targets with configurable threads and output logging.cve_2026_63223.py:431-524

Observables

Exploit Mechanism

Payload withheldThe script builds a PHP payload that includes a system command execution backdoor, which is the core of the CVE-2026-63223 exploit.cve_2026_63223.py:104-110

Network Behavior

Payload withheldThe script sends the crafted payload to a user-specified target and then accesses it to run commands. This is the intended exploit flow, not a backdoor against the operator.cve_2026_63223.py:241-326

Dependency

Payload withheldStandard HTTP libraries with no suspicious or uncommon packages.requirements.txt:1-2

Classification basis

The primary artifact is a Python script that actively exploits CVE-2026-66066 by uploading a malicious file to read arbitrary server files and then executing arbitrary commands on the target. This is code intended to exercise a vulnerability, not merely detect it.

Requirements

• Target must be a Rails application with Active Storage using the default libvips variant processor and accepting unauthenticated direct uploads.README.md:15-16cve_2026_66066.py:7-10
• A variation key must be harvestable from the target application (e.g., from an existing thumbnail).cve_2026_66066.py:509-518

Observed behavior

• Detects Rails and Active Storage by checking for indicators in HTML and probing the direct upload endpoint.cve_2026_66066.py:358-393
• Crafts a dual-identity MATLAB/HDF5 file with an external dataset pointing to an arbitrary server-side file path.cve_2026_66066.py:130-180
• Uploads the crafted payload via the direct upload endpoint, then triggers the file read by requesting a representation URL, and decodes the resulting PNG to recover file bytes.cve_2026_66066.py:433-529cve_2026_66066.py:573-617
• Recovers SECRET_KEY_BASE from /proc/self/environ or /proc/1/environ via the file read primitive.cve_2026_66066.py:619-641
• Derives the Active Storage verifier key, forges a signed variation containing instance_eval with a shell command, and executes it to achieve RCE.cve_2026_66066.py:286-307cve_2026_66066.py:661-704
• Supports mass scanning of multiple targets with concurrent threads.cve_2026_66066.py:781-812

Observables

Exploit Behavior

Payload withheldThe script implements the full CVE-2026-66066 exploit chain as described in the README, including file read from /proc/self/environ and RCE via instance_eval.cve_2026_66066.py:573-617cve_2026_66066.py:661-704

Network Target

Payload withheldAll network requests are directed to the target specified by the user via -t/--target or -f/--file arguments. No hardcoded exfiltration endpoints or callbacks to attacker infrastructure are present.cve_2026_66066.py:916-917cve_2026_66066.py:360-393

Embedded Payload

Payload withheldThe script contains a pre-built HDF5 template used to construct the dual-identity file for the file-read primitive. This is a necessary component of the exploit, not a concealed malicious payload.cve_2026_66066.py:68

Classification basis

The Python script (cve_2026_60004.py) implements a full exploit chain: it registers an account, creates a repo, and sends a malicious patch to achieve remote code execution. The README describes it as a 'Proof of Concept' and the code includes a 'GiteaExploit' class with an 'exploit' method that triggers the vulnerability. This is not merely a scanner or writeup; it actively exploits the vulnerability to execute arbitrary commands.

Requirements

• Target Gitea/Forgejo instance with open registration (default) and version < 1.27.1README.md:19cve_2026_60004.py:19
• Git version >= 2.32 on the target server for three-way merge fallbackREADME.md:67cve_2026_60004.py:13

Observed behavior

• Registers a new user account on the target Gitea/Forgejo instancecve_2026_60004.py:478-524
• Creates a new private repository via the APIcve_2026_60004.py:558-579
• Sends a crafted patch containing a post-index-change hook to the diffpatch API endpoint twice to trigger an add/add conflict and execute the hookcve_2026_60004.py:606-692
• Exfiltrates command output via an HTTP callback to an attacker-controlled servercve_2026_60004.py:285-358
• Supports mass scanning of multiple targets with configurable threadscve_2026_60004.py:827-940

Observables

Exploit Mechanism

Payload withheldThis is the core of the disclosed CVE-2026-60004 vulnerability and is the expected exploit behavior.cve_2026_60004.py:606-692

Payload Generation

Payload withheldThe hook's actions (command execution, file write, callback) are all controlled by the operator's --command and --callback arguments. No hidden commands or hardcoded exfiltration endpoints exist.cve_2026_60004.py:285-358

Callback Listener

Payload withheldThis is a standard feature for capturing output from blind RCE exploits. It only listens and decodes data; it does not execute received data or establish persistence on the operator's machine.cve_2026_60004.py:121-212

Classification basis

The Python script actively exploits the vulnerability by recovering a keystream, building a PHP object injection payload, deploying a webshell, and executing commands on the target. It is not limited to detection or validation; it performs the full attack chain to achieve RCE.

Requirements

• Target must run Aimy Captcha-Less Form Guard 18.0-20.0 on Joomla with a captcha-protected form accessible.cve_2026_65883.py:255-266
• Attacker must be able to send HTTP requests to the target and receive responses containing the clfgd hidden field and form HTML.cve_2026_65883.py:279-286

Observed behavior

• Sends GET request to Joomla form paths to detect Aimy plugin by searching for 'clfgd' in response.cve_2026_65883.py:255-266
• Extracts base64-encoded clfgd ciphertext and plaintext trap_ids from HTML to recover XOR keystream.cve_2026_65883.py:110-157
• Constructs a PHP serialized object chain (FormattedtextLogger gadget) that writes a PHP webshell to the webroot.cve_2026_65883.py:70-103
• Encrypts the gadget with the recovered keystream and sends it as the clfgd POST parameter to trigger unserialize() and deploy the webshell.cve_2026_65883.py:296-331
• Verifies RCE by requesting the deployed webshell with a command parameter and checking for command output.cve_2026_65883.py:349-361
• Supports mass scanning mode that exploits multiple targets concurrently and reports RCE URLs.cve_2026_65883.py:401-483

Observables

Webshell Deployment

Payload withheldThis is the intended exploit payload for CVE-2026-65883, not a backdoor against the user running the PoC.cve_2026_65883.py:76-79

Rce Verification

Payload withheldThis is standard exploit verification, not a backdoor.cve_2026_65883.py:349-361

Classification basis

The primary artifact is a Python script that actively uploads a malicious webshell to a target and executes arbitrary commands, which constitutes exploitation rather than mere detection or scanning.

Requirements

• Target must run a vulnerable version of DJ-Classifieds (<= 3.11.1) with the imageupload task exposed.cve_2026_61424.py:3-4

Observed behavior

• Detects DJ-Classifieds by requesting known XML manifest paths and parsing the version tag.cve_2026_61424.py:204-226
• Generates a PHP webshell payload using only short open tags (<?=) to bypass a 3-string blocklist filter.cve_2026_61424.py:72-83
• Embeds the webshell inside a valid GIF header to create a polyglot file that passes image validation.cve_2026_61424.py:86-108
• Uploads the polyglot shell via an unauthenticated POST to the imageupload task endpoint.cve_2026_61424.py:232-320
• Verifies remote code execution by sending commands (id;hostname;uname -a) to the uploaded shell and checking for expected output markers.cve_2026_61424.py:326-363
• Supports mass exploitation mode with multi-threading, progress display, and optional output of successful RCE URLs.cve_2026_61424.py:426-513

Observables

Exploit Behavior

Payload withheldThis is the advertised exploit for CVE-2026-61424. The webshell uses PHP short tags to bypass a 3-string filter.cve_2026_61424.py:72-83cve_2026_61424.py:232-320cve_2026_61424.py:326-363

Cleanup Mechanism

Payload withheldThe cleanup() method sends a command to the shell to remove itself, which is consistent with a responsible PoC and not a backdoor.cve_2026_61424.py:369-379

Classification basis

The Python script actively exploits the vulnerability by uploading a PHP webshell and executing commands, which is the definition of an exploit. It does not merely check for the vulnerability.

Requirements

• Target must be running a vulnerable version of RSFiles! (< 1.17.12) with the default downloads folder accessible.cve_2026_57827.py:6

Observed behavior

• Detects the RSFiles! component and its version by requesting known paths.cve_2026_57827.py:163-205
• Uploads a PHP webshell by sending a POST request directly to the 'rsfiles.upload' task, bypassing the pre-flight check.cve_2026_57827.py:207-284
• Executes commands on the target via the uploaded webshell and optionally cleans up the shell file.cve_2026_57827.py:286-314

Observables

Php Webshell

Payload withheldThis is the payload uploaded to the target server to achieve RCE, as described in the README and implemented in the script.cve_2026_57827.py:72-92

Exploit Endpoint

Payload withheldThe vulnerable endpoint on the target Joomla server where the PHP shell is uploaded.cve_2026_57827.py:107

Command Execution

Payload withheldThe command executed on the target server to verify RCE, as shown in the script and README.cve_2026_57827.py:303

Classification basis

The script's primary function is to generate a detection payload and check if a target is vulnerable, not to achieve remote code execution. The serialized payloads are limited to stdClass objects for probing; the 'gadget' payload is explicitly a placeholder. The README states the script 'can also fingerprint MediaWiki instances and attempt the import via the API', and the code includes a --check flag for fingerprint-only mode. No functional gadget chain is provided, and the script does not execute arbitrary code on the target.

Requirements

• Target must be a MediaWiki instance with Special:Import accessible.exploit.py:178-179
• Attacker must have import or importupload rights (default: sysop group) and valid session cookies.README.md:26exploit.py:390-392

Observed behavior

• Generates a MediaWiki XML export file containing a logitem with serialized PHP objects in the <params> field.exploit.py:88-118
• Fingerprints a target URL by checking for MediaWiki generator meta tag and version, and determines if the version is vulnerable.exploit.py:121-208
• Attempts to upload the generated XML payload to Special:Import using provided session cookies.exploit.py:211-292
• Performs bulk fingerprinting of multiple targets from a file.exploit.py:295-330

Observables

Url

Payload withheldRepository clone URL provided in README.md installation instructions.README.md:210

Command

Payload withheldCommand to generate a malicious XML payload file.README.md:196

Command

Payload withheldCommand to run the exploit against a target with session cookies.README.md:202

Network Activity

Payload withheldThe exploit script uploads a crafted XML file to the target's import endpoint.exploit.py:243-260

Payload

Payload withheldThe generated XML contains a serialized stdClass object to test deserialization behavior.exploit.py:80

Classification basis

The artifact contains a complete Python script (exploit.py) that actively uploads a PHP webshell to a target and attempts to execute commands on it, which is the definition of exploit code. The README describes it as an exploit and provides usage instructions for exploitation.

Requirements

• Target must run Blocksy Companion Pro < 2.1.47 with WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active.README.md:26
• Target must expose the vulnerable AJAX endpoint (wp-admin/admin-ajax.php) and allow unauthenticated requests.exploit.py:170-175

Observed behavior

• Fingerprints the target for Blocksy theme or companion plugin and checks version.exploit.py:90-137
• Generates a random filename with .woff2.php double extension to bypass strpos() validation.exploit.py:140-143
• Sends a multipart POST request with a PHP webshell payload to multiple AJAX endpoints using the parameter blc-review-images[].exploit.py:146-196
• Searches common upload paths for the uploaded shell and tests command execution via ?cmd=id.exploit.py:199-237

Observables

Webshell Payload

Payload withheldThe exploit uploads a PHP file that executes commands via the 'cmd' parameter. This is the expected behavior for an arbitrary file upload RCE exploit.exploit.py:76-87

Exploit Behavior

Payload withheldThe script's actions are directly aligned with exploiting the described vulnerability. No additional hidden actions were found.exploit.py:146-196exploit.py:199-237

Classification basis

The Python script actively exploits the SQL injection vulnerability by constructing and sending malicious payloads to extract data from the target database, going beyond detection to achieve data exfiltration.

Requirements

• Target running EasyStore ≤ 2.0.1 with accessible product listingREADME.md:16README.md:94-97
• Python 3.8+ with standard library onlyREADME.md:106requirements.txt:1

Observed behavior

• Sends HTTP requests with SQL injection payload in filter_sortby parametercve_2026_65761.py:33-45
• Performs time-based detection using SLEEP(5) to confirm vulnerabilitycve_2026_65761.py:47-51
• Extracts database version, name, user, and table prefix via blind SQLicve_2026_65761.py:101-115
• Dumps Joomla user credentials (username, email, name) from the databasecve_2026_65761.py:117-130
• Extracts sensitive configuration including site secret and payment API keyscve_2026_65761.py:132-144

Observables

Network Target

Payload withheldAll HTTP requests are sent only to the target specified by the user via the --url argument. No hardcoded external URLs or data exfiltration endpoints are present.cve_2026_65761.py:39cve_2026_65761.py:149cve_2026_65761.py:154

Imports

Payload withheldOnly Python standard library modules are imported. No third-party or obfuscated modules are used.cve_2026_65761.py:19cve_2026_65761.py:25

Ssl Configuration

Payload withheldSSL certificate verification is disabled, which is a common practice in exploit PoCs to avoid connection errors against misconfigured targets. This does not constitute backdoor behavior.cve_2026_65761.py:26

Classification basis

The primary artifact cve_2026_63030.py contains code that actively exploits vulnerabilities to achieve remote code execution. It performs SQL injection, creates an administrator account, and deploys a webshell, which is the definition of an exploit.

Requirements

• Target must be a vulnerable WordPress instance (6.9.0-6.9.4 or 7.0.0-7.0.1) with at least one published post and REST API accessible.README.md:16README.md:99-106

Observed behavior

• Sends crafted batch REST API requests to trigger a route confusion desync, then injects SQL via the author__not_in parameter to extract database information.cve_2026_63030.py:112-126cve_2026_63030.py:128-146
• Uses UNION SELECT SQL injection to forge fake WordPress post objects in the database cache, then leverages oEmbed processing and changeset hijacking to create a new administrator account.cve_2026_63030.py:148-182
• Optionally authenticates as the new administrator, uploads a malicious plugin containing a PHP webshell, activates it, and executes an arbitrary system command.cve_2026_63030.py:184-230

Observables

Exploit Behavior

Payload withheldThis is the advertised purpose of the PoC and is not a backdoor; it is the normal exploit behavior against the stated target.cve_2026_63030.py:148-182

Exploit Behavior

Payload withheldThis is an advertised feature (--rce flag) and is part of the documented exploit chain, not a hidden backdoor.cve_2026_63030.py:184-230

Network Communication

Payload withheldNo requests are made to external or attacker-controlled infrastructure; the script only interacts with the target specified by the user.cve_2026_63030.py:50-60cve_2026_63030.py:151

Classification basis

The Python script actively exploits the vulnerability by obtaining a nonce, uploading a PHP webshell, and executing commands on the target, which constitutes an exploit.

Requirements

• Target must run WordPress with Super Forms plugin version <= 6.3.313.cve_2026_14894.py:6
• Target must expose wp-admin/admin-ajax.php and allow unauthenticated POST requests.cve_2026_14894.py:130-131

Observed behavior

• Sends unauthenticated POST to super_create_nonce AJAX endpoint to obtain a valid nonce.cve_2026_14894.py:137-149
• Uploads a Base64-encoded PHP webshell via the super_submit_form AJAX handler using the obtained nonce.cve_2026_14894.py:151-209
• Executes system commands on the target by requesting the uploaded webshell with a command parameter.cve_2026_14894.py:232-235
• Optionally cleans up by deleting the uploaded webshell after exploitation.cve_2026_14894.py:237-239

Observables

Url

Payload withheldExample shell URL from README output, consistent with the exploit's target-side payload.README.md:150

Url

Payload withheldTarget WordPress AJAX endpoint used for nonce generation and file upload.README.md:173-174cve_2026_14894.py:59

Command

Payload withheldTest command executed on the target to confirm RCE.cve_2026_14894.py:233

File Write

Payload withheldTarget directory where the PHP webshell is uploaded.README.md:79cve_2026_14894.py:185

Classification basis

The artifact contains a complete Python script that actively exploits CVE-2026-3891 by uploading a PHP webshell and executing arbitrary commands on vulnerable targets. The code performs the full attack chain: nonce retrieval, file upload, and command execution, which constitutes an exploit rather than a scanner or writeup.

Requirements

• Target must be running Pix for WooCommerce plugin version <= 1.5.0README.md:15
• Target must have the vulnerable AJAX endpoints accessiblecve_2026_3891.py:57-59

Observed behavior

• Sends POST request to obtain a valid nonce without authenticationcve_2026_3891.py:127-130
• Uploads a PHP webshell file via the certificate_crt_path parameter in a multipart POST requestcve_2026_3891.py:156-162
• Verifies successful upload by requesting the webshell URL and checking for expected contentcve_2026_3891.py:168-169
• Executes system commands (id;hostname;uname -a) on the target via the uploaded webshellcve_2026_3891.py:194-196
• Optionally cleans up by deleting the uploaded webshell filecve_2026_3891.py:198-200
• Supports mass scanning of multiple targets with configurable threadingcve_2026_3891.py:206-223

Observables

Webshell Payload

Payload withheldThe exploit deploys a webshell to achieve RCE as described in the CVE. The shell requires a random token to operate and includes a self-deletion feature, which is consistent with a responsible PoC.cve_2026_3891.py:63-83

Cleanup Behavior

Payload withheldThe script deletes the webshell by default after command execution, reducing persistence risk. This is controlled by the --no-cleanup flag.cve_2026_3891.py:198-200

Classification basis

The primary Python script (cve_2026_13001.py) actively exploits the vulnerability by uploading a PHP web shell and executing commands on the target. It goes beyond detection by deploying a payload and achieving remote code execution, which is the defining characteristic of an exploit.

Requirements

• A target running Podlove Podcast Publisher <= 4.5.1cve_2026_13001.py:160-180
• An attacker-controlled server hosting a PHP polyglot payload (or use of the built-in --serve option)cve_2026_13001.py:327-330

Observed behavior

• Detects the Podlove plugin by fetching readme.txt or podlove.php and parsing the versioncve_2026_13001.py:160-180
• Constructs a bypass URL (e.g., http://attacker.com/shell.php?.gif) to exploit the is_image() vs extract_file_extension() mismatchcve_2026_13001.py:187-193
• Triggers the vulnerable podlove_image_cache_url endpoint to download and save the polyglot as a .php file in the cache directorycve_2026_13001.py:199-204
• Verifies shell deployment by accessing the uploaded file and checking for the web shell interfacecve_2026_13001.py:211-216
• Executes system commands (id;hostname;uname -a) on the target via the deployed web shell to confirm RCEcve_2026_13001.py:239-243
• Optionally cleans up by deleting the uploaded shell filecve_2026_13001.py:244-246
• Supports mass scanning of multiple targets with concurrent threads and progress reportingcve_2026_13001.py:254-304

Observables

Exploit Behavior

Payload withheldThis is the core disclosed exploit for CVE-2026-13001. The script generates a GIF89a PHP polyglot, triggers the vulnerable endpoint to download it, and verifies RCE.cve_2026_13001.py:182-221

Exploit Behavior

Payload withheldThe PayloadServer class starts a local HTTP server to serve the polyglot payload, simplifying exploitation when the operator does not have a remote server. This is disclosed via the --serve argument.cve_2026_13001.py:91-123cve_2026_13001.py:329-330

Exploit Behavior

Payload withheldThe script deletes the uploaded shell from the target by default (--no-cleanup disables this). This is a disclosed feature to reduce forensic footprint.cve_2026_13001.py:244-246

Classification basis

The primary operation of the code is to detect and report the presence of the vulnerability by checking for a specific indicator (stack traces with 'args' in API error responses). It does not perform any action beyond parsing the server's error response, which is characteristic of a scanner. The README describes it as a 'scan' and the code's main class is named 'MassScanner'.

Requirements

• Target must be running a vulnerable version of Moodle (4.5.0 - 4.5.2) with web services enabled and PHP's zend.exception_ignore_args set to Off.README.md:15README.md:17README.md:28

Observed behavior

• Sends HTTP requests to detect Moodle by checking for the string 'moodle' in the response body of /login/index.php.cve_2025_32044.py:108-109
• Checks if Moodle web services are enabled by requesting /login/token.php with guest credentials.cve_2025_32044.py:131
• Attempts to obtain a web service token using a list of common credentials.cve_2025_32044.py:145-146
• Sends malformed requests to REST API endpoints to trigger an exception and then parses the JSON response for a 'stacktrace' key containing 'args'.cve_2025_32044.py:167-172
• Extracts usernames, emails, and password hashes from the leaked stack trace arguments.cve_2025_32044.py:180-193
• Outputs a report indicating whether the target is vulnerable and, if so, the number of leaked users, emails, and hashes.cve_2025_32044.py:252-253cve_2025_32044.py:316-323

Observables

Network Request

Payload withheldThis is the core functionality of the PoC and matches the described CVE-2025-32044 exploitation technique.cve_2025_32044.py:103-176

Credential Attempt

Payload withheldThis is part of the vulnerability assessment to determine if a token can be obtained for authenticated leak testing. It is not a backdoor.cve_2025_32044.py:143-157

Data Extraction

Payload withheldThis is the intended information disclosure described by CVE-2025-32044.cve_2025_32044.py:178-193

Classification basis

The primary artifact is a Python script that actively exploits CVE-2026-56291 by uploading a PHP web shell to a vulnerable target and executing commands on the remote server. The README describes it as a 'Mass RCE Exploit' and the code contains functions to deploy a shell, check for RCE, and execute commands.

Requirements

• Target must be running a vulnerable version of the Balbooa Forms Joomla extension (versions 1.0 through 2.4.0).README.md:15
• The target's web server must be configured to execute PHP files in the upload directory.cve_2026_56291.py:11

Observed behavior

• Detects the presence of the Balbooa Forms component by sending HTTP GET requests to known component paths and checking for the string 'baforms' in the response.cve_2026_56291.py:88-105
• Uploads a PHP web shell by sending a multipart POST request to the unauthenticated 'form.uploadAttachmentFile' task endpoint. The script attempts multiple form IDs, file extensions (.php, .phtml), and upload methods.cve_2026_56291.py:107-156
• Verifies successful remote code execution by sending a GET request to the uploaded shell with the command 'id' and checking for 'uid=' in the response.cve_2026_56291.py:158-162
• Optionally cleans up the uploaded shell by sending a GET request with a command to delete the file.cve_2026_56291.py:164-166
• Supports mass scanning and exploitation of multiple targets from a file using multi-threading.cve_2026_56291.py:198-218

Observables

Webshell Upload

Payload withheldThe PHP payload uploaded to the target to achieve RCE, consistent with the described vulnerability.cve_2026_56291.py:110

Command Execution

Payload withheldCommand executed on the target to verify RCE after shell upload.cve_2026_56291.py:186

Cleanup Mechanism

Payload withheldOptional cleanup deletes the uploaded shell using a self-deletion command, leaving no persistent backdoor.cve_2026_56291.py:189

Classification basis

The primary artifact is a Python script that actively exploits CVE-2026-15282 by uploading a PHP webshell to a vulnerable target and executing commands on it. The README explicitly describes it as a 'Mass RCE Exploit' and provides usage examples for exploitation. The code contains functions to detect, exploit, verify RCE, and clean up, which is characteristic of an exploit.

Requirements

• Target must have the vulnerable Instant Appointment plugin (<= 1.2) installed and the 'add_service_front' AJAX action accessible.cve_2026_15282.py:100-119
• The target server must allow outbound HTTP requests (for file_get_contents) or support data:// URIs.README.md:34-38

Observed behavior

• Detects the presence of the Instant Appointment plugin by requesting known plugin paths and checking for the 'add_service_front' AJAX action.cve_2026_15282.py:100-119
• Exploits the vulnerability by sending a POST request to /wp-admin/admin-ajax.php with a base64-encoded PHP webshell payload in the 'image_url' parameter and a .php filename in the 'image_name' parameter.cve_2026_15282.py:121-167
• Verifies remote code execution by requesting the uploaded webshell with a system command ('id') and checking for the expected output.cve_2026_15282.py:169-175
• Optionally cleans up by deleting the uploaded webshell via a self-deletion command.cve_2026_15282.py:177-180
• Supports mass scanning of multiple targets from a file with multi-threading and progress reporting.cve_2026_15282.py:227-288

Observables

Webshell Upload

Payload withheldThe exploit uploads a simple PHP webshell to the target server to demonstrate RCE, consistent with the described CVE.cve_2026_15282.py:124

Cleanup Mechanism

Payload withheldThe script includes a cleanup mechanism that deletes the uploaded webshell after exploitation, unless the user explicitly opts out with --no-cleanup. This is standard for responsible PoC scripts.cve_2026_15282.py:177-180cve_2026_15282.py:210-212cve_2026_15282.py:309

Output Saving

Payload withheldThe script can save discovered RCE URLs to a file for later use, a common feature in mass exploitation tools.cve_2026_15282.py:273-275

Classification basis

The primary operation is detection and reporting of vulnerable JTL Shop instances. The code identifies JTL Shop, checks version vulnerability, and locates contact forms. The optional --exploit flag only submits a blind SSTI probe and checks for form submission success; it does not extract data, establish a shell, or verify code execution. The README describes manual exploitation steps but the code itself does not implement them. This matches the definition of a scanner.

Requirements

• Target must be a JTL Shop instance running a vulnerable version (5.2.0–5.7.1) with an accessible contact form.cve_2026_54390.py:143-163cve_2026_54390.py:167-217

Observed behavior

• Detects JTL Shop by searching homepage HTML for JTL markers and extracting version from static asset paths or specific file paths.cve_2026_54390.py:84-141
• Checks if the detected version falls within the vulnerable range (5.2.0–5.7.1, excluding patched versions 5.5.4+, 5.6.2+, 5.7.2+).cve_2026_54390.py:143-163
• Discovers contact forms by requesting known paths and parsing HTML for form action, CSRF token, and subject IDs.cve_2026_54390.py:167-217
• Optionally submits a contact form with a blind SSTI payload ({7*7}) and checks for success markers in the response, but does not verify SSTI execution.cve_2026_54390.py:221-265cve_2026_54390.py:349-354
• Outputs a list of vulnerable hosts and saves them to a file if specified.cve_2026_54390.py:362-366

Observables

Network Activity

Payload withheldThe script sends HTTP requests to detect JTL Shop instances and optionally submits SSTI payloads via contact forms. This is expected behavior for a vulnerability scanner.cve_2026_54390.py:93cve_2026_54390.py:174cve_2026_54390.py:252-253

Payload Submission

Payload withheldThe script can submit template injection payloads to demonstrate the vulnerability. The payloads are standard SSTI test strings and do not contain hidden malicious code.cve_2026_54390.py:44-46cve_2026_54390.py:236-237

File Operation

Payload withheldThe script saves identified vulnerable hosts to a file for reporting purposes. This is a standard feature of security scanners.cve_2026_54390.py:364-366

Classification basis

The primary operation of the code is to detect and confirm the presence of the vulnerability through time-based blind SQLi probes, not to exploit it for unauthorized access or data exfiltration by default. The README and script describe it as a 'scanner' and 'mass scanner', and the core logic focuses on detection and validation. The optional --extract flag adds data extraction capability, but the default and primary behavior is scanning.

Requirements

• Target must have WP Maps plugin <= 4.9.1 installed and the admin-ajax.php endpoint reachable.cve_2026_39492.py:84-118cve_2026_39492.py:370-398

Observed behavior

• Detects WP Maps plugin by fetching readme.txt or plugin PHP file and searching for identifying markers.cve_2026_39492.py:84-118
• Checks if the detected plugin version is vulnerable (<= 4.9.1).cve_2026_39492.py:120-136
• Sends time-based blind SQLi payloads using backtick-wrapped location_id parameter to admin-ajax.php and measures response time to confirm vulnerability.cve_2026_39492.py:140-230
• Optionally extracts data (e.g., admin credentials) from confirmed vulnerable targets using boolean-based blind SQLi with binary search.cve_2026_39492.py:250-301cve_2026_39492.py:576-588
• Supports mass scanning of multiple targets from a file with configurable threads and output of vulnerable hosts.cve_2026_39492.py:420-508

Observables

Vulnerability Scanner

Payload withheldThe main Python script implements detection and exploitation of CVE-2026-39492, including mass scanning and blind SQLi data extraction.cve_2026_39492.py:1-600

Network Activity

Payload withheldThe script sends POST requests to /wp-admin/admin-ajax.php with crafted location_id payloads to test and exploit the SQL injection vulnerability.cve_2026_39492.py:140-230

Data Extraction

Payload withheldThe --extract flag triggers extraction of admin user_login and user_pass from the WordPress database using the SQL injection vulnerability.cve_2026_39492.py:576-588

Classification basis

The code's primary operation is to detect the presence of the vulnerable plugin and test for the LFI vulnerability by sending probes and analyzing responses. It does not contain logic to execute arbitrary commands, establish a reverse shell, or perform any post-exploitation actions. The README describes an 'RCE Chain' but the scanner only checks for the accessibility of files that could be used in such a chain; it does not implement the chain itself. The artifact is therefore a scanner.

Requirements

• Target must be running a vulnerable version (<= 2.9.17) of the WP User Manager WordPress plugin.README.md:15
• The target's profile page must be accessible and process the 'tab' query parameter.cve_2026_9290.py:110-136

Observed behavior

• Detects the WP User Manager plugin by requesting known plugin file paths and checking for specific markers in the response.cve_2026_9290.py:94-108
• Identifies the profile page endpoint by testing a list of common paths and searching for WPUM profile markers in the HTML.cve_2026_9290.py:110-136
• Tests for LFI by sending requests with path traversal payloads (e.g., '../../../wp-config.php') in the 'tab' parameter and comparing the response length and content to a baseline request.cve_2026_9290.py:140-193
• Confirms LFI by checking the response for PHP error messages or the presence of expected file content markers like 'DB_NAME'.cve_2026_9290.py:172-188
• Checks for potential Remote Code Execution chains by probing for accessible log files or uploaded PHP shells.cve_2026_9290.py:257-265
• Outputs a summary of findings, including whether WPUM was detected, LFI was confirmed, and if RCE might be possible.cve_2026_9290.py:317-329

Observables

Exploit Behavior

Payload withheldThe Python script sends GET requests to target WordPress sites, checks for plugin markers, and attempts to include files like wp-config.php and /etc/passwd. This is standard PoC behavior for the described CVE.cve_2026_9290.py:94-108cve_2026_9290.py:140-193

Network Communication

Payload withheldThe script uses the requests library to interact with target servers. No connections to attacker-controlled infrastructure are made; all requests are directed at the user-supplied targets.cve_2026_9290.py:86-90cve_2026_9290.py:150-164

File Operations

Payload withheldThe script reads a list of targets from a user-specified file and optionally saves LFI results to an output file. These are local file operations controlled by the user, not unauthorized data exfiltration.cve_2026_9290.py:331-339cve_2026_9290.py:359-362

Classification basis

The primary artifact, cve_2026_8713.py, contains code that, when invoked with the --exploit flag, actively sends path traversal payloads to delete arbitrary files on a target server. This constitutes an exploit. The script also includes a non-destructive detection mode, but the presence of the destructive capability makes the overall artifact an exploit.

Requirements

• Target must have a vulnerable version of Avada (Fusion) Builder plugin (<= 3.15.3) installed.cve_2026_8713.py:6-8
• Target must have a published Avada form configured to save entries to the database.cve_2026_8713.py:149-189
• The WordPress admin-ajax.php endpoint must be reachable (POST or GET).cve_2026_8713.py:220-234

Observed behavior

• Detects Avada/Fusion Builder installations by checking for known file paths and markers.cve_2026_8713.py:106-147
• Finds published Avada form IDs via REST API, homepage scraping, or brute-force.cve_2026_8713.py:149-189
• In exploit mode, sends a crafted POST or GET request to admin-ajax.php with a path traversal payload (e.g., ../../wp-config.php) and parameters to trigger immediate file deletion.cve_2026_8713.py:193-268
• Verifies file deletion by checking HTTP status codes of the targeted file or checking if WordPress enters setup mode.cve_2026_8713.py:241-296

Observables

Exploit Behavior

Payload withheldThis is the documented exploit behavior for CVE-2026-8713. No additional hidden actions were identified.cve_2026_8713.py:193-268cve_2026_8713.py:379-450

Network Communication

Payload withheldExpected for a network-based exploit PoC. No communication to attacker-controlled infrastructure was found.cve_2026_8713.py:98-102cve_2026_8713.py:106-189

File Deletion

Payload withheldThis is the core vulnerability being exploited. The script only deletes files on the target specified by the user.cve_2026_8713.py:193-268README.md:35-41

Classification basis

The artifact contains a complete Python script that actively exploits CVE-2026-48939 by uploading a PHP webshell and executing commands on the target. It is not limited to detection or scanning; it performs the full exploit chain.

Requirements

• Target must be running a vulnerable version of the iCagenda Joomla extension (3.2.1-3.9.14 or 4.0.0-4.0.7).cve_2026_48939.py:130-139
• Target must have the iCagenda registration.submit controller endpoint accessible.cve_2026_48939.py:32-35

Observed behavior

• Detects iCagenda by fetching the XML manifest or checking for known paths.cve_2026_48939.py:99-128
• Uploads a PHP webshell by POSTing to the registration.submit endpoint with a file in the jform[attachment] field.cve_2026_48939.py:143-203
• Locates the uploaded shell by checking known destination paths and parsing directory listings.cve_2026_48939.py:170-197
• Executes arbitrary system commands on the target via the deployed webshell.cve_2026_48939.py:216-223
• Optionally cleans up the webshell by triggering a self-deletion command.cve_2026_48939.py:225-230

Observables

Exploit Behavior

Payload withheldThis is the core functionality of the PoC and matches the described CVE-2026-48939 vulnerability.cve_2026_48939.py:143-203cve_2026_48939.py:216-223

Token Protection

Payload withheldThis limits unauthorized reuse of the deployed shell and is a common practice in responsible PoCs.cve_2026_48939.py:56-63

Cleanup Mechanism

Payload withheldThis is a responsible disclosure feature, not a backdoor.cve_2026_48939.py:225-230

Classification basis

The primary artifact is a scanner. The README explicitly titles it a 'Scanner' (line 8) and the code includes a '--no-exploit' flag that performs detection only (lines 146-147, 160, 244-257). While the code also contains exploitation logic, its design as a mass-scanning tool with a detection-only mode and its self-description as a scanner indicate its primary purpose is scanning.

Requirements

• Target must be running a vulnerable version of Langflow (< 1.8.0).cve_2026_27966.py:91-96
• Target must have an unauthenticated API endpoint for custom component registration or build vertex injection.cve_2026_27966.py:98-105

Observed behavior

• Sends HTTP GET requests to /api/v1/version to detect Langflow and its version.cve_2026_27966.py:63-89
• Checks if the target requires an API key by attempting to POST to /api/v1/custom_component.cve_2026_27966.py:98-105
• Attempts to obtain an API key via the auto_login endpoint.cve_2026_27966.py:109-136
• Attempts remote code execution by registering a backdoor FastAPI route via /api/v1/custom_component and then calling it with a command.cve_2026_27966.py:140-186
• Attempts remote code execution by injecting a malicious vertex into a flow via /api/v1/build/{uuid}/vertices and then running the flow.cve_2026_27966.py:187-208
• Attempts remote code execution via payload withheld by sending a crafted prompt to /api/v1/run/{fid}.cve_2026_27966.py:210-216
• Supports a --no-exploit flag that skips all RCE attempts and only reports vulnerability status.cve_2026_27966.py:244-257

Observables

Exploit Technique

Payload withheldThe script registers a backdoor FastAPI route on the target to achieve RCE, as described in the README.cve_2026_27966.py:144-149

Exploit Technique

Payload withheldThe script injects a malicious vertex into a flow and triggers execution to achieve RCE.cve_2026_27966.py:196-208

Exploit Technique

Payload withheldThe script attempts prompt injection against CSV Agent flows to execute Python code.cve_2026_27966.py:211-216

Network Behavior

Payload withheldThe script sends HTTP requests to the specified target(s) to detect and exploit the vulnerability.cve_2026_27966.py:52-59

Classification basis

The artifact is a scanner because its primary operation is to detect and validate the presence of CVE-2026-49049 without exploiting it for malicious impact. The README explicitly describes it as a 'Read-Only Vulnerability Scanner' (line 9) that performs a 'non-destructive probe' (line 7-8). The code writes a temporary file only to confirm the vulnerability and immediately deletes it (lines 219-226, 250-261), which is a detection technique, not an exploitation payload. It does not leverage the vulnerability to delete arbitrary files, write malicious content, or achieve code execution.

Requirements

• Target must be running Joomla with the Helix3 template framework (versions 1.0 through 3.1.0).README.md:15
• The unauthenticated AJAX endpoint (index.php?option=com_ajax&plugin=helix3&format=json) must be reachable.cve_2026_49049.py:52

Observed behavior

• Detects Joomla and Helix3 template by probing /templates/shaper_helix3/templateDetails.xml and /administrator/.cve_2026_49049.py:153-195
• Checks if the detected Helix3 version is within the vulnerable range (1.0 – 3.1.0).cve_2026_49049.py:197-215
• Probes the 'save' action by sending a POST request with a harmless JSON payload to the AJAX endpoint.cve_2026_49049.py:236-247
• If the 'save' probe succeeds, probes the 'remove' action to delete the temporary file, leaving no persistent changes.cve_2026_49049.py:250-261
• Probes the 'import' action (v3.x only) by sending a POST request with empty settings.cve_2026_49049.py:264-275
• Outputs scan results to console and optionally to text and JSON report files.cve_2026_49049.py:95-131cve_2026_49049.py:412-441

Observables

Vulnerability Scanner

Payload withheldThe tool probes for an unauthenticated AJAX handler vulnerability. It writes a harmless JSON file to confirm the save action and deletes it to confirm the remove action, leaving no persistent changes.cve_2026_49049.py:219-279README.md:78

Network Activity

Payload withheldThe scanner sends POST requests to the target's AJAX endpoint to test save, remove, and import actions. This is the expected behavior for a vulnerability scanner targeting CVE-2026-49049.cve_2026_49049.py:237-275

File Operation

Payload withheldThe scanner writes a JSON file named '_cve49049_<probe_id>.json' to the target's Helix3 layout folder and then deletes it. This is a non-destructive validation technique.cve_2026_49049.py:239-240cve_2026_49049.py:252-254

Classification basis

The primary artifact is a Python script (cve_2026_57517.py) that actively exploits CVE-2026-57517 by performing SQL injection to write a PHP webshell to the target filesystem and then executing arbitrary commands. The README describes it as a 'Mass Scanner + Validator + Interactive Shell' and the code includes functions for deploying a webshell (exploit_sqli), verifying it (_verify_shell), and executing commands (exec_command). This constitutes an exploit, not merely a scanner or writeup.

Requirements

• Target must be running a vulnerable version of Control Web Panel (≤ 0.9.8.1224) on port 2083.README.md:25
• A valid CWP username must be known or enumerable.cve_2026_57517.py:235-325

Observed behavior

• Detects if a host is running Control Web Panel by checking for CWP indicators in HTTP responses on port 2083.cve_2026_57517.py:192-229
• Enumerates valid CWP usernames via HTTP GET requests to user panel paths and login page response differentiation.cve_2026_57517.py:235-325
• Exploits a blind SQL injection in the userRes POST parameter by sending a UNION SELECT payload with a hex-encoded PHP webshell, using INTO DUMPFILE to write the shell to the Roundcube logs directory.cve_2026_57517.py:331-390
• Verifies the deployed webshell by sending a base64-encoded PHP command via the HTTP 'C' header and checking for a unique token in the response.cve_2026_57517.py:392-405
• Executes arbitrary operating system commands on the target via the webshell and returns the output.cve_2026_57517.py:407-422
• Optionally cleans up the deployed webshell by sending a self-deleting PHP command.cve_2026_57517.py:424-432
• Supports mass scanning of multiple targets with configurable concurrency and real-time result logging.cve_2026_57517.py:507-561
• Provides an interactive shell mode for direct command execution on a compromised target.cve_2026_57517.py:675-711

Observables

Exploit Behavior

Payload withheldThis is the documented exploit chain for CVE-2026-57517 and does not constitute a backdoor.cve_2026_57517.py:331-390

Exploit Behavior

Payload withheldThis is the standard command execution method for the deployed webshell and matches the README description.cve_2026_57517.py:407-422

Cleanup Mechanism

Payload withheldThe script can leave shells on target if --no-cleanup is used, but this is a user-controlled option, not a hidden backdoor.cve_2026_57517.py:424-432