imbas007
Source-scoped identity with 21 associated PoCs and 22 linked vulnerabilities.
Exploit catalog results
Showing 21 PoCs on this page
GitHubimbas007/CVE-2026-64638-POC
Repository PoCStars: 5Created 2026-08-08ScannerCVE-2026-6463816 files
Analysis
Technical assessment
The artifact is a repository containing a scanner (xss2shell_scanner.py) and a checker (xss2shell_checker.py) for CVE-2026-64638, a reflected XSS vulnerability in WordPress. The README and Makefile describe and reference these scanning/checking tools. The provided exploit_server.py is a callback server for XSS exfiltration, but the core exploit chain script (xss2shell_chain.py) is not included in the supplied evidence, so the primary operation visible is detection and validation.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README, Makefile, a Python callback server, and a requirements file for a CVE-2026-64638 proof-of-concept. The code serves an educational exploit page and logs callbacks, consistent with the stated XSS-to-RCE chain demonstration. No concealed executable behavior, persistence, credential theft, or unrelated payloads were observed in the supplied text.
Classification basis and observed behavior
Classification basis
The supplied evidence includes references to and usage instructions for xss2shell_scanner.py and xss2shell_checker.py, which are explicitly described as tools for detecting the vulnerability (version detection, patch checking) without exploiting it. The exploit chain script (xss2shell_chain.py) is mentioned but its source code is not provided in the evidence, so the primary artifact operation visible is scanning/checking.
README.md:85-86Makefile:51-55Requirements
- Target WordPress instance must be vulnerable (version < 7.0.3).
README.md:25 - Scanner requires network access to the target WordPress login page.
Makefile:52
Observed behavior
- The Makefile defines a 'scan' target that runs xss2shell_scanner.py to detect version and patch status.
Makefile:51-52 - The Makefile defines a 'check' target that runs xss2shell_checker.py, described as a lightweight patch checker.
Makefile:54-55 - The README describes xss2shell_scanner.py as performing version detection and username reflection test.
README.md:85 - The README describes xss2shell_checker.py as a safe, non-exploitative patch checker.
README.md:86
Behaviors behind the backdoor verdict
Observables
- Callback Server
- Payload withheldThis is the expected behavior for a PoC that demonstrates an XSS callback chain; it does not perform any unauthorized actions on the operator's machine.
exploit_server.py:43-89 - Network Activity
- Payload withheldThis is standard for a controlled lab environment and does not indicate backdoor behavior.
exploit_server.py:123-135
What the analysis did not establish
- The main exploit chain script (xss2shell_chain.py) is referenced but its source code is not included in the supplied evidence. Only exploit_server.py, Makefile, README.md, and requirements.txt are provided.
- The scanner and checker scripts (xss2shell_scanner.py, xss2shell_checker.py) are referenced but their source code is not included in the supplied evidence.
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included.
- 12 out of 16 text files in the repository were not included in the evidence packet; their contents are unknown and could contain backdoor behavior.
- No binary files were identified, but the analysis scope notes 70,512 unclassified bytes across 12 files, which may include unexamined content.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimbas007/POC-CVE-2026-58048
Repository PoCStars: 1Created 2026-08-04ExploitCVE-2026-580485 files
Analysis
Technical assessment
The artifact is a Python-based exploit for CVE-2026-58048, a SQL injection vulnerability in cPanel. It provides a class `CVE202658048Exploit` that automates the attack chain: authenticating to cPanel, setting the SQL mode to ANSI_QUOTES, creating a database, and renaming it with a crafted name containing a backtick to inject arbitrary SQL that executes as MySQL root. The code includes multiple payload presets for creating admin users, writing webshells, reading files, and executing OS commands.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, a Python PoC script (poc.py), and a requirements file for CVE-2026-58048. The PoC demonstrates a SQL injection vulnerability in cPanel's database rename functionality. It uses standard Python libraries (requests, pymysql, rich) to interact with cPanel APIs and MySQL, and includes a simulation mode. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated remote access were observed. The code's purpose aligns with the described vulnerability and does not perform any actions beyond the stated exploit and verification.
Classification basis and observed behavior
Classification basis
The primary artifact is `poc.py`, which contains a complete, automated exploit class (`CVE202658048Exploit`) that executes the full attack chain to achieve SQL injection and privilege escalation. It is not merely a scanner or writeup; it actively performs the exploitation steps, including crafting and sending malicious payloads to a target cPanel instance.
poc.py:319-329poc.py:412-543Requirements
- Valid cPanel user credentials (username and password or API token) or access to a Docker lab environment.
poc.py:71-98poc.py:331-353 - Ability to connect to the MySQL server associated with the cPanel account to set the session SQL mode.
poc.py:383-401poc.py:444-471 - Target cPanel version must be vulnerable (e.g., < 11.110.0.137).
README.md:59
Observed behavior
- Authenticates to the cPanel API using provided credentials.
poc.py:89-98 - Sets the MySQL session SQL mode to 'ANSI_QUOTES' to disable backtick identifier quoting.
poc.py:217-221poc.py:444-471 - Creates a new database via the cPanel API.
poc.py:143-145poc.py:473-486 - Crafts a malicious database name containing a backtick and injected SQL (e.g., `db`; GRANT ALL ON *.* TO 'rce'@'%' IDENTIFIED BY 'pwned!'; -- `).
poc.py:236-270poc.py:488-501 - Triggers the vulnerability by calling the cPanel rename_database API with the malicious name, causing the injected SQL to execute as MySQL root.
poc.py:151-155poc.py:503-512 - Optionally verifies successful exploitation by connecting to MySQL as the newly created admin user.
poc.py:545-568
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe PoC connects to user-supplied cPanel and MySQL endpoints to demonstrate the SQL injection. This is expected behavior for a PoC exploit.
poc.py:100-132poc.py:192-204 - Payload Generation
- Payload withheldThese payloads are generated based on user-selected presets or custom SQL input. They are used to demonstrate the impact of the vulnerability (privilege escalation, file write, file read, command execution) and are not executed surreptitiously.
poc.py:233-313poc.py:689-729 - Simulation Mode
- Payload withheldThe simulation mode only prints explanatory text and does not make any network connections or modify the local system. It is a safe educational feature.
poc.py:581-660
What the analysis did not establish
- The evidence packet does not include the contents of `simulate.py` or any Docker-related files, which are referenced in the README but omitted from the selected text.
- The analysis is based solely on the provided source code and documentation; no dynamic execution or verification of the exploit's effectiveness was performed.
- Two files (metadata only) were omitted from the text analysis due to size or classification; their content was not reviewed.
- The review is limited to the supplied text evidence and does not include dynamic analysis or execution of the code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimbas007/CVE-2026-60004-POC
Repository PoCStars: 12Created 2026-08-03ExploitCVE-2026-600044 files
Analysis
Technical assessment
The artifact is a full exploit chain for CVE-2026-60004, a pre-auth remote code execution vulnerability in Gitea. It includes a Python script (cve-2026-60004-poc.py) that registers a user, creates a repository, sends malicious diff patches to trigger a Git hook injection, and retrieves command output. A Nuclei template (CVE-2026-60004.yaml) also performs the full exploit chain. The README documents the exploit and provides usage instructions.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Nuclei template, a README, and a Python PoC script for CVE-2026-60004, a Gitea RCE vulnerability. All three files describe and implement the same exploit chain: register a user, create a repo, send a crafted diffpatch to inject a Git hook, and retrieve command output. The Python script uses only standard library modules and performs no unrelated network activity, persistence, credential exfiltration, or concealed payload delivery. The hook payload is generated transparently from the user-supplied --cmd argument. No backdoor or deceptive behavior was observed.
Classification basis and observed behavior
Classification basis
The Python script and Nuclei template both contain code that actively exploits the vulnerability by sending malicious patches to achieve remote code execution and retrieve command output. The README describes the exploit chain and provides usage examples for exploitation. This is not merely a scanner or writeup; it is a functional exploit.
cve-2026-60004-poc.py:444-503CVE-2026-60004.yaml:152-195README.md:69-93Requirements
- Target Gitea instance must have open registration enabled for full-auto mode, or attacker must have valid credentials for semi-auto/manual modes.
cve-2026-60004-poc.py:293-314cve-2026-60004-poc.py:702-704 - Target Gitea version must be between 1.17 and 1.27.0 (inclusive).
CVE-2026-60004.yaml:8-10cve-2026-60004-poc.py:17-18
Observed behavior
- Registers a new user on the target Gitea instance via the signup page.
cve-2026-60004-poc.py:316-352CVE-2026-60004.yaml:91-108 - Creates a private repository with auto-init on the target instance.
cve-2026-60004-poc.py:356-384CVE-2026-60004.yaml:110-126 - Sends a crafted Git diff patch multiple times to the diffpatch API endpoint to trigger an add/add collision, which writes a malicious post-index-change hook into the bare repository's hooks directory.
cve-2026-60004-poc.py:410-503CVE-2026-60004.yaml:152-195 - The injected hook executes an attacker-supplied command, captures the output, and stores it in a Git blob in the origin repository, creating a new branch named 'rce-proof'.
cve-2026-60004-poc.py:122-145CVE-2026-60004.yaml:162 - Retrieves the command output by fetching the 'proof' file from the 'rce-proof' branch via the raw API endpoint.
cve-2026-60004-poc.py:507-544CVE-2026-60004.yaml:197-215
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThe PoC implements the documented CVE-2026-60004 exploit chain with no hidden steps.
cve-2026-60004-poc.py:263-503 - Command Execution
- Payload withheldThe hook payload is built by replacing CMD_PLACEHOLDER with the user's command; no hardcoded malicious command is present.
cve-2026-60004-poc.py:122-145 - Network Activity
- Payload withheldAll HTTP requests target the user-specified --url; no external callbacks, beacons, or data exfiltration to third parties.
cve-2026-60004-poc.py:171-257
What the analysis did not establish
- One file (likely an image) was omitted from the evidence due to being non-text, but it is referenced in the README as a screenshot and is not required for classification.
- The CVE record for CVE-2026-60004 was absent from the acquired CVEList, so external validation of the vulnerability details is not possible from the provided evidence alone.
- One file (metadata-only) was omitted from the text evidence; its content is unknown but is not required for the backdoor review of the supplied readable files.
- The review does not assess whether the exploit works as claimed or whether the target is actually vulnerable.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimbas007/CVE-2026-63223-POC
Repository PoCStars: 1Created 2026-08-03ExploitCVE-2026-6322310 files
Analysis
Technical assessment
The artifact is a fully functional Python exploit for CVE-2026-63223, a file upload RCE vulnerability in CodeIgniter 4. It generates a malicious PHP webshell disguised with image magic bytes, uploads it to a vulnerable endpoint, and provides command execution and an interactive shell.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a payload withheld, README, and Python exploit script for CVE-2026-63223. All three files describe and implement a legitimate proof-of-concept for the disclosed vulnerability: uploading a file with image magic bytes and a .php extension to bypass CodeIgniter 4's is_image/mime_in validation. The exploit script generates a payload, uploads it, and executes commands via the uploaded webshell. No concealed, deceptive, or unrelated harmful behavior was observed. The artifact's behavior is consistent with the stated CVE and does not contain backdoor functionality.
Classification basis and observed behavior
Classification basis
The primary artifact is the Python script 'payload withheld', which is explicitly designed to exercise the CVE-2026-63223 vulnerability by uploading a malicious file and executing commands on the target. The README describes it as a 'PoC' and provides usage instructions for exploitation, including command execution and an interactive shell. The payload withheld sets up a vulnerable lab environment for testing the exploit. This code is intended to achieve remote code execution, not merely detect or report the vulnerability.
exploit/exploit.py:1-18README.md:1-6README.md:135-151Requirements
- A target running a vulnerable version of CodeIgniter 4 (< 4.7.4) with an upload endpoint that uses is_image or mime_in validation without an independent extension check, saves files with the client-supplied filename, and stores them in a web-accessible directory.
README.md:16-20 - The Python 'requests' library must be installed.
exploit/exploit.py:27-31
Observed behavior
- Generates a PHP webshell payload prepended with image magic bytes (GIF, JPEG, or PNG) to bypass content-based MIME type validation.
exploit/exploit.py:36-78 - Uploads the malicious file to a specified target URL via a multipart POST request, simulating an unauthenticated attacker.
exploit/exploit.py:99-136 - Attempts to discover the uploaded file's path from the server response or by guessing common paths.
exploit/exploit.py:138-161 - Executes arbitrary system commands on the target server by sending HTTP requests to the uploaded webshell and displays the output.
exploit/exploit.py:163-211 - Provides an interactive shell mode for continuous command execution.
exploit/exploit.py:213-231
Behaviors behind the backdoor verdict
Observables
- Exploit Script
- Payload withheldPython script that generates a PHP webshell with image magic bytes, uploads it to a target endpoint, and provides command execution and interactive shell capabilities. This is the core PoC for CVE-2026-63223.
exploit/exploit.py:1-300 - Vulnerable Lab Setup
- Payload withheldpayload withheld sets up a CodeIgniter 4.7.3 environment with a vulnerable upload controller, matching the CVE description. It installs the framework, configures Apache, and copies vulnerable application code.
Dockerfile:1-56 - Documentation
- Payload withheldREADME explains the vulnerability, patch analysis, PoC components, and usage instructions. It includes manual exploitation steps and detection queries, all aligned with the CVE.
README.md:1-305
What the analysis did not establish
- The evidence includes only 3 of 10 files from the repository. The 7 omitted files (e.g., docker-compose.yml, vulnerable-app controllers/views) are not provided, so their content cannot be analyzed.
- The analysis is based solely on static review of the provided text; the code was not executed, and its effectiveness or safety is not verified.
- 7 files (16897 bytes) were classified as unclassified and only metadata was provided; their content was not reviewed.
- The analysis is limited to the supplied text evidence; no dynamic execution or binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimbas007/CVE-2026-42533
Repository PoCStars: 32Created 2026-07-27ExploitCVE-2026-4253310 files
Analysis
Technical assessment
The artifact is a full exploit chain for CVE-2026-42533, a heap buffer overflow in nginx. It includes Python modules for information leaking (leak.py), heap spraying and overflow triggering (overflow.py), and a complete exploit orchestrator (exploit.py) that chains these primitives to achieve remote code execution by corrupting a pool cleanup handler.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a PoC exploit for CVE-2026-42533, a heap buffer overflow in nginx. All reviewed Python scripts (exploit.py, leak.py, overflow.py, analyze.py) and the README.md describe and implement the claimed vulnerability exploitation chain: info leak, heap spray, and overflow to achieve RCE. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed. The code performs only the actions necessary to demonstrate the CVE.
Classification basis and observed behavior
Classification basis
The artifact contains multiple Python scripts (exploit.py, leak.py, overflow.py) that actively exploit CVE-2026-42533 to achieve remote code execution. The code performs information leaking, heap spraying, and a heap buffer overflow to corrupt memory and hijack control flow, which is the definition of an exploit. The README explicitly describes it as a 'PoC Exploit' and 'Full Exploit Chain'.
README.md:1-3exploit/exploit.py:1-10exploit/exploit.py:295-422Requirements
- Target must be running a vulnerable version of nginx (0.9.6–1.30.3 stable, 0.9.6–1.31.2 mainline) with a specific vulnerable configuration involving a regex-based map directive and a regex location that references both capture variables and the map output variable in the same directive.
README.md:12-13README.md:188-201 - The attacker must be able to send HTTP requests to the target nginx server.
exploit/exploit.py:60-68
Observed behavior
- Sends crafted HTTP GET requests to trigger an information leak, exposing uninitialized heap memory containing libc and heap pointers to defeat ASLR.
exploit/leak.py:31-60exploit/exploit.py:80-205 - Opens multiple keep-alive connections to spray the heap and groom its layout, placing controlled allocations adjacent to the overflow target.
exploit/overflow.py:188-241exploit/exploit.py:241-291 - Sends a crafted HTTP POST request with a body that triggers a heap buffer overflow, corrupting an adjacent ngx_pool_cleanup_t structure to hijack a function pointer and redirect execution to a ROP chain or system() call.
exploit/overflow.py:120-159exploit/exploit.py:295-422 - Provides a diagnostic mode that demonstrates the two-pass size mismatch without crashing the target.
exploit/overflow.py:37-84
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal and expected behavior for a PoC demonstrating CVE-2026-42533.
exploit/exploit.py:57-422exploit/leak.py:21-180exploit/overflow.py:28-289 - Command Execution
- Payload withheldThis is the stated goal of the exploit (RCE) and is not a hidden backdoor; the command is explicitly provided by the user running the PoC.
exploit/exploit.py:299-300exploit/exploit.py:326-327exploit/exploit.py:494-496 - Network Communication
- Payload withheldThis is required for the PoC to function against a target nginx server.
exploit/exploit.py:67-69exploit/leak.py:24-27exploit/overflow.py:31-34
What the analysis did not establish
- The evidence includes only 5 of 10 files from the repository. The omitted files (Dockerfile, docker-compose.yml, nginx/nginx.conf, exploit/requirements.txt) are not provided, so the vulnerable configuration and build environment cannot be fully verified.
- The analysis is based solely on static review of the provided source code. The code was not executed, and its claims of reliability or effectiveness on specific targets are not verified.
- The exploit contains hardcoded offsets and addresses (e.g., DEFAULT_CONFIG in exploit.py) that are specific to a particular build of nginx and glibc. The code's portability to other targets is not assessed.
- Five files in the repository (including requirements.txt, nginx.conf, Dockerfile, docker-compose.yml) were not included in the text evidence and were not reviewed.
- Binary files were flagged as metadata-only and not analyzed; none were reported in the evidence.
- The review is limited to static analysis of the provided source code; dynamic behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimbas007/POC-CVE-2026-60206
Repository PoCStars: 32Created 2026-07-24ExploitCVE-2026-602069 files
Analysis
Technical assessment
A Python-based exploit for CVE-2026-60206, an Oracle WebLogic Server SAML authentication bypass. The code implements multiple attack vectors including unsigned assertion injection, XML Signature Wrapping, NameID manipulation, and combined attacks, and actively sends crafted SAML responses to a target server to achieve unauthorized access.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a Python-based proof-of-concept (PoC) exploit for CVE-2026-60206, a SAML authentication bypass in Oracle WebLogic Server. The code implements multiple SAML attack vectors (XML Signature Wrapping, unsigned assertion injection, NameID manipulation, etc.) and sends crafted SAML responses to a user-supplied target. No backdoor, trojan, or deceptive behavior was observed. The artifact's functionality is consistent with its stated purpose as a security testing tool. It does not contain concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads. The code is plaintext Python with no obfuscation, and all actions are directed at the operator-specified target.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script that actively crafts and sends malicious SAML payloads to a target server to achieve authentication bypass. It includes multiple attack vectors (unsigned assertion, XSW, NameID manipulation) and verifies success by checking for a logged-in state, which constitutes exploitation, not just detection or scanning.
CVE-2026-60206-exploit.py:1-3CVE-2026-60206-exploit.py:220-222CVE-2026-60206-exploit.py:531-611Requirements
- Network access to a target Oracle WebLogic Server instance with SAML endpoints enabled.
CVE-2026-60206-exploit.py:37 - Python 3 environment with required libraries (requests, lxml, cryptography, signxml, urllib3).
requirements.txt:2-6
Observed behavior
- Detects the WebLogic version and probes for SAML endpoints on the target server.
CVE-2026-60206-exploit.py:241-272 - Crafts and sends an unsigned SAML Response to the target's ACS endpoint to bypass authentication.
CVE-2026-60206-exploit.py:276-316 - Performs XML Signature Wrapping by injecting a malicious unsigned assertion alongside a signed one.
CVE-2026-60206-exploit.py:320-362 - Manipulates the NameID field using techniques like comment injection to confuse the identity mapper.
CVE-2026-60206-exploit.py:366-398 - Executes a combined attack using XSW, an unsigned inner assertion, and NameID manipulation.
CVE-2026-60206-exploit.py:442-495 - Sends the crafted SAML payload to multiple potential ACS endpoints and checks for successful authentication bypass.
CVE-2026-60206-exploit.py:531-611
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe exploit sends crafted SAML responses to the operator-specified WebLogic server. This is expected behavior for a PoC exploit.
CVE-2026-60206-exploit.py:224CVE-2026-60206-exploit.py:569-574 - File Write
- Payload withheldThe script can save generated SAML payloads and JSON reports locally. This is a documented feature for analysis and does not indicate malicious intent.
CVE-2026-60206-exploit.py:537-543CVE-2026-60206-exploit.py:714-716 - Dependency
- Payload withheldStandard Python libraries for HTTP requests, XML processing, and cryptographic operations. No suspicious or uncommon dependencies.
requirements.txt:2-6
What the analysis did not establish
- The evidence includes only the main exploit script, README, and requirements.txt. Supporting modules (samlib.py, weblogic_client.py, logger.py, mass_scan.py) are referenced but not provided, so the full implementation of SAML manipulation and HTTP client functions cannot be verified.
- The artifact is not executed; classification is based solely on static analysis of the provided source code.
- Six files in the repository (including modules/samlib.py, modules/weblogic_client.py, modules/logger.py, mass_scan.py) were not included in the text evidence and were not reviewed. These modules likely contain the core SAML manipulation and HTTP client logic, but their absence does not indicate a backdoor; the main script's imports and usage are consistent with the stated purpose.
- Binary files were not present in the repository, so no binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimbas007/CVE-2026-48282
Repository PoCStars: 24Created 2026-07-06ExploitCVE-2026-482823 files
Analysis
Technical assessment
Python exploit for CVE-2026-48282, an unauthenticated path traversal in Adobe ColdFusion RDS. It reads/writes arbitrary files via /CFIDE/main/ide.cfm and achieves RCE by deploying a CFML webshell or executing commands.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a Python script that exploits CVE-2026-48282, a path traversal vulnerability in Adobe ColdFusion RDS. It reads/writes files and deploys a CFML webshell for command execution, all consistent with the stated exploit behavior. No concealed backdoor, deceptive payload, or unrelated harmful action was observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a fully functional Python script that actively exploits CVE-2026-48282 by reading/writing files and executing commands on a vulnerable target. It includes RDS protocol encoding, path traversal payloads, webshell generation, and command execution logic, which goes beyond detection or scanning.
CVE-2026-48282.py:1-22CVE-2026-48282.py:273-435Requirements
- Target must have Adobe ColdFusion RDS enabled and accessible without authentication.
CVE-2026-48282.py:7-10 - Target must be running a vulnerable ColdFusion version (2025 <= Update 9, 2023 <= Update 20).
CVE-2026-48282.py:12-14
Observed behavior
- Sends crafted RDS protocol requests to /CFIDE/main/ide.cfm to read arbitrary files from the target filesystem.
CVE-2026-48282.py:273-289 - Writes arbitrary files to the target filesystem via the RDS endpoint, enabling webshell deployment.
CVE-2026-48282.py:291-301 - Deploys a CFML webshell to the ColdFusion web root to achieve remote command execution.
CVE-2026-48282.py:376-401 - Executes arbitrary system commands by writing a temporary CFML file and requesting it via HTTP.
CVE-2026-48282.py:404-435
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe script constructs RDS READ requests with traversal prefixes to read files like /etc/passwd or win.ini, matching the CVE description.
CVE-2026-48282.py:113-115CVE-2026-48282.py:258-269 - Exploit Behavior
- Payload withheldThe script constructs RDS WRITE requests to deploy a webshell or temporary command execution file, consistent with the CVE's RCE impact.
CVE-2026-48282.py:118-120CVE-2026-48282.py:376-401 - Exploit Behavior
- Payload withheldThe script generates and writes a CFML webshell that executes system commands via <cfexecute>, which is the intended RCE mechanism.
CVE-2026-48282.py:351-373CVE-2026-48282.py:404-435 - Network Target
- Payload withheldThe script targets the specific vulnerable endpoint described in the CVE.
CVE-2026-48282.py:46-48
What the analysis did not establish
- Evidence is limited to the supplied text files; no binary or opaque content was present. The artifact was not executed, and its effectiveness or safety is not verified.
- Only the three text files (Python script, README, requirements) were reviewed; no binary files were present or analyzed.
- The review does not verify that the script functions as claimed or is safe to execute; it only assesses the supplied evidence for backdoor indicators.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimbas007/POC_CVE-2026-41940
Repository PoCStars: 0Created 2026-05-03ExploitCVE-2026-419402 files
Analysis
Technical assessment
Python script that performs a 4-stage authentication bypass exploit against cPanel & WHM (CVE-2026-41940) to gain root access, then offers post-exploitation actions including command execution, password change, and an interactive shell.
Backdoor review
No backdoor observed in reviewed code
The PoC implements a documented 4-stage authentication bypass exploit for CVE-2026-41940 against cPanel/WHM. All code is readable Python with no obfuscation. The post-exploit actions (list accounts, change password, execute commands, create user, read files) are consistent with the stated exploit goal of demonstrating unauthorized root access. No concealed payloads, persistence mechanisms, or unrelated remote access features were observed.
Classification basis and observed behavior
Classification basis
The script actively performs a multi-stage attack chain (CRLF injection, session poisoning, token propagation) to bypass authentication and gain root WHM access, then provides post-exploitation capabilities including command execution and an interactive shell. This is exploitation, not mere detection.
POC_CVE-2026-41940.py:4-5POC_CVE-2026-41940.py:11-16POC_CVE-2026-41940.py:922-1033Requirements
- Target must be a vulnerable cPanel/WHM instance (versions before patches listed in CVE-2026-41940).
POC_CVE-2026-41940.py:24-26 - Network access to the target's WHM port (default 2087).
POC_CVE-2026-41940.py:30
Observed behavior
- Discovers canonical hostname via /openid_connect/cpanelid redirect.
POC_CVE-2026-41940.py:250-263 - Mints a preauth session by POSTing wrong credentials to /login/?login_only=1.
POC_CVE-2026-41940.py:268-305 - Injects CRLF characters into the session file via a crafted Authorization: Basic header.
POC_CVE-2026-41940.py:310-336 - Triggers session cache propagation by requesting /scripts2/listaccts.
POC_CVE-2026-41940.py:341-367 - Verifies root access by requesting /json-api/version and checking for a 200 response with version data.
POC_CVE-2026-41940.py:372-399 - Offers post-exploit actions: list accounts, change root password, execute OS commands, create users, read files, and an interactive WHM shell.
POC_CVE-2026-41940.py:639-896
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThe script performs a documented exploit chain: canonical host discovery, preauth session minting, CRLF injection via Authorization header, token denial gadget propagation, and root access verification.
POC_CVE-2026-41940.py:11-16 - Post Exploit Actions
- Payload withheldPost-exploit actions are consistent with demonstrating the impact of the authentication bypass vulnerability.
POC_CVE-2026-41940.py:18-22 - Payload
- Payload withheldThe payload injects session fields (hasroot=1, tfa_verified=1) to bypass authentication. It is clearly documented and directly related to the CVE.
POC_CVE-2026-41940.py:91-101
What the analysis did not establish
- Evidence is limited to the supplied text files; no runtime behavior or network traffic was observed.
- The artifact's README.md references an external repository (ynsmroztas/cPanelSniper) not included in the evidence.
- Only the two text files (POC_CVE-2026-41940.py and README.md) were reviewed; no other files exist in the repository.
- The review does not assess whether the exploit actually works or is safe to execute against a target.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimbas007/auth-bypass-CVE-2025-40554
Repository PoCStars: 1Created 2026-01-29ScannerCVE-2025-405544 files
Analysis
Technical assessment
The artifact is a Nuclei template and a Python script that detect vulnerable SolarWinds Web Help Desk instances. The Nuclei template checks for version strings below 2026.1, and the Python script performs an authentication bypass check and optional login validation. Neither component executes a payload or achieves code execution; they only identify and report vulnerable targets.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Nuclei template, a README, and a requirements file for a CVE-2025-40554 authentication bypass PoC. The text files describe legitimate vulnerability detection and exploitation behavior against SolarWinds Web Help Desk. No backdoor, deceptive payload, or concealed operator-directed harm is observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The Nuclei template only detects vulnerable versions via HTTP response matching and version comparison; it does not exploit the vulnerability. The Python script is described as performing a bypass and login check, but its source code is not provided, and the README indicates it saves vulnerable targets, consistent with a scanner. No exploit payload or code execution is present.
CVE-2025-40554.yaml:24-59README.md:22-46Requirements
- Target must be running SolarWinds Web Help Desk version below 2026.1
CVE-2025-40554.yaml:59 - Python script requires requests library
requirements.txt:1
Observed behavior
- Nuclei template sends GET request to /helpdesk/WebObjects/Helpdesk.woa and extracts version from response body
CVE-2025-40554.yaml:25-45 - Nuclei template matches response body for Web Help Desk strings and compares version to < 2026.1
CVE-2025-40554.yaml:47-59 - Python script performs authentication bypass and optional login validation, saving vulnerable targets
README.md:22-46
Behaviors behind the backdoor verdict
Observables
- Exploit Script Reference
- Payload withheldThe README references a Python script that performs authentication bypass and optional login. The script itself is not included in the supplied text evidence, so its behavior cannot be fully verified.
README.md:25
What the analysis did not establish
- Python script payload withheld is not included in the evidence; its behavior is inferred from README usage examples only.
- One file (payload withheld) is omitted from the packet, limiting full analysis of the Python component.
- The main exploit script payload withheld is referenced in README.md but is not included in the supplied text evidence. Its contents are unknown.
- One file (metadata only) was omitted from the text evidence; its content is not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimbas007/POC-CVE-2025-55182
Repository PoCStars: 1Created 2025-12-05Not analyzedCVE-2025-55182CVE-2025-664785 files
GitHubimbas007/CVE-2025-49844-Vulnerability-Scanner
Repository PoCStars: 1Created 2025-10-11ScannerCVE-2025-498443 files
Analysis
Technical assessment
A Python-based vulnerability scanner that checks Redis instances for exposure to CVE-2025-49844 by connecting, retrieving the server version, testing Lua scripting availability, and comparing the version against a hardcoded list of vulnerable releases. It does not execute or deliver any exploit payload.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python-based vulnerability scanner for CVE-2025-49844. The code performs Redis connection tests, version checks, and Lua scripting availability checks. No backdoor, trojan, or deceptive payload was observed. The scanner does not execute any exploit payload, establish persistence, exfiltrate data, or perform any action beyond the stated vulnerability assessment.
Classification basis and observed behavior
Classification basis
The artifact's primary operation is to detect whether a Redis instance is vulnerable to CVE-2025-49844 by checking the server version and Lua scripting availability. It does not contain any code that triggers a use-after-free, manipulates the garbage collector, or achieves remote code execution. The README explicitly describes it as a 'Vulnerability Scanner' and the code only performs read-only diagnostic commands (PING, INFO, EVAL with a safe return statement).
CVE-2025-49844-Vulnerability-Scanner.py:2-5CVE-2025-49844-Vulnerability-Scanner.py:56-64README.md:1-3Requirements
- Network access to a Redis instance on a reachable IP:PORT
CVE-2025-49844-Vulnerability-Scanner.py:38-45 - Redis instance must accept unauthenticated connections or the scanner must supply valid credentials (the code does not implement authentication)
CVE-2025-49844-Vulnerability-Scanner.py:41-42
Observed behavior
- Connects to a Redis server and sends a PING command to verify accessibility
CVE-2025-49844-Vulnerability-Scanner.py:38-45 - Retrieves the Redis server version via the INFO command
CVE-2025-49844-Vulnerability-Scanner.py:47-54 - Executes a benign Lua script (return 'Lua scripting enabled') to test whether EVAL is permitted
CVE-2025-49844-Vulnerability-Scanner.py:56-64 - Compares the retrieved version against a hardcoded list of vulnerable version strings and a version-range logic to determine vulnerability status
CVE-2025-49844-Vulnerability-Scanner.py:66-105 - Reports results to stdout with color-coded output and optionally saves vulnerable targets to a text file or full results to a JSON file
CVE-2025-49844-Vulnerability-Scanner.py:245-292
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe scanner connects to Redis instances specified by the user via -t or -l arguments to check version and Lua scripting status.
CVE-2025-49844-Vulnerability-Scanner.py:41-42CVE-2025-49844-Vulnerability-Scanner.py:50-51CVE-2025-49844-Vulnerability-Scanner.py:59-61 - File Write
- Payload withheldThe scanner writes scan results to local files as documented; no unexpected file writes or system modifications occur.
CVE-2025-49844-Vulnerability-Scanner.py:273-274CVE-2025-49844-Vulnerability-Scanner.py:290-291 - External Reference
- Payload withheldA typo'd attribution link to a GitHub profile; no evidence of malicious content at the link, and the scanner does not fetch or execute it.
README.md:78
What the analysis did not establish
- The scanner does not implement Redis authentication; it will fail against password-protected instances unless they are configured to accept unauthenticated connections.
- Vulnerability determination relies solely on version string comparison and does not attempt to trigger the actual use-after-free condition, so false positives/negatives are possible if version detection fails or the server is patched outside the version scheme.
- Only the three text files in the repository were reviewed; no binary or non-text files were present.
- The review does not assess the safety of the linked GitHub profile or any content hosted there.
- The scanner's version comparison logic may produce false positives or negatives, but this is a functional limitation, not a backdoor.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubimbas007/POC-CVE-2025-52970
Repository PoCStars: 0Created 2025-10-05ExploitCVE-2025-529702 files
Analysis
Technical assessment
Python script that exploits CVE-2025-52970 in FortiWeb via SQL injection in the Authorization header to write a webshell and a chmod gadget, then executes arbitrary commands.
Backdoor review
No backdoor observed in reviewed code
The PoC implements a SQL injection to RCE chain against FortiWeb CVE-2025-52970. It uploads a CGI webshell and a Python chmod gadget, then executes commands via the User-Agent header. No concealed backdoor, unrelated payload, credential theft, or persistence mechanism was observed. The code performs only the advertised exploit behavior.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by sending SQL injection payloads to write a webshell and a chmod gadget, then executes arbitrary commands on the target. It does not merely detect or scan for the vulnerability.
POC-CVE-2025-52970.py:23-28POC-CVE-2025-52970.py:50-68POC-CVE-2025-52970.py:70-77Requirements
- Target running vulnerable FortiWeb version (7.0.0-7.0.10, 7.2.0-7.2.10, 7.4.0-7.4.7, 7.6.0-7.6.3)
POC-CVE-2025-52970.py:1 - Network access to target's /api/fabric/device/status endpoint
POC-CVE-2025-52970.py:21
Observed behavior
- Sends SQL injection payloads in the Authorization header to /api/fabric/device/status
POC-CVE-2025-52970.py:23-28 - Uses SQL injection to write a webshell to /migadmin/cgi-bin/x.cgi via INTO OUTFILE
POC-CVE-2025-52970.py:50-57 - Writes a Python chmod gadget to /var/log/lib/python3.10/pylab.py and triggers it via /cgi-bin/ml-draw.py
POC-CVE-2025-52970.py:59-68 - Executes arbitrary OS commands by sending them in the User-Agent header to the uploaded webshell
POC-CVE-2025-52970.py:70-77 - Provides an interactive shell that sends commands via User-Agent header and prints response
POC-CVE-2025-52970.py:97-112 - Saves vulnerable target URLs to vul.txt file
POC-CVE-2025-52970.py:134-137
Behaviors behind the backdoor verdict
Observables
- Webshell Upload
- Payload withheldThis is the intended RCE payload for the exploit, not a hidden backdoor.
POC-CVE-2025-52970.py:45-48POC-CVE-2025-52970.py:70-74 - Chmod Gadget
- Payload withheldThis is part of the exploit chain to make the webshell executable.
POC-CVE-2025-52970.py:41-44POC-CVE-2025-52970.py:64-65 - Vulnerable Target Logging
- Payload withheldThis is a common PoC logging practice and does not exfiltrate data or establish persistence.
POC-CVE-2025-52970.py:135-137
What the analysis did not establish
- Evidence is limited to the supplied source code; no runtime output or network captures are provided to confirm successful exploitation.
- The README.md references a screenshot (image) that is not included in the text evidence, so its content cannot be verified.
- Only the two text files (Python script and README) were reviewed; no binary files were present.
- The review does not assess whether the exploit works as claimed or is safe to execute.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.