nullwhisper
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubnullwhisper/CVE-2026-56292-AcyMailing-SQLi
Repository PoCStars: 0Created 2026-08-13ScannerCVE-2026-562927 files
Analysis
Technical assessment
Python-based mass scanner that sends a crafted SQL injection payload to a specific Joomla AcyMailing endpoint and classifies targets as vulnerable, patched, or error based on the response, without extracting or dumping database contents beyond a version string.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward SQL injection scanner for CVE-2026-56292. It sends a crafted request to a target Joomla endpoint and parses the response to determine vulnerability. All code is readable and directly serves the disclosed exploit. No concealed payloads, data exfiltration to third parties, or deceptive behavior was found.
Classification basis and observed behavior
Classification basis
The code sends a SQL injection payload but only extracts the database version string to determine vulnerability; it does not exfiltrate data, establish a shell, or perform any post-exploitation actions. The README describes it as a 'single + mass scanner' and the script's output is limited to classification and version reporting.
README.md:18cve_2026_56292_acymailing_sqli.py:3cve_2026_56292_acymailing_sqli.py:36cve_2026_56292_acymailing_sqli.py:72-85Requirements
- Target must have AcyMailing component installed and the frontentityselect task accessible.
cve_2026_56292_acymailing_sqli.py:7-8
Observed behavior
- Sends a GET request with a UNION SELECT version() payload in the columns parameter to the loadEntityFront endpoint.
cve_2026_56292_acymailing_sqli.py:35-36cve_2026_56292_acymailing_sqli.py:61-69 - Parses the JSON response to extract a non-numeric id field as the database version string, indicating vulnerability.
cve_2026_56292_acymailing_sqli.py:72-85 - Classifies responses as vulnerable, patched, error, or safe based on HTTP status and response body keywords.
cve_2026_56292_acymailing_sqli.py:88-141 - Supports single target and mass scanning with multi-threading, output files for vulnerable/patched/error targets.
cve_2026_56292_acymailing_sqli.py:192-205cve_2026_56292_acymailing_sqli.py:231-257
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldThe vulnerable endpoint targeted by the exploit.
cve_2026_56292_acymailing_sqli.py:35 - Payload
- Payload withheldThe SQL injection payload used to extract the database version.
cve_2026_56292_acymailing_sqli.py:36
What the analysis did not establish
- Evidence does not include the TECHNICAL.md writeup file referenced in README.md; only README.md, the scanner script, and requirements.txt are provided.
- The repository contains 7 files total but only 3 text files are included; 4 files are omitted, including dorks.txt and LICENSE.
- The scanner script is not executed; classification is based solely on static analysis of the provided source code.
- Four files from the repository (dorks.txt, TECHNICAL.md, LICENSE, and a .gitignore) were not included in the text evidence, but their metadata and names are consistent with the disclosed project and do not suggest executable behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubnullwhisper/CVE-2026-14282
Repository PoCStars: 1Created 2026-08-13ExploitCVE-2026-142826 files
Analysis
Technical assessment
Python script that uploads a PHP web shell to a vulnerable GoDAM WordPress plugin instance via an unauthenticated WPForms file upload, then executes arbitrary commands on the target server.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward exploit for CVE-2026-14282. It uploads a PHP webshell to a vulnerable WordPress target and executes a user-supplied command. All behavior is consistent with the disclosed vulnerability and the artifact's own documentation. No concealed, deceptive, or unrelated harmful actions were found.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script that actively uploads a PHP web shell to a vulnerable server and executes arbitrary commands, which constitutes exploitation rather than mere detection or scanning.
cve_2026_14282_poc.py:30cve_2026_14282_poc.py:58-80cve_2026_14282_poc.py:164-170Requirements
- Target must have a page containing a WPForms form with a GoDAM record field.
cve_2026_14282_poc.py:33-55 - The GoDAM plugin version must be <= 1.12.2 and the save_video_file() handler must be active.
README.md:8-15
Observed behavior
- Fetches a target page and parses HTML to extract WPForms form IDs and GoDAM field IDs.
cve_2026_14282_poc.py:33-55 - Constructs a multipart POST request with a PHP file disguised as video/mp4 and submits it to the detected form.
cve_2026_14282_poc.py:58-80 - Attempts to access the uploaded PHP shell at a predictable web-accessible path and verifies execution by checking for a marker string.
cve_2026_14282_poc.py:83-96 - Executes an attacker-supplied system command via the uploaded shell and prints the output.
cve_2026_14282_poc.py:164-170
Behaviors behind the backdoor verdict
Observables
- Webshell
- Payload withheldThe PHP payload uploaded to the target server to achieve remote code execution.
cve_2026_14282_poc.py:30 - Command Execution
- Payload withheldThe operator-supplied command is executed on the target server via the uploaded webshell.
cve_2026_14282_poc.py:164-170
What the analysis did not establish
- Evidence does not include the lab setup files (docker-compose.yml, setup.php) or the vulnerable plugin binaries; only the README, PoC script, and requirements.txt are provided.
- The PoC script was not executed; classification is based solely on static analysis of the provided source code.
- Three files (lab/docker-compose.yml, lab/setup.php, and a .gitignore) were not included in the text evidence, but their metadata shows they are lab setup files and do not affect the PoC's runtime behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubnullwhisper/CVE-2026-14840
Repository PoCStars: 0Created 2026-08-13ExploitCVE-2026-148406 files
Analysis
Technical assessment
The artifact is a Python script that exploits CVE-2026-14840 by sending multiple votes with spoofed X-Forwarded-For IPs to bypass per-IP vote restrictions in the YOP Poll WordPress plugin.
Backdoor review
No backdoor observed in reviewed code
The PoC script cve_2026_14840_poc.py performs exactly the disclosed exploit: it sends POST requests to a target WordPress site's YOP Poll REST API endpoint with a spoofed X-Forwarded-For header to bypass per-IP vote limits. No hidden, deceptive, or unrelated harmful behavior is present. The script's actions are limited to the operator-specified target, and all network communication is directly tied to the vote-casting functionality.
Classification basis and observed behavior
Classification basis
The script actively sends crafted requests to cast multiple votes, which is the exploitation of the vulnerability, not just detection. It is described as a 'PoC' and its main purpose is to demonstrate the bypass by successfully casting votes.
cve_2026_14840_poc.py:1-15cve_2026_14840_poc.py:143-145Requirements
- Target must have a page containing a YOP Poll with the vulnerable plugin version (< 7.0.6).
README.md:8-12 - The attacker must be able to send HTTP requests to the target WordPress site.
cve_2026_14840_poc.py:38
Observed behavior
- Fetches a target page and extracts poll ID, nonce, and answer IDs from embedded JSON.
cve_2026_14840_poc.py:35-67 - Sends multiple POST requests to the YOP Poll REST API endpoint with a randomly generated IP in the X-Forwarded-For header.
cve_2026_14840_poc.py:70-111 - Reports the target as vulnerable if more than one vote is accepted.
cve_2026_14840_poc.py:165-167
Behaviors behind the backdoor verdict
Observables
- Network Endpoint
- Payload withheldThe script sends vote-casting POST requests to these endpoints on the operator-specified target. This is the core of the disclosed exploit.
cve_2026_14840_poc.py:92-95 - Http Header
- Payload withheldThe script sets a spoofed IP address in the X-Forwarded-For header for each vote request, which is the mechanism for bypassing the per-IP vote restriction.
cve_2026_14840_poc.py:89 - Dependency
- Payload withheldStandard Python HTTP libraries required to run the PoC. No unusual or suspicious dependencies are included.
requirements.txt:1-2
What the analysis did not establish
- The lab setup files (docker-compose.yml, setup.php) are not included in the text evidence, so the full lab environment cannot be analyzed.
- The evidence does not include the vulnerable plugin binary, so the exact vulnerable code path cannot be verified.
- Three files (lab/docker-compose.yml, lab/setup.php, and the .gitignore) were not included in the text evidence, but their omission is not material to the backdoor review as they are described as lab setup files and the primary executable PoC script was fully provided.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.