webshellseo8
Source-scoped identity with 11 associated PoCs and 11 linked vulnerabilities.
Exploit catalog results
Showing 11 PoCs on this page
GitHubwebshellseo8/CVE-2026-12720-Proof-of-Concept
Repository PoCStars: 0Created 2026-08-04Model review verdict: Suspicious behavior.StubCVE-2026-127202 files
AnalysisSuspicious behavior
Technical assessment
The artifact is a Python script and README that describe CVE-2026-12720 but contain only a placeholder payload and no functional exploit or scanner logic. The script prints vulnerability information and a hardcoded illustrative serialized string, then exits. It does not connect to a target, send a payload, or verify vulnerability status.
Backdoor review
Suspicious behaviorThe Python script is a harmless simulation that prints a placeholder payload and does not perform any network activity or exploitation. However, the README.md materially misrepresents the script's capabilities, claiming it is a 'functional demonstration script' with 'Automated Verification' and 'Customizable Payloads', which directly contradicts the script's actual behavior. This deception about the artifact's functionality raises concern about the operator's intent.
Classification basis and observed behavior
Classification basis
The script contains no code to connect to a target, send a payload, or check for vulnerability. It only prints a placeholder payload and describes the vulnerability. The README claims 'Automated Verification' and 'Customizable Payloads' but the provided Python file implements none of these features. The artifact is materially incomplete for exploitation or scanning.
CVE-2026-12720.py:1-90README.md:19-21Requirements
- User must type 'yes' to proceed to the simulation step.
CVE-2026-12720.py:80-81
Observed behavior
- Prints a disclaimer and vulnerability information.
CVE-2026-12720.py:36-58 - Displays a hardcoded placeholder serialized payload without sending it to any target.
CVE-2026-12720.py:34CVE-2026-12720.py:61-72
Behaviors behind the backdoor verdict
Flagged behaviors
- The README.md describes the artifact as a 'functional demonstration script' with features like 'Automated Verification' and 'Customizable Payloads', but the provided Python script (CVE-2026-12720.py) contains no such functionality; it only prints a hardcoded placeholder payload and requires no target input.
README.md:13README.md:19-21CVE-2026-12720.py:61-72
Observables
- Url
- Payload withheldA Telegram channel URL embedded in the script as the 'Source' of vulnerability information. It is displayed to the user but not used for any network communication within the provided code.
CVE-2026-12720.py:32
What the analysis did not establish
- The README describes features (Automated Verification, Customizable Payloads) not present in the supplied Python file.
- The Python file contains only a placeholder payload and no network operations.
- Only the two text files (CVE-2026-12720.py and README.md) were reviewed. No other files, dependencies, or network behavior were analyzed.
- The review cannot determine if the Telegram channel URL is malicious or if the repository contains hidden branches or tags with different content.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubwebshellseo8/CVE-2026-57811-Proof-of-Concept
Repository PoCStars: 0Created 2026-07-29WriteupCVE-2026-578111 file
Analysis
Technical assessment
The artifact is a README file that provides an overview of CVE-2026-57811, a code injection vulnerability in the Realtyna Organic IDX plugin for WordPress. It describes the vulnerability, its potential impact (unauthenticated RCE), and the purpose of a Proof of Concept for validation, but explicitly states that the complete PoC is not published in the repository. The file contains no exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The repository contains only a single README.md file that describes the CVE-2026-57811 vulnerability and states that the complete PoC is not published. No executable code, obfuscated payloads, or instructions to execute anything are present. The file includes a link to a Telegram channel, which is a common promotional tactic but does not constitute backdoor behavior within the artifact itself.
Classification basis and observed behavior
Classification basis
The artifact is a README file containing a technical analysis and overview of CVE-2026-57811. It explicitly states 'The complete PoC is not published in this repository' and contains no exploit or scanner code, making it a writeup.
README.md:30Requirements
- Target must be running a vulnerable version of the Realtyna Organic IDX plugin (<= 5.2.0).
README.md:9
Observed behavior
- The file describes the vulnerability and the intended use of a PoC for verification, but does not contain or execute any code.
README.md:15-30
Behaviors behind the backdoor verdict
Observables
- Telegram Link
- Payload withheldThe README promotes a Telegram channel for exploit updates. This is a common social-engineering or lead-generation tactic in PoC repositories but does not, by itself, demonstrate backdoor or malicious behavior within the supplied artifact.
README.md:37-44
What the analysis did not establish
- Only one file (README.md) was provided; no other source code or binaries were included.
- The artifact explicitly states the complete PoC is not published, so no functional code is available for analysis.
- Only the README.md file was provided; no other files exist in the repository snapshot. The artifact's own statement that the complete PoC is not published is taken at face value, but no evidence of hidden or omitted content is present in the supplied data.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubwebshellseo8/CVE-2026-50522-Proof-of-Concept
Repository PoCStars: 0Created 2026-07-29Model review verdict: Suspicious behavior.WriteupCVE-2026-505221 file
AnalysisSuspicious behavior
Technical assessment
The artifact is a README file that provides a vulnerability overview, technical analysis, and mitigation guidance for CVE-2026-50522. It explicitly states that the complete PoC is not published in the repository and contains no exploit or scanner code.
Backdoor review
Suspicious behaviorThe repository claims to be a Proof of Concept for CVE-2026-50522 but explicitly states 'The complete PoC is not published in this repository.' The only content is a README that directs users to a Telegram channel ('payload withheld') for 'the latest vulnerability research, exploit analysis, Proofs of Concept.' This is a material contradiction: the artifact is presented as a PoC but contains no exploit code, instead serving as a lure to an external, uninspected communication channel. The absence of any PoC code and the redirection to an external channel for the actual exploit is a deceptive practice that creates concern about the operator's intent.
Classification basis and observed behavior
Classification basis
The artifact is a README file containing a vulnerability overview, technical analysis, and mitigation guidance. It explicitly states 'The complete PoC is not published in this repository' and contains no executable code, making it a writeup.
README.md:31README.md:53-57Observed behavior
- The document describes the vulnerability, its CVSS score, and intended use for authorized security research, but does not perform any technical action.
README.md:7-9README.md:15-23
Behaviors behind the backdoor verdict
Flagged behaviors
- The repository is titled 'CVE-2026-50522 – Proof of Concept' but explicitly states 'The complete PoC is not published in this repository.' The artifact contains no exploit code, contradicting its primary advertised purpose and serving only as a lure to an external Telegram channel.
README.md:1README.md:31
- The README contains a prominent call-to-action to join a Telegram channel ('payload withheld') for 'the latest vulnerability research, exploit analysis, Proofs of Concept.' This redirects the operator to an uninspected external resource, which is the only apparent purpose of the repository.
README.md:35-47
Observables
- Url
- Payload withheldA Telegram channel URL promoted as the source for 'the latest vulnerability research, exploit analysis, Proofs of Concept,' serving as the only call-to-action in a repository that lacks any PoC code.
README.md:38-44
What the analysis did not establish
- The evidence consists of a single README.md file; no exploit or scanner source code is present.
- The artifact's claim of containing a 'Technical analysis' cannot be verified as the analysis content is not provided in the evidence.
- The content of the external Telegram channel was not inspected, so the nature of any files or instructions distributed there is unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubwebshellseo8/CVE-2024-1813-Proof-of-Concept
Repository PoCStars: 0Created 2026-07-29WriteupCVE-2024-18131 file
Analysis
Technical assessment
The artifact is a README file that describes CVE-2024-1813, a PHP Object Injection vulnerability in the Simple Job Board WordPress plugin. It provides an overview, intended audience, and expected outcomes for a Proof of Concept, but explicitly states the PoC code is not hosted in the repository. The file contains no exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The repository contains only a README.md file with vulnerability documentation, a Telegram channel link, and a disclaimer. No executable code, payload, or backdoor behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a documentation file (README.md) that provides a technical overview of CVE-2024-1813. It states 'The PoC itself is not hosted in this repository' (line 30) and contains no executable code, making it a writeup rather than an exploit or scanner.
README.md:30Requirements
- Target must be running Simple Job Board plugin version <= 2.11.0
README.md:7 - A suitable POP chain must be present via an additional plugin or theme for high impact
README.md:9
Observed behavior
- Describes the vulnerability and its potential impact, but does not perform any actions
README.md:1-70
Behaviors behind the backdoor verdict
Observables
- External Link
- Payload withheldTelegram channel link for security updates; no backdoor behavior in the artifact itself.
README.md:37-44
What the analysis did not establish
- Evidence consists of a single README.md file; no other source code or files were provided.
- The artifact explicitly states the PoC is not included, so the actual exploit or scanner code is absent.
- Only the README.md file was reviewed; no other files exist in the repository snapshot. The PoC itself is stated to be not hosted in this repository, so its behavior cannot be assessed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubwebshellseo8/CVE-2026-61511-POC
Repository PoCStars: 0Created 2026-07-29Not analyzedCVE-2026-615111 file
GitHubwebshellseo8/CVE-2026-32488-POC
Repository PoCStars: 0Created 2026-06-16WriteupCVE-2026-324881 file
Analysis
Technical assessment
The artifact is a README.md file describing a tool for mass scanning and exploiting CVE-2026-32488 in the UpdraftPlus WordPress plugin. It contains no exploit or scanner code; it only provides a high-level overview, usage instructions, and output descriptions.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a README.md file describing a mass scanner and exploit tool for CVE-2026-32488. The file contains no executable code, no obfuscated payloads, and no instructions for the reviewer to perform harmful actions. It describes normal exploit behavior against the stated target (WordPress User Registration plugin) and includes standard disclaimers. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The only file provided is a README.md that describes a tool's features and usage but contains no executable code, exploit logic, or scanner implementation. It is a substantive technical writeup describing the tool's purpose and operation.
README.md:1-59Requirements
- Target list of URLs in targets.txt
README.md:22-23 - Python 3 and dependencies from requirements.txt
README.md:41-45
Observed behavior
- Describes mass scanning of target lists with concurrent workers
README.md:13 - Describes auto-exploitation of CVE-2026-32488
README.md:14 - Describes credential and role extraction (admin, file-manager, uploader accounts)
README.md:15
Behaviors behind the backdoor verdict
Observables
- Contact Information
- Payload withheldThe README includes contact details for the author, which may be associated with webshell-related activity, but this alone does not constitute backdoor behavior in the reviewed artifact.
README.md:54-55
What the analysis did not establish
- Only the README.md file is included; the actual Python script (CVE-2026-32488 -mass.py) and requirements.txt are not present.
- The artifact describes a tool for UpdraftPlus, but the associated CVE context indicates the vulnerability is in the User Registration plugin, creating a discrepancy in target software.
- Only the README.md file was provided; no source code, scripts, or binary files were included in the evidence packet. The actual behavior of the referenced tool cannot be assessed.
- The analysis scope indicates that no executable source was identified and binary files were not analyzed, so the review is limited to the documentation text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubwebshellseo8/CVE-2026-53787-POC-
Repository PoCStars: 0Created 2026-06-14Not analyzedCVE-2026-537871 file
GitHubwebshellseo8/CVE-2026-1555-POC
Repository PoCStars: 0Created 2026-06-13ScannerCVE-2026-15551 file
Analysis
Technical assessment
The artifact is a README file describing a scanner script for CVE-2026-1555. It provides a command-line usage example that reads a list of targets and saves confirmed vulnerable hosts to a file, indicating a scanning and validation operation rather than a direct exploit.
Backdoor review
Backdoor review undetermined
The supplied evidence consists solely of a README.md file describing a PoC for CVE-2026-1555. The README mentions a Python script (payload withheld) but the script itself is not included in the evidence. Without the actual executable code, it is impossible to determine whether the PoC contains backdoor behavior. The README's description of the exploit target (SP Pagebuilder for Joomla) contradicts the CVE description (WebStack theme for WordPress), which is a material inconsistency but does not, by itself, constitute evidence of a backdoor against the operator. No executable behavior can be reviewed.
Classification basis and observed behavior
Classification basis
The README describes a script that takes a list of targets and outputs 'confirmed shells' to a file, which is characteristic of a vulnerability scanner that validates exposure. The script itself is not provided, but the described behavior is scanning, not direct exploitation.
README.md:22-25Requirements
- A list of target URLs or IPs in a file named targets.txt
README.md:22
Observed behavior
- Executes a Python script that reads targets from a file and saves confirmed vulnerable hosts to webshell.txt
README.md:22-25
Behaviors behind the backdoor verdict
Observables
- Target Mismatch
- Payload withheldThe README title and overview reference a different product and platform than the associated CVE record, indicating a potential misrepresentation or error in the PoC's documentation.
README.md:1README.md:15 - Missing Executable
- Payload withheldThe README references a Python script as the PoC, but this file is not included in the evidence packet, preventing any analysis of its behavior.
README.md:22
What the analysis did not establish
- Only the README.md file is provided; the actual Python script (payload withheld) is not included, so the exact scanning logic cannot be verified.
- The README title references CVE-2026-1555 but the usage example references a different CVE (CVE-2026-48908), creating ambiguity about the target vulnerability.
- The evidence packet contains only the README.md file. The referenced Python script (payload withheld) and any other source files are not included, making a complete review impossible.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubwebshellseo8/CVE-2026-10795-POC
Repository PoCStars: 0Created 2026-06-11ExploitCVE-2026-107952 files
Analysis
Technical assessment
A Python 3 script that exploits CVE-2026-10795 (authentication bypass in UpdraftPlus) to create an administrator account, upload a malicious plugin containing a web shell, and activate it, achieving remote code execution on vulnerable WordPress sites.
Backdoor review
No backdoor observed in reviewed code
The PoC is a mass scanner and auto-exploit for CVE-2026-10795. It exploits an authentication bypass in the UpdraftPlus WordPress plugin to create an administrator account and upload a webshell. All actions are consistent with the disclosed exploit and the tool's documented purpose. No concealed, unrelated, or misrepresented harmful behavior was found.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by forging RPC messages to create an admin user, upload a web shell plugin, and activate it, resulting in remote code execution. It does not merely detect or report the vulnerability.
CVE-2026-10795-mass.py:1-5CVE-2026-10795-mass.py:170-224Requirements
- A list of target URLs in a file (targets.txt).
CVE-2026-10795-mass.py:229-236 - Python 3 with requests, pycryptodome, colorama, and urllib3 libraries.
CVE-2026-10795-mass.py:10-28
Observed behavior
- Sends a forged RPC message to the target's admin-ajax.php endpoint using a zeroed AES key to bypass signature verification.
CVE-2026-10795-mass.py:98-125 - Creates a new administrator user named 'WebshellRS' on the target WordPress site via the 'users.add_user' RPC command.
CVE-2026-10795-mass.py:138-150 - Generates a malicious WordPress plugin ZIP containing a PHP web shell with file upload capability.
CVE-2026-10795-mass.py:63-77 - Uploads the malicious plugin via the 'plugin.upload_plugin' RPC command and activates it via 'plugin.activate_plugin'.
CVE-2026-10795-mass.py:153-167 - Saves the created admin credentials to 'admins.txt' and the web shell URL to 'uploaders.txt'.
CVE-2026-10795-mass.py:200-224
Behaviors behind the backdoor verdict
Observables
- Webshell
- Payload withheldThis is the PHP webshell uploaded to the target as part of the disclosed exploit. It provides a file upload form and is the intended RCE payload.
CVE-2026-10795-mass.py:65-73 - Admin Credentials
- Payload withheldThe PoC creates a hardcoded administrator account on the target. This is the disclosed privilege escalation step of the exploit.
CVE-2026-10795-mass.py:47 - Contact Information
- Payload withheldThe PoC includes contact information for the authors, which is displayed in the banner and embedded in the uploaded webshell. This is not a backdoor indicator.
CVE-2026-10795-mass.py:6-7CVE-2026-10795-mass.py:51
What the analysis did not establish
- The evidence is limited to the source code and README; no runtime output, network captures, or target interaction logs are provided.
- The artifact's behavior is inferred from static analysis of the Python script; no dynamic execution or verification was performed.
- The review is limited to the two provided text files. No external dependencies or network behavior at runtime were analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubwebshellseo8/CVE-2026-48907-Unauthenticated-RCE-in-JCE
Repository PoCStars: 1Created 2026-06-09ScannerCVE-2026-489072 files
Analysis
Technical assessment
A Python mass scanner that checks for CVE-2026-48907 in JCE Joomla by attempting to create a profile, upload a PHP webshell, and verify remote code execution via an HTTP request. It saves only confirmed vulnerable URLs.
Backdoor review
No backdoor observed in reviewed code
The PoC is a mass scanner for CVE-2026-48907 that uploads PHP webshells to vulnerable Joomla JCE targets. All payloads are standard PHP backticks or system() calls consistent with the stated RCE exploit. No concealed operator-directed harm, credential theft, persistence, or unrelated payloads were observed.
Classification basis and observed behavior
Classification basis
The script is described as a 'Mass Scanner' in its docstring and banner. It checks for the vulnerability by attempting exploitation steps (profile import, upload, rename) but its primary stated purpose is to detect and report vulnerable targets, saving only confirmed RCE URLs. It does not provide an interactive shell or post-exploitation capabilities; it validates the vulnerability and exits.
CVE-2026-48907.py:3CVE-2026-48907.py:9CVE-2026-48907.py:230CVE-2026-48907.py:249Requirements
- Target must have JCE extension installed and accessible.
CVE-2026-48907.py:84-91 - Target must expose the JCE proxy endpoint.
CVE-2026-48907.py:93-95 - Target must provide a CSRF token in the homepage or a form.
CVE-2026-48907.py:97-104
Observed behavior
- Checks for JCE presence by requesting known plugin paths and looking for version XML.
CVE-2026-48907.py:25-30CVE-2026-48907.py:84-91 - Imports a malicious JCE profile via XML upload to enable file upload and rename features.
CVE-2026-48907.py:106-132 - Uploads PHP payloads directly as .php files and verifies execution by requesting the file with a command parameter.
CVE-2026-48907.py:159-175 - Uploads GIF payloads as .gif files, then renames them to .php via JSON-RPC and verifies execution.
CVE-2026-48907.py:177-198 - Saves confirmed RCE URLs to an output file.
CVE-2026-48907.py:59-64CVE-2026-48907.py:216-218
Behaviors behind the backdoor verdict
Observables
- Webshell Payload
- Payload withheldStandard PHP backtick webshell used to demonstrate RCE on the target.
CVE-2026-48907.py:33 - Output File
- Payload withheldFile where confirmed RCE URLs are saved; consistent with scanner output.
CVE-2026-48907.py:22 - Contact Info
- Payload withheldAuthor contact information; not a backdoor indicator.
CVE-2026-48907.py:7
What the analysis did not establish
- Evidence is limited to the supplied source code; no runtime behavior or network traffic was observed.
- The artifact is self-described as a PoC and scanner, but classification is based solely on its code and documentation.
- Only the two text files (CVE-2026-48907.py and README.md) were reviewed; no binary or other files were present in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubwebshellseo8/CVE-2026-21628-POC
Repository PoCStars: 0Created 2026-04-02Model review verdict: Suspicious behavior.ExploitCVE-2026-216288 files
AnalysisSuspicious behavior
Technical assessment
Python script that exploits CVE-2026-21628 in Astroid Framework for Joomla to achieve unauthenticated remote code execution by uploading a webshell via the media upload endpoint and optionally using an installTemplate fallback.
Backdoor review
Suspicious behaviorThe PoC exploits CVE-2026-21628 to upload a webshell. It contains a fallback method (installTemplate) that instructs the target server to download and install a ZIP from a hardcoded external URL (payload withheld). The ZIP's contents are not provided for review, and the PoC's own documentation does not disclose that this fallback fetches an uninspected remote payload. This concealment of a critical operator-run code path creates concern, but without the ZIP's contents, concealed harm is not directly established.
Classification basis and observed behavior
Classification basis
The script actively uploads and executes a webshell on a remote target, which constitutes exploitation. It does not merely detect the vulnerability; it performs the full attack chain (upload, rename, verify execution) and includes a fallback exploitation method.
CVE-2026-21628.py:238-297CVE-2026-21628.py:300-333CVE-2026-21628.py:337-349CVE-2026-21628.py:400-454Requirements
- Target must be running a vulnerable version of Astroid Framework (2.0.0-3.3.10) on Joomla.
CVE-2026-21628.py:3 - Target must have the Astroid media upload endpoint accessible at /administrator/index.php.
CVE-2026-21628.py:247-249 - A valid CSRF token must be obtainable from the target's administrator login page.
CVE-2026-21628.py:217-234
Observed behavior
- Fetches a CSRF token from the target's /administrator/ page.
CVE-2026-21628.py:217-234 - Uploads a PHP webshell disguised as an SVG file via the Astroid media upload AJAX endpoint.
CVE-2026-21628.py:238-297 - Renames the uploaded .svg file to .php (or other executable extensions) using the media rename endpoint.
CVE-2026-21628.py:300-333 - Verifies successful webshell execution by checking for a unique marker in the HTTP response.
CVE-2026-21628.py:337-349 - If the primary upload/rename method fails, attempts a fallback installTemplate method that drops a webshell via a malicious ZIP file.
CVE-2026-21628.py:400-454 - Saves successfully exploited URLs to a local file (upload.txt).
CVE-2026-21628.py:457-460
Behaviors behind the backdoor verdict
Flagged behaviors
- The installTemplate fallback method instructs the target server to download and install a ZIP archive from a hardcoded external URL (payload withheld). The contents of this ZIP are not included in the repository, and the PoC's documentation does not disclose that this fallback fetches an uninspected remote payload. The operator cannot review what code will be executed on the target.
CVE-2026-21628.py:160-161CVE-2026-21628.py:400-454
Observables
- Url
- Payload withheldHardcoded external URL used by the installTemplate fallback to fetch a ZIP payload for installation on the target server.
CVE-2026-21628.py:160 - Url
- Payload withheldPromotional link in the script's docstring and README, indicating the author's commercial interest in webshells.
CVE-2026-21628.py:9README.md:4
What the analysis did not establish
- Six binary files (shell.phar, shell.php, shell.php5, shell.php7, shell.php8, shell.phtml) were not inspected; their content is unknown.
- The evidence packet reports complete_artifact_coverage as false, indicating not all files in the repository were included in the analysis.
- The contents of the remote ZIP archive at payload withheld are not included in the repository and were not reviewed.
- Six binary files (shell.phar, shell.php, shell.php5, shell.php7, shell.php8, shell.phtml) were flagged as binary and not analyzed; their content is unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.