dzmind2312
Source-scoped identity with 3 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubdzmind2312/CVE_2026_25892
Repository PoCStars: 0Created 2026-02-26ExploitUnlinked3 files
Analysis
Technical assessment
The artifact is a Python script that sends a crafted POST request with an array parameter to trigger a persistent denial-of-service condition in Adminer <= 5.4.1. It includes a Nuclei template for detection and a README with usage instructions.
Backdoor review
No backdoor observed in reviewed code
The repository contains a PoC exploit for CVE-2026-25892, a DoS vulnerability in Adminer. The Python script sends a crafted POST request to trigger a server error. No backdoor, deceptive payload, or concealed operator-directed harm is observed. The code performs only the described vulnerability check and exploitation.
Classification basis and observed behavior
Classification basis
The Python script actively sends a malicious payload to trigger a vulnerability, which constitutes exploitation. The script's own description calls it an 'exploit' and its primary function is to cause a persistent DoS, not merely detect the vulnerability.
CVE_2026_25892.py:6CVE_2026_25892.py:16-19CVE_2026_25892.py:106-113Requirements
- Target must be running Adminer version 4.6.2 to 5.4.1
CVE-2026-25892.yaml:65-66 - Attacker must know the URL path where Adminer is installed
CVE_2026_25892.py:21-34
Observed behavior
- Sends a POST request to the target's version endpoint with 'version[]' parameter to cause a type confusion error
CVE_2026_25892.py:131CVE_2026_25892.py:147-152 - Verifies the denial-of-service by checking for HTTP 500 status or error signatures in the response
CVE_2026_25892.py:160-167 - Supports mass scanning of multiple targets with multi-threading and saves vulnerable targets to a file
CVE_2026_25892.py:191-234
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the core exploit action for the claimed CVE-2026-25892 vulnerability.
CVE_2026_25892.py:131CVE_2026_25892.py:147-152 - Network Communication
- Payload withheldThe script communicates only with the target specified by the user, which is standard for a PoC exploit.
CVE_2026_25892.py:138CVE_2026_25892.py:147-152 - File Creation
- Payload withheldThis is a benign output file for saving scan results.
CVE_2026_25892.py:232-234
What the analysis did not establish
- The evidence includes a Nuclei template (CVE-2026-25892.yaml) that only detects the Adminer version and does not exploit the vulnerability, but the primary artifact is the Python exploit script.
- The README.md file is truncated at line 101, so the full documentation is not available.
- Only the three text files in the repository were reviewed; no binary files were present or analyzed.
- The review is based solely on static analysis of the provided source code; dynamic behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubdzmind2312/CVE-2024-34444-Exploit-Poc
Repository PoCStars: 0Created 2026-02-15ScannerCVE-2024-344442 files
Analysis
Technical assessment
The artifact is a mass scanner for CVE-2024-34444, a missing authorization vulnerability in the Slider Revolution WordPress plugin. It detects vulnerable installations by extracting a nonce and checking the REST API endpoint, but does not perform exploitation or modification of slider data.
Backdoor review
Backdoor review undetermined
The supplied evidence consists solely of a README.md file describing a scanner for CVE-2024-34444. The actual exploit code (payload withheld) is not included in the reviewable text, making it impossible to determine whether the scanner contains backdoor or deceptive behavior.
Classification basis and observed behavior
Classification basis
The README explicitly describes the tool as a 'Professional mass scanner' that 'automates the detection' of vulnerable installations. It outlines a vulnerability chain but states the scanner's purpose is detection, not exploitation. No exploit code is provided in the evidence.
README.md:1README.md:8README.md:14Requirements
- Target must be running a vulnerable version (< 6.7.0) of the Slider Revolution WordPress plugin with the REST API endpoint accessible.
README.md:14
Observed behavior
- Extracts a nonce from the frontend to bypass REST API authentication.
README.md:26-27 - Scans single or multiple targets using multi-threading and outputs results to a file.
README.md:60-73
Behaviors behind the backdoor verdict
Observables
- Missing Evidence
- Payload withheldThe README references and provides usage instructions for payload withheld, but the file content is not included in the evidence packet. The behavior of the scanner cannot be assessed.
README.md:61-73
What the analysis did not establish
- Only the README.md file is included; the actual Python script (payload withheld) and other files are omitted, so the scanner's implementation cannot be verified.
- The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository are present.
- Only the README.md file was provided for review. The payload withheld file and any other source files are omitted from the evidence packet.
- The analysis scope indicates 1 unclassified file (14789 bytes) and 1 text file without content, which likely includes the missing payload withheld.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.