rxerium
Source-scoped identity with 39 associated PoCs and 45 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
GitHubrxerium/CVE-2025-52691
Repository PoCStars: 19Created 2025-12-30ScannerCVE-2025-526913 files
Analysis
Technical assessment
A Nuclei template and README that detect SmarterMail instances vulnerable to CVE-2025-52691 by checking the build version via a GET request and regex extraction. No exploit code is present.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Nuclei template (payload withheld) and a README.md for detecting a SmarterMail arbitrary file upload vulnerability. The template performs a benign GET request to fingerprint the target and extract version information; it does not execute any exploit, upload files, or establish remote access. The README provides usage instructions and contact links but contains no hidden commands, obfuscated payloads, or instructions to execute untrusted code. No backdoor, trojan, or deceptive behavior is present in the reviewed text files.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs version detection and comparison to identify vulnerable SmarterMail instances. It does not contain any code to upload files or execute commands; it only reports whether a target matches the vulnerable version criteria. The README explicitly describes it as a 'detection method' and 'vulnerability detection script'.
CVE-2025-52691.yaml:1-64README.md:5-7README.md:50Requirements
- Target must be running SmarterMail with the /interface/root#/login endpoint accessible.
CVE-2025-52691.yaml:28-29
Observed behavior
- Sends a GET request to the target's /interface/root#/login path.
CVE-2025-52691.yaml:27-29 - Checks if the response body contains 'ng-app="smartermail"' and returns HTTP status 200.
CVE-2025-52691.yaml:33-40 - Extracts the build number from the stProductVersion JavaScript variable using regex.
CVE-2025-52691.yaml:54-60 - Flags the target as vulnerable if the extracted build number is less than or equal to 9406.
CVE-2025-52691.yaml:42-44
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- Payload withheldThe template sends a GET request to /interface/root#/login and uses matchers and extractors to identify SmarterMail and its build version. It does not perform any write, upload, or command execution actions.
CVE-2025-52691.yaml:26-64 - Contact Method
- Payload withheldThe README provides a Signal contact link for questions. The link itself is not executed by the artifact and does not constitute a backdoor.
README.md:50
What the analysis did not establish
- One file (LICENSE) was omitted from the evidence, but it is unlikely to contain exploit code.
- The evidence does not include the actual execution output of the template, only its static definition.
- One file (LICENSE) was omitted from the text content and not reviewed; its metadata indicates it is a text file but its content was not supplied.
- The review is limited to the static content of the provided text files; no dynamic or runtime behavior was analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-68613
Repository PoCStars: 28Created 2025-12-22ScannerCVE-2025-686133 files
Analysis
Technical assessment
A Nuclei template that detects vulnerable n8n instances by extracting the version from a base64-encoded meta tag on the /signin page and comparing it against known vulnerable version ranges for CVE-2025-68613.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Nuclei template (payload withheld) and a README.md file. The template performs a GET request to /signin, extracts a base64-encoded configuration value, decodes it, extracts a version string, and compares it against known vulnerable version ranges. The README provides usage instructions and contact information. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs version detection and comparison to identify vulnerable instances. It does not contain any code to exploit the vulnerability, such as sending a malicious payload or executing commands. The README describes it as a 'detection method' and 'vulnerability detection script'.
CVE-2025-68613.yaml:1-62README.md:5-7README.md:47Requirements
- Target must be running a reachable n8n instance with the /signin endpoint accessible.
CVE-2025-68613.yaml:19-21
Observed behavior
- Sends an HTTP GET request to the /signin path of the target.
CVE-2025-68613.yaml:18-21 - Extracts a base64-encoded string from the 'n8n:config:sentry' meta tag in the response body.
CVE-2025-68613.yaml:23-29 - Decodes the base64 string and extracts the n8n version number using a regex.
CVE-2025-68613.yaml:31-41 - Compares the extracted version against known vulnerable ranges (>= 0.211.0 < 1.120.4 or >= 1.121.0 < 1.121.1) and reports the target as vulnerable if it matches.
CVE-2025-68613.yaml:59-62 - Outputs the detected n8n version string.
CVE-2025-68613.yaml:43-45
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- Payload withheldThe template performs version detection for CVE-2025-68613 by extracting and decoding a meta tag value and comparing the version against vulnerable ranges. This is normal exploit behavior for a detection template.
CVE-2025-68613.yaml:18-62 - Contact Information
- Payload withheldThe README includes contact information for the author. This is not a backdoor or harmful behavior.
README.md:45-49
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository were included. One file was omitted from the packet (files_total: 3, file_metadata_included: 2, file_metadata_omitted: 1). The content of the omitted file is unknown.
- The analysis is based solely on the provided text files; no code was executed, and the behavior described is inferred from the template logic.
- One file (LICENSE) was present in the repository but not included in the text evidence; its content is standard metadata and unlikely to contain a backdoor.
- The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-68461
Repository PoCStars: 16Created 2025-12-19ScannerCVE-2025-684613 files
Analysis
Technical assessment
A Nuclei template that detects vulnerable Roundcube Webmail instances by extracting the version from the 'rcversion' JSON field and comparing it against known vulnerable ranges (<1.5.12 or 1.6.0-1.6.11). It does not exploit the XSS vulnerability.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Nuclei template (CVE-2025-68461.yaml) and a README.md file for a CVE-2025-68461 detection script. The template performs a standard version-based vulnerability check against Roundcube Webmail by extracting the 'rcversion' field and comparing it to known vulnerable ranges. No backdoor, deceptive payload, or concealed executable behavior is present in the reviewed text. The README provides usage instructions and contact information, which is normal for a public PoC repository.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs version detection and comparison to identify vulnerable instances. It does not contain any code to inject or execute a payload, steal cookies, or otherwise exploit the XSS vulnerability. The README explicitly describes it as a 'detection method' and 'vulnerability detection script'.
CVE-2025-68461.yaml:1-75README.md:5-7README.md:50Requirements
- Target must be running Roundcube Webmail and expose the 'rcversion' field in its HTTP response body.
CVE-2025-68461.yaml:34CVE-2025-68461.yaml:70-71
Observed behavior
- Sends an HTTP GET request to the target base URL.
CVE-2025-68461.yaml:25-27 - Extracts the major, minor, and patch version numbers from the 'rcversion' JSON field using regex.
CVE-2025-68461.yaml:30-49 - Constructs a version string in the format 'major.minor.patch'.
CVE-2025-68461.yaml:51-54 - Checks if the extracted version is less than 1.5.12 or between 1.6.0 and 1.6.11 (inclusive).
CVE-2025-68461.yaml:63-66 - Matches the response body for the word 'Roundcube' and checks for HTTP status 200.
CVE-2025-68461.yaml:68-75 - Reports the detected Roundcube version.
CVE-2025-68461.yaml:57-59
Behaviors behind the backdoor verdict
Observables
- Contact Information
- Payload withheldThe README includes author contact details, which is typical for open-source projects and does not constitute a backdoor or deceptive payload.
README.md:50-52
What the analysis did not establish
- One file (total 3 files in artifact, 2 provided as text) was omitted from the evidence packet; its content is unknown.
- The evidence packet reports complete_artifact_coverage as false, so the full artifact content is not available for analysis.
- One file (metadata only, not analyzed) was omitted from the text evidence; its content is unknown.
- Binary content, if any, was not inspected per the evidence envelope policy.
- The review is limited to the supplied text; no execution or dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-37164
Repository PoCStars: 3Created 2025-12-18ScannerCVE-2025-371643 files
Analysis
Technical assessment
A Nuclei template that detects potentially vulnerable HPE OneView instances by checking for the OneView title tag, extracting the version, and flagging versions below 11.00. It does not exploit the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Nuclei template (payload withheld) and a README.md file. The template performs a benign GET request to the target, extracts a version string from the response body, and uses a DSL matcher to compare the version against '<11.00'. No malicious, deceptive, or concealed executable behavior is present. The README provides usage instructions and contact information, none of which constitutes a backdoor or trojan.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs version detection and comparison to identify potentially vulnerable instances. It does not contain any code to execute commands, inject code, or otherwise exploit the vulnerability. The README explicitly states it is a 'vulnerability detection script' and warns that flagged instances are only 'possibly vulnerable'.
CVE-2025-37164.yaml:1-56README.md:7-9Requirements
- Target must be running HPE OneView and respond to HTTP GET requests.
CVE-2025-37164.yaml:26-28
Observed behavior
- Sends an HTTP GET request to the target base URL.
CVE-2025-37164.yaml:26-28 - Extracts the version string from the JavaScript variable 'artifactVersion' in the response body.
CVE-2025-37164.yaml:30-37 - Matches if the HTTP status is 200, the response body contains '<title>OneView', and the extracted version is less than 11.00.
CVE-2025-37164.yaml:43-56
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- Payload withheldThe template sends a single GET request to the target, extracts a version via regex, and compares it to '<11.00' using a DSL matcher. This is standard vulnerability detection behavior.
CVE-2025-37164.yaml:25-56 - Contact Information
- Payload withheldThe README includes contact links for the author. These are standard for open-source projects and do not indicate backdoor behavior.
README.md:50-52
What the analysis did not establish
- One file (LICENSE) was omitted from the text content; it is unlikely to contain exploit code.
- The evidence does not include the actual execution of the template, only its static definition.
- One file (likely an image) was omitted from text analysis and is flagged as metadata-only; its content was not inspected.
- The review is limited to the supplied evidence and does not verify the safety of external dependencies (e.g., Nuclei itself) or the target application.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-40602
Repository PoCStars: 3Created 2025-12-18ScannerCVE-2025-406023 files
Analysis
Technical assessment
A Nuclei template and README that detect vulnerable versions of SonicWall SMA 1000 by checking the Server header and page content. It does not exploit the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Nuclei template for detecting CVE-2025-40602 and a README. The template performs standard HTTP GET requests to identify vulnerable SonicWall SMA 1000 versions via Server header and body content matching. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that sends an HTTP GET request, extracts version information, and compares it against known vulnerable ranges. It does not contain any code to exploit the vulnerability (e.g., no privilege escalation payloads, no command execution). The README explicitly describes it as a 'detection method' and a 'vulnerability detection script'.
CVE-2025-40602.yaml:1-70README.md:5-9Requirements
- Target must expose the Appliance Management Console login page over HTTP/HTTPS.
CVE-2025-40602.yaml:28-30 - Target must return a Server header containing a SMA version string.
CVE-2025-40602.yaml:40-46
Observed behavior
- Sends an HTTP GET request to /login.action.
CVE-2025-40602.yaml:28-30 - Extracts the Server header value.
CVE-2025-40602.yaml:33-38 - Extracts the SMA version from the Server header using regex.
CVE-2025-40602.yaml:40-46 - Checks if the response body contains the string "<title>Appliance Management Console Login".
CVE-2025-40602.yaml:51-54 - Checks if the HTTP status code is 200.
CVE-2025-40602.yaml:56-58 - Compares the extracted version against known vulnerable ranges (<= 12.4.3-03093 and <= 12.5.0-02002).
CVE-2025-40602.yaml:60-70 - Reports a match if all conditions are met, indicating a potentially vulnerable system.
CVE-2025-40602.yaml:49-70
Behaviors behind the backdoor verdict
Observables
- Network Request
- Payload withheldStandard Nuclei template request to identify the target appliance login page.
CVE-2025-40602.yaml:28-30 - Version Extraction
- Payload withheldExtracts SMA version from the Server header for vulnerability matching.
CVE-2025-40602.yaml:40-46 - Version Comparison
- Payload withheldDSL matcher to flag vulnerable 12.4.3 builds.
CVE-2025-40602.yaml:65 - Version Comparison
- Payload withheldDSL matcher to flag vulnerable 12.5.0 builds.
CVE-2025-40602.yaml:69 - Contact Information
- Payload withheldREADME provides a Signal contact link for questions about the detection script.
README.md:48
What the analysis did not establish
- One file (LICENSE) is omitted from the evidence, but it is unlikely to contain exploit code.
- The evidence does not include the execution output of the template, so the scanner's effectiveness is not verified.
- One file (LICENSE) was omitted from the text evidence; its content is not reviewed.
- Binary files were not present in the evidence.
- The review is limited to the supplied text content and does not assess the safety of external links or the Nuclei engine itself.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/FreePBX-Vulns-December-25
Repository PoCStars: 48Created 2025-12-15ScannerCVE-2025-61675CVE-2025-61678CVE-2025-660395 files
Analysis
Technical assessment
The artifact is a set of Nuclei templates and a README that detect vulnerable FreePBX instances by extracting the version from the admin panel and comparing it against known vulnerable ranges. It does not contain exploit code.
Backdoor review
No backdoor observed in reviewed code
The repository contains three Nuclei templates and a README for detecting known FreePBX vulnerabilities (CVE-2025-61675, CVE-2025-61678, CVE-2025-66039). The templates perform only version detection via HTTP GET requests and regex matching; they do not execute any exploit payloads, upload files, or establish remote access. No concealed, deceptive, or operator-directed harmful behavior is present in the reviewed text files.
Classification basis and observed behavior
Classification basis
The templates only perform version detection and matching; they do not send any payloads to trigger SQL injection, file upload, or authentication bypass. The README confirms the detection is non-invasive and does not attempt exploitation.
CVE-2025-61675.yaml:24-52README.md:26Requirements
- Target must expose the FreePBX administration panel at /admin/config.php.
CVE-2025-61675.yaml:26 - Nuclei scanner must be installed to execute the templates.
README.md:31
Observed behavior
- Sends a GET request to /admin/config.php to retrieve the page body.
CVE-2025-61675.yaml:24-26 - Extracts the FreePBX version string using a regex.
CVE-2025-61675.yaml:28-34 - Matches the response status (200) and body content (FreePBX Administration, Operator Panel, User Control Panel).
CVE-2025-61675.yaml:36-48 - Compares the extracted version against vulnerable version ranges using DSL.
CVE-2025-61675.yaml:50-52 - README explicitly states the detection is non-invasive and does not attempt exploitation.
README.md:26
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- Payload withheldTemplate performs version detection only; no exploit payload or backdoor behavior.
CVE-2025-61675.yaml:24-52 - Nuclei Template
- Payload withheldTemplate performs version detection only; no exploit payload or backdoor behavior.
CVE-2025-61678.yaml:24-52 - Nuclei Template
- Payload withheldTemplate performs version detection only; no exploit payload or backdoor behavior.
CVE-2025-66039.yaml:24-52 - Contact Information
- Payload withheldAuthor contact information is present but does not constitute backdoor behavior.
README.md:76-78
What the analysis did not establish
- One file (LICENSE) is omitted from the text content; its absence does not affect classification as it is not a code or behavior file.
- The evidence does not include any exploit payloads or proof of exploitation; classification is based solely on the provided scanner templates and documentation.
- One file (LICENSE) was omitted from the text evidence; its content was not reviewed.
- Binary content was not present in the evidence packet.
- The review is limited to the supplied text evidence and does not assess the safety of external links or the Nuclei framework itself.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-58360
Repository PoCStars: 0Created 2025-12-12ScannerCVE-2025-583603 files
Analysis
Technical assessment
A Nuclei template that detects potentially vulnerable GeoServer instances by checking the Last-Modified header of a static resource and comparing it to a date threshold, without exploiting the XXE vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Nuclei detection template and a README for CVE-2025-58360. The template performs a benign GET request to fetch a logo image and checks the response status, body hash, and a header timestamp to identify potentially vulnerable GeoServer instances. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs passive detection based on HTTP headers and a date comparison. It does not send an XML payload, define external entities, or attempt to read local files, which would be required for an exploit. The README describes it as a 'detection script'.
CVE-2025-58360.yaml:1-48README.md:7Requirements
- Target must be running GeoServer and expose the /geoserver/web/ or /web/ path.
CVE-2025-58360.yaml:20-21
Observed behavior
- Sends an HTTP GET request to fetch a logo image from the target GeoServer instance.
CVE-2025-58360.yaml:18-21 - Extracts the Last-Modified header from the response.
CVE-2025-58360.yaml:23-28 - Converts the extracted date to a Unix timestamp.
CVE-2025-58360.yaml:30-34 - Matches if the response status is 200, the body matches a specific SHA-256 hash, and the timestamp is before November 28, 2025.
CVE-2025-58360.yaml:36-48
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldTarget path used in the Nuclei template to identify GeoServer instances.
CVE-2025-58360.yaml:20 - Url
- Payload withheldAlternative target path used in the Nuclei template.
CVE-2025-58360.yaml:21 - Hash
- Payload withheldExpected SHA-256 hash of the logo image body used for GeoServer identification.
CVE-2025-58360.yaml:44 - Contact
- Payload withheldContact method provided in the README for questions about the script.
README.md:44
What the analysis did not establish
- One file (LICENSE) was omitted from the evidence; its content is not material to the classification.
- The evidence does not include the execution output of the template, so the detection logic is assessed solely from the static YAML definition.
- One file (LICENSE) was omitted from the text evidence; its content is not reviewed.
- Binary content is not present in the evidence.
- The review is limited to the supplied text; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-8110
Repository PoCStars: 22Created 2025-12-11ScannerCVE-2025-81103 files
Analysis
Technical assessment
A Nuclei template that detects Gogs instances vulnerable to CVE-2025-8110 by extracting the version from the login page and comparing it to <= 0.13.3. It does not exploit the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The artifact is a Nuclei detection template and README for CVE-2025-8110. The template performs a version check against a Gogs login page; the README provides documentation and usage instructions. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs version-based detection of a vulnerable Gogs instance. It does not contain any code to exploit the symlink vulnerability or achieve code execution; it only checks the version and reports a match.
CVE-2025-8110.yaml:1-37README.md:7Requirements
- Target must be running Gogs with a reachable /user/login endpoint.
CVE-2025-8110.yaml:14-16
Observed behavior
- Sends an HTTP GET request to /user/login.
CVE-2025-8110.yaml:14-16 - Extracts the Gogs version string from the response body using a regex.
CVE-2025-8110.yaml:18-23 - Matches if the response contains 'Sign In - Gogs: Go Git Service', returns status 200, and the extracted version is <= 0.13.3.
CVE-2025-8110.yaml:25-37
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- Payload withheldA Nuclei template that sends a GET request to /user/login, extracts the Gogs version via regex, and matches on version <= 0.13.3. This is standard vulnerability detection behavior.
CVE-2025-8110.yaml:1-37 - Contact Information
- Payload withheldThe README includes contact links for the author. This is typical for open-source projects and does not constitute a backdoor.
README.md:44-48
What the analysis did not establish
- One text file (likely LICENSE) was omitted from the packet content, but it is not material to the classification.
- The artifact's detection logic relies solely on version comparison; it does not verify the actual presence of the symlink vulnerability.
- One file (total 3) was omitted from text content; its metadata indicates it is a non-text file (likely an image) and was not analyzed.
- Binary content, if any, was not inspected per the evidence envelope's binary policy.
- The review is limited to the supplied text evidence and does not assess the safety of external links or referenced tools.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-34299
Repository PoCStars: 0Created 2025-11-11ScannerCVE-2025-342993 files
Analysis
Technical assessment
A Nuclei template that detects Monsta FTP instances vulnerable to CVE-2025-34299 by checking the HTTP response for a title tag, extracting the version, and comparing it to < 2.11. It does not upload files or execute code.
Backdoor review
No backdoor observed in reviewed code
The artifact contains a Nuclei detection template (payload withheld) and a README.md. The template performs a GET request to identify Monsta FTP instances and compares the extracted version against 2.11. The README provides usage instructions and references. No backdoor, deceptive payload, or concealed harmful behavior is observed in the supplied text.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs version detection via HTTP response matching. It does not contain any code to upload files, execute commands, or otherwise exploit the vulnerability. The README explicitly describes it as a 'detection template' and 'vulnerability detection script'.
CVE-2025-34299.yaml:1-36README.md:5-7README.md:43Requirements
- Target must be running Monsta FTP and accessible via HTTP.
CVE-2025-34299.yaml:12-15
Observed behavior
- Sends an HTTP GET request to the target base URL.
CVE-2025-34299.yaml:13-15 - Extracts the Monsta FTP version from the HTML title tag using a regex.
CVE-2025-34299.yaml:17-22 - Matches if the response contains '<title>Monsta FTP', returns status 200, and the extracted version is less than 2.11.
CVE-2025-34299.yaml:24-36
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- Payload withheldDetection template for CVE-2025-34299; performs version detection only.
CVE-2025-34299.yaml:1-36 - Contact Method
- Payload withheldAuthor contact information in README; not a backdoor indicator.
README.md:43
What the analysis did not establish
- One file (likely .gitkeep or similar) is omitted from the text evidence; its metadata indicates it is not a text file and is not analyzed.
- The evidence does not include the actual execution of the template; classification is based solely on static analysis of the provided YAML and README.
- One file (metadata only, not analyzed) was omitted from the text evidence; its content is unknown.
- Binary content was not inspected; the analysis is limited to the supplied readable text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-53072-CVE-2025-62481
Repository PoCStars: 4Created 2025-10-22ScannerCVE-2025-53072CVE-2025-624813 files
Analysis
Technical assessment
A Nuclei template (referenced but not included) and README documentation for detecting Oracle E-Business Suite instances likely vulnerable to CVE-2025-53072 and CVE-2025-62481 by checking the Last-Modified header date against the patch date and identifying the home page content.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a README.md file describing a Nuclei template for detecting vulnerable Oracle E-Business Suite instances. The text contains no executable code, no obfuscated payloads, no instructions to download or run anything beyond the publicly available Nuclei scanner, and no deceptive behavior. The README provides documentation, usage instructions, references, a disclaimer, and contact information, all of which are consistent with a legitimate proof-of-concept detection script.
Classification basis and observed behavior
Classification basis
The artifact describes a Nuclei template that checks for vulnerability indicators (Last-Modified header date, page content) without performing any exploitation actions. The README explicitly states it is a 'script to fingerprint devices that are "likely" vulnerable... not confirmed vulnerable', which is characteristic of a scanner.
README.md:7Requirements
- Nuclei scanner must be installed.
README.md:11 - Target Oracle E-Business Suite instance must be network accessible via HTTP.
README.md:15
Observed behavior
- Sends HTTP requests to the target to retrieve the Last-Modified header and page content.
README.md:7 - Checks if the Last-Modified header indicates a build date before October 21, 2025.
README.md:7 - Identifies the E-Business Suite home page content and a 200 status response.
README.md:7 - Reports instances that are likely vulnerable based on the header and content checks.
README.md:7
Behaviors behind the backdoor verdict
Observables
- Contact Method
- Payload withheldThe README provides a Signal contact link for questions about the detection script. This is a standard practice in security research and does not constitute a backdoor or malicious instruction.
README.md:46 - Social Media Link
- Payload withheldThe README includes links to the author's social media profiles. This is normal for open-source projects and does not indicate malicious intent.
README.md:48
What the analysis did not establish
- The actual Nuclei template file (template.yaml) is not included in the evidence; only the README.md is provided.
- The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository are present.
- Only the README.md file content was provided; two other files in the repository (totaling 2278 bytes) were omitted and classified as unclassified. Their content is unknown, but the analysis routing indicates no executable source was identified in the artifact.
- The actual Nuclei template file (template.yaml) referenced in the README is not included in the evidence, so its contents cannot be reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-11371
Repository PoCStars: 5Created 2025-10-10ScannerCVE-2025-113713 files
Analysis
Technical assessment
A Nuclei template that detects CVE-2025-11371 by fetching the CentreStack login page, extracting the build version via regex, and comparing it against the vulnerable version range.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Nuclei detection template for CVE-2025-11371 and a README. The template performs a benign GET request to a login page, extracts a version string, and compares it to a known vulnerable version. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that only detects the presence of a vulnerable version by checking the login page and comparing the build number. It does not include any code to read or exfiltrate local files, which would be required for an exploit. The README explicitly describes it as a detection script.
CVE-2025-11371.yaml:1-43README.md:7Requirements
- Target must be running Gladinet CentreStack or TrioFox with a reachable login page.
CVE-2025-11371.yaml:18
Observed behavior
- Sends an HTTP GET request to /portal/loginpage.aspx.
CVE-2025-11371.yaml:16-18 - Extracts the build version from the response body using the regex '\(Build\s+([0-9.]+)\)'.
CVE-2025-11371.yaml:22-28 - Checks if the response body contains 'CentreStack - Login'.
CVE-2025-11371.yaml:32-35 - Compares the extracted version to determine if it is <= 16.7.10368.56560.
CVE-2025-11371.yaml:37-39 - Reports the target as vulnerable if all matchers succeed.
CVE-2025-11371.yaml:30-43
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldTarget path used by the Nuclei template to detect the vulnerable application.
CVE-2025-11371.yaml:18 - Regex
- Payload withheldRegex used to extract the build version from the response body for vulnerability comparison.
CVE-2025-11371.yaml:28 - Version Comparison
- Payload withheldDSL matcher that checks if the extracted version is vulnerable.
CVE-2025-11371.yaml:39
What the analysis did not establish
- One file (likely an image) was omitted from the evidence packet, but the README and YAML template are complete and sufficient for classification.
- One text file (likely a license) was omitted from content review; its metadata shows 1073 bytes and no indication of executable behavior.
- The review covers only the supplied text evidence and does not inspect the referenced external image or links.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-61882-CVE-2025-61884
Repository PoCStars: 36Created 2025-10-05ScannerCVE-2025-61882CVE-2025-618844 files
Analysis
Technical assessment
Nuclei templates that detect potentially vulnerable Oracle E-Business Suite instances by checking for a specific body string and comparing the Last-Modified header date against a patch timestamp. No exploitation code is present.
Backdoor review
No backdoor observed in reviewed code
The repository contains two Nuclei detection templates and a README. The templates perform passive HTTP GET requests, extract the Last-Modified header, convert it to a Unix timestamp, and compare it against a fixed date to determine if an Oracle E-Business Suite instance is potentially unpatched. No backdoor, deceptive payload, or concealed operator-directed harm is present in the reviewed text files.
Classification basis and observed behavior
Classification basis
The YAML files are Nuclei templates that only perform detection by matching response characteristics and comparing dates. They do not contain any code to exploit the vulnerability, execute commands, or gain unauthorized access. The README explicitly describes them as 'detection templates'.
CVE-2025-61882.yaml:4README.md:10Requirements
- Target must be an Oracle E-Business Suite instance serving the 'E-Business Suite Home Page' string in the response body.
CVE-2025-61882.yaml:33-35 - Target must return a Last-Modified header with a date before the patch cutoff (Unix timestamp 1759602752 for CVE-2025-61882, 1760198400 for CVE-2025-61884).
CVE-2025-61882.yaml:37-39CVE-2025-61884.yaml:37-39
Observed behavior
- Sends an HTTP GET request to the target base URL.
CVE-2025-61882.yaml:14-16 - Extracts the Last-Modified header value and converts it to a Unix timestamp.
CVE-2025-61882.yaml:18-28 - Matches if the response body contains 'E-Business Suite Home Page', the converted timestamp is less than the patch cutoff, and the HTTP status is 200.
CVE-2025-61882.yaml:30-43
Behaviors behind the backdoor verdict
Observables
- Network Request
- Payload withheldThe templates issue a single HTTP GET request to the target to retrieve headers and body for version fingerprinting.
CVE-2025-61882.yaml:14-16CVE-2025-61884.yaml:14-16 - Date Comparison
- Payload withheldCVE-2025-61882 template checks if the Last-Modified date is before October 4, 2025, indicating a potentially unpatched instance.
CVE-2025-61882.yaml:37-39 - Date Comparison
- Payload withheldCVE-2025-61884 template checks if the Last-Modified date is before October 11, 2025, indicating a potentially unpatched instance.
CVE-2025-61884.yaml:37-39 - Contact Information
- Payload withheldThe README provides a Signal contact link for questions; this is author contact information and not a backdoor indicator.
README.md:48
What the analysis did not establish
- One file (LICENSE) was omitted from the packet and not analyzed.
- The detection logic relies on the Last-Modified header as a proxy for patch status, which may produce false positives or negatives if the header is not updated consistently with patching.
- One text file (LICENSE) was omitted from the packet and not reviewed; its content is unknown.
- One binary file (unclassified, 1073 bytes) was flagged as metadata-only and not analyzed; its content is unknown.
- The review is limited to the supplied evidence and does not assess the safety of external links (e.g., Signal, Twitter, LinkedIn) or the Nuclei tool itself.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-41244
Repository PoCStars: 1Created 2025-09-30ScannerCVE-2025-412443 files
Analysis
Technical assessment
A Nuclei template that detects VMware Aria Operations instances by checking for a specific response body string and HTTP 200 status, then extracts a version number and compares it to a vulnerable range (< 8.18.5).
Backdoor review
No backdoor observed in reviewed code
The repository contains a Nuclei template for detecting CVE-2025-41244 and a README with usage instructions. The template performs a benign GET request to identify VMware Aria Operations instances and extract version information. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text files.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs version detection and comparison to identify vulnerable VMware Aria Operations instances. It does not contain any code to exploit the vulnerability or gain elevated privileges; it only checks for the presence and version of the software.
CVE-2025-41244.yaml:1-38README.md:1-3Requirements
- Target URL must be reachable and respond to GET /ui/login.action?vcf=1
CVE-2025-41244.yaml:14-16
Observed behavior
- Sends an HTTP GET request to payload withheld
CVE-2025-41244.yaml:14-16 - Extracts a version string from the response body using regex ?version=([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)
CVE-2025-41244.yaml:18-24 - Matches if the response body contains 'VMware Aria Operations', the HTTP status is 200, and the extracted version is less than 8.18.5
CVE-2025-41244.yaml:26-38
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldTarget path used by the Nuclei template to probe for the vulnerable application.
CVE-2025-41244.yaml:16 - Regex
- Payload withheldRegex used to extract the version string from the response body for version comparison.
CVE-2025-41244.yaml:22 - Dsl Expression
- Payload withheldDSL matcher that checks if the extracted version is below the vulnerable threshold.
CVE-2025-41244.yaml:38
What the analysis did not establish
- One file (unclassified, 1073 bytes) was omitted from analysis; its content is unknown.
- The artifact does not include any exploit code; it only detects potentially vulnerable versions.
- One file (metadata only, not supplied as text) was omitted from the review; its content is unknown.
- Binary content was not present in the supplied evidence.
- The review is limited to the static content of the provided text files and does not include dynamic analysis or execution.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-26399
Repository PoCStars: 2Created 2025-09-23ScannerCVE-2025-263993 files
Analysis
Technical assessment
A Nuclei template that detects SolarWinds Web Help Desk instances vulnerable to CVE-2025-26399 by checking the version string extracted from the login page.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Nuclei detection template and a README. The template performs a read-only HTTP GET to identify SolarWinds Web Help Desk instances and extract a version string for comparison. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs version-based detection of a vulnerable instance. It does not contain any code to exploit the deserialization vulnerability or execute commands; it only checks for the presence of the software and its version.
CVE-2025-26339.yaml:1-52README.md:5Requirements
- Target must be running SolarWinds Web Help Desk and expose the login page at /helpdesk/WebObjects/Helpdesk.woa.
CVE-2025-26339.yaml:20
Observed behavior
- Sends an HTTP GET request to the target's Helpdesk login page.
CVE-2025-26339.yaml:18-20 - Extracts a build token from the response body using a regex pattern.
CVE-2025-26339.yaml:26-32 - Converts the build token into a version string by replacing underscores with dots.
CVE-2025-26339.yaml:35-38 - Matches the response if it contains specific product identifiers and the extracted version is less than 12.8.7.0.
CVE-2025-26339.yaml:40-52
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldTarget path used by the Nuclei template to detect the application.
CVE-2025-26339.yaml:20 - Regex
- Payload withheldRegex used to extract a build token from the response body for version comparison.
CVE-2025-26339.yaml:32 - Dsl Expression
- Payload withheldVersion check that flags instances older than the patched release.
CVE-2025-26339.yaml:52
What the analysis did not establish
- One file (likely .gitignore or similar) was omitted from the packet; its content is not available for analysis.
- The evidence does not include any exploit code or proof of exploitation, only a detection template.
- One file (metadata only, not supplied as text) was omitted from the evidence packet and was not reviewed.
- Binary content was not present; the analysis covers only the supplied readable text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-10035
Repository PoCStars: 19Created 2025-09-20ScannerCVE-2025-100353 files
Analysis
Technical assessment
A Nuclei template that detects vulnerable GoAnywhere MFT instances by extracting the version from the login page and comparing it against known affected ranges (>=7.7.0,<7.8.4 and <7.6.3). It does not exploit the deserialization vulnerability.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Nuclei detection template (payload withheld) and a README.md file. The template performs a version-based detection of vulnerable GoAnywhere MFT instances by extracting the version from the login page and comparing it against known affected ranges. The README provides usage instructions and references. No backdoor, deceptive payload, concealed executable behavior, or operator-directed harm is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs version-based detection of a vulnerability without any exploit payload, command execution, or deserialization logic. The README explicitly describes it as a detection method.
CVE-2025-10035.yaml:1-40README.md:3-5Requirements
- Target must be running GoAnywhere MFT with an accessible login page.
CVE-2025-10035.yaml:14-16
Observed behavior
- Sends an HTTP GET request to /goanywhere/auth/Login.xhtml.
CVE-2025-10035.yaml:14-16 - Extracts the version string using the regex 'GoAnywhere\s+([0-9]+\.[0-9]+\.[0-9]+)'.
CVE-2025-10035.yaml:18-24 - Matches if the response body contains 'GoAnywhere Managed File Transfer' and the extracted version falls within the affected ranges.
CVE-2025-10035.yaml:28-40
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- Payload withheldDetection template that extracts GoAnywhere MFT version from /goanywhere/auth/Login.xhtml and matches against affected version ranges (<7.6.3 or >=7.7.0,<7.8.4).
CVE-2025-10035.yaml:1-40 - Contact Method
- Payload withheldAuthor provides a Signal contact link for questions; this is a standard practice and does not constitute a backdoor or malicious behavior.
README.md:44-46
What the analysis did not establish
- One file (LICENSE) is omitted from the packet; its content is not provided, but it is unlikely to contain exploit code.
- The evidence does not include any exploit or deserialization payload; classification is based solely on the provided scanner template and documentation.
- One file (metadata only, not analyzed) was omitted from the text evidence; its content is unknown.
- Binary files were flagged as metadata-only and not analyzed; their content is unknown.
- The review is limited to the supplied text evidence and does not assess the safety of external links or referenced tools.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-42944
Repository PoCStars: 0Created 2025-09-11ScannerCVE-2025-429443 files
Analysis
Technical assessment
A Nuclei template that detects SAP NetWeaver Application Server instances by checking the HTTP server header and comparing the extracted version against '<= 7.50' to identify potentially vulnerable systems.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Nuclei template (CVE-2025-42944.yaml) and a README.md file. The template performs a benign HTTP GET request to the target, extracts the server version from the response header, and uses a DSL matcher to check if the version is <= 7.50. No malicious, deceptive, or concealed behavior is present. The README provides usage instructions and references. No backdoor or trojan behavior is observed.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that performs version-based detection of SAP NetWeaver. It sends a GET request, extracts a version from the server header, and uses a DSL matcher to check if the version is <= 7.50. It does not deliver a payload, trigger deserialization, or execute commands; it only identifies potentially vulnerable instances.
CVE-2025-42944.yaml:1-44README.md:7Requirements
- Target must expose an HTTP service that returns a 'Server' header containing 'SAP NetWeaver Application Server' and a version number.
CVE-2025-42944.yaml:18-20CVE-2025-42944.yaml:26-31
Observed behavior
- Sends an HTTP GET request to the target base URL.
CVE-2025-42944.yaml:18-20 - Extracts the version string from the 'Server' header using the regex 'SAP NetWeaver Application Server ([0-9]+\.[0-9]+)'.
CVE-2025-42944.yaml:26-31 - Matches if the 'Server' header contains 'SAP NetWeaver Application Server' and the extracted version is less than or equal to 7.50.
CVE-2025-42944.yaml:33-44
Behaviors behind the backdoor verdict
Observables
- Http Request
- Payload withheldThe template sends a single GET request to the target to identify the SAP NetWeaver version.
CVE-2025-42944.yaml:18-20 - Regex Extraction
- Payload withheldExtracts the server version from the response header for version comparison.
CVE-2025-42944.yaml:26-31 - Version Check
- Payload withheldChecks if the extracted version is vulnerable according to the CVE description.
CVE-2025-42944.yaml:42-44
What the analysis did not establish
- One file (total 3) was omitted from the packet content; its metadata indicates it is a text file but its content was not included, so its contribution to the artifact cannot be assessed.
- The analysis is based solely on static review of the provided text files; the template was not executed, and no network traffic was observed.
- One file (metadata only, not analyzed) was omitted from the text evidence; its content is unknown.
- The review is based solely on the supplied text files and does not include dynamic analysis or execution.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-53690
Repository PoCStars: 5Created 2025-09-04ScannerCVE-2025-536903 files
Analysis
Technical assessment
A Nuclei template that detects Sitecore instances potentially vulnerable to CVE-2025-53690 by fetching the version XML file, extracting the version number, and checking if it is <= 9.0. It does not perform deserialization or code injection.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Nuclei detection template (CVE-2025-53690.yaml) and a README.md. The template performs a benign HTTP GET to fetch a version file, extracts version numbers using regex, and compares the version to determine if it is vulnerable. The README provides usage instructions and references. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a Nuclei template that only checks for the presence and version of Sitecore. It does not contain any code to exploit the deserialization vulnerability (e.g., sending a malicious ViewState payload). The README explicitly describes it as a 'detection template' and the template itself only performs version extraction and comparison.
README.md:7CVE-2025-53690.yaml:1-58Requirements
- Target must expose /sitecore/shell/sitecore.version.xml and return a version number matching the regex pattern.
CVE-2025-53690.yaml:20-28
Observed behavior
- Sends an HTTP GET request to /sitecore/shell/sitecore.version.xml.
CVE-2025-53690.yaml:18-20 - Extracts the first two digits of the version number from the response body using regex.
CVE-2025-53690.yaml:22-37 - Constructs a major.minor version string and compares it to <= 9.0.
CVE-2025-53690.yaml:39-58 - Matches if the response status is 200, the body contains 'Sitecore Corporation', and the version is <= 9.0.
CVE-2025-53690.yaml:45-58
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldTarget path for the detection request; standard Nuclei template behavior.
CVE-2025-53690.yaml:20 - Regex
- Payload withheldRegex used to extract major and minor version digits from the response body.
CVE-2025-53690.yaml:28CVE-2025-53690.yaml:36 - Dsl Expression
- Payload withheldDSL matcher that checks if the extracted version is vulnerable; standard Nuclei functionality.
CVE-2025-53690.yaml:58
What the analysis did not establish
- One file (total 3) was omitted from the packet; its content is unknown.
- The evidence packet reports complete_artifact_coverage is false, so the full repository content is not available.
- One file (metadata only, not analyzed) was omitted from the evidence; its content is unknown.
- Binary files were flagged but not present in the selected text evidence.
- The review is limited to the supplied text content and does not assess the safety of the referenced external URLs or the Nuclei tool itself.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-4427-CVE-2025-4428
Repository PoCStars: 0Created 2025-08-31ScannerCVE-2025-4427CVE-2025-44283 files
Analysis
Technical assessment
The artifact is a README describing a Nuclei template for detecting vulnerable versions of Ivanti Endpoint Manager Mobile. It does not contain exploit or scanner code itself, but its stated purpose is version detection, which is a scanner function.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a README.md file describing two CVEs, a detection template, and usage instructions. No executable code, scripts, or configuration files are included in the reviewed text. The README contains no concealed commands, deceptive payloads, or instructions that would cause harm to the person running the PoC. The only actionable instruction is to run a publicly available Nuclei scanner with a template, which is standard security testing behavior.
Classification basis and observed behavior
Classification basis
The README explicitly states the artifact is a 'Version detection template' (line 9) and provides instructions to run it with Nuclei to check a host (lines 19-21). This is a scanner function, not an exploit. No exploit code is present in the provided text.
README.md:9README.md:19-21Requirements
- Requires Nuclei to run the detection template.
README.md:19-21
Observed behavior
- Describes a version detection template that matches vulnerable versions of Ivanti Endpoint Manager Mobile.
README.md:7-13 - Provides instructions to run the template with Nuclei against a target host.
README.md:19-21
Behaviors behind the backdoor verdict
Observables
- Instruction
- Payload withheldThe README instructs the user to download and run the Nuclei vulnerability scanner against a target host. This is normal behavior for a PoC detection template and does not indicate a backdoor.
README.md:21 - Contact
- Payload withheldThe README provides a Signal contact link for questions. This is a common practice in open-source projects and does not constitute a backdoor.
README.md:52
What the analysis did not establish
- Only the README.md file content is provided; the actual Nuclei template file (template.yaml) and any other files are omitted. The analysis is based solely on the README description.
- The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository are included.
- Only the README.md file was provided as readable text; two other files (likely the template.yaml and possibly a license) were present in the repository but not included in the review. Their content could not be assessed.
- The analysis is limited to static review of the provided text; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-7775
Repository PoCStars: 2Created 2025-08-31ScannerCVE-2025-77753 files
Analysis
Technical assessment
The artifact is a Nuclei template README describing a detection method for CVE-2025-7775. It explains how to extract the date from a remote NetScaler instance and compare it to the patch date to determine vulnerability. No exploit code is present; the artifact only provides instructions for running a detection script.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a payload withheld file describing a Nuclei template for detecting CVE-2025-7775. No executable code, scripts, or configuration files are present in the reviewed text. The README contains only documentation, usage instructions, references, and contact information, with no concealed or deceptive behavior.
Classification basis and observed behavior
Classification basis
The README describes a detection method that checks the patch date of a remote instance, which is a non-intrusive vulnerability check. It does not contain any code that exercises or exploits the vulnerability. The artifact is classified as a scanner because its primary operation is to detect or report exposure.
README.md:5-7Requirements
- Requires Nuclei to be downloaded and installed.
README.md:11 - Requires the Nuclei template file to be copied locally.
README.md:12
Observed behavior
- Extracts the date from the remote instance and compares it to the date patches were made available.
README.md:7 - Runs a Nuclei command against a target host to perform the detection.
README.md:13
Behaviors behind the backdoor verdict
Observables
- Documentation Only
- Payload withheldThe only file provided in the evidence is a documentation file with no executable content.
README.md:1-45
What the analysis did not establish
- Only the payload withheld file is included; the actual Nuclei template (template.yaml) and any other files are omitted, so the exact detection logic cannot be verified.
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are present.
- Only payload withheld was included as selected text; two other files (total 1987 bytes) were omitted and classified as unclassified, but their metadata indicates no executable source was identified. The review cannot assess the content of those omitted files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-57819
Repository PoCStars: 1Created 2025-08-28WriteupCVE-2025-578193 files
Analysis
Technical assessment
The artifact is a README.md file describing a Nuclei template for detecting vulnerable FreePBX versions related to CVE-2025-57819. It explains the vulnerability, how the detection method works, and provides usage instructions, but does not contain any exploit or scanner code itself.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a README.md file describing a Nuclei template for detecting vulnerable FreePBX versions. No executable code, scripts, or configuration files are present in the reviewed text. The README contains only documentation, references, and social sharing links, with no concealed or deceptive behavior.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file that provides a technical overview of CVE-2025-57819 and describes a detection method using a Nuclei template. It does not contain any executable code, exploit, or scanner script; the actual template file is not included in the evidence. Therefore, it is classified as a writeup.
README.md:1-47Requirements
- The FreePBX Administrator UI must be exposed to the network.
README.md:6
Observed behavior
- The document describes a detection method that sends a request to the FreePBX admin panel, extracts the version, and flags it as vulnerable if it falls within affected version ranges.
README.md:11
Behaviors behind the backdoor verdict
Observables
- Documentation Only
- Payload withheldThe artifact contains no PoC code or executable payload; only a description of a version-checking template.
README.md:1-47
What the analysis did not establish
- The evidence packet includes only the README.md file. The actual Nuclei template (template.yaml) and any other files are not provided, so the detection logic cannot be analyzed directly.
- The analysis is based solely on the textual description in the README; no code was executed or inspected.
- Two additional files (template.yaml and possibly another) were omitted from the text evidence; their contents are unknown.
- Binary files were flagged but not analyzed; none were reported in the packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubrxerium/CVE-2025-8875-CVE-2025-8876
Repository PoCStars: 21Created 2025-08-17ScannerCVE-2025-8875CVE-2025-88764 files
Analysis
Technical assessment
Two Nuclei templates that detect vulnerable versions of N-able N-central by extracting a version string from the /login page and comparing it against a known-vulnerable threshold. No exploitation code is present.
Backdoor review
No backdoor observed in reviewed code
The repository contains two Nuclei templates for version detection of N-able N-central and a README with usage instructions. The templates perform a GET request to /login, extract a version string, and compare it to a vulnerable threshold. No backdoor, obfuscated payload, or concealed operator-directed harm is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The templates only perform version detection via HTTP GET and string comparison; they do not send any payload, deserialize data, or execute commands. The README explicitly describes them as a 'Version detection template'.
README.md:5CVE-2025-8875.yaml:16-40Requirements
- Target must expose an N-central login page at /login that returns HTTP 200 and contains a version string matching the regex 202\d+\.\d+\.\d+\.\d+\b.
CVE-2025-8875.yaml:17-26
Observed behavior
- Sends an HTTP GET request to {{BaseURL}}/login.
CVE-2025-8875.yaml:17-19 - Extracts a version string from the response body using the regex 202\d+\.\d+\.\d+\.\d+\b.
CVE-2025-8875.yaml:22-26 - Matches if the response status is 200, the body contains class="ncentral", and the extracted version is less than 2025.3.1.9.
CVE-2025-8875.yaml:28-40
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- Payload withheldNuclei template for detecting vulnerable N-central versions via GET /login and version comparison.
CVE-2025-8875.yaml:1-40 - Nuclei Template
- Payload withheldNuclei template for detecting vulnerable N-central versions via GET /login and version comparison.
CVE-2025-8876.yaml:1-40 - Contact Info
- Payload withheldAuthor provides a Signal contact link for questions; no malicious behavior is indicated.
README.md:27
What the analysis did not establish
- One file (metadata only) was omitted from the evidence; its content is unknown.
- The evidence does not include any exploit payload or proof of exploitation.
- One file (metadata only, flagged as non-text) was not included in the text evidence; its content is unknown.
- Binary files were not analyzed; the analysis scope covers only the provided readable text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.