Galaxy-sc
Source-scoped identity with 4 associated PoCs and 5 linked vulnerabilities.
Exploit catalog results
Showing 4 PoCs on this page
GitHubGalaxy-sc/CVE-2026-47423-dompurify-xss-detector
Repository PoCStars: 0Created 2026-06-03ScannerCVE-2024-48910CVE-2026-474233 files
Analysis
Technical assessment
A Go-based scanner that fetches a target URL, extracts JavaScript file paths, and checks their content for the presence of 'dompurify' and 'selectedcontent' strings to identify potentially vulnerable DOMPurify deployments.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Go-based scanner and a README that describe and implement a detection tool for CVE-2026-47423. The Go code performs HTTP requests to a user-supplied target, fetches JavaScript files, and checks for the presence of 'dompurify' and 'selectedcontent' strings. No backdoor, concealed operator-directed harm, credential theft, persistence, or unrelated payload is observed. The tool's behavior is limited to the stated vulnerability detection purpose.
Classification basis and observed behavior
Classification basis
The code only detects the presence of specific strings in JavaScript files to report potential vulnerability; it does not construct or deliver an XSS payload, trigger the vulnerability, or perform any exploitation. The README describes it as a 'Detection Tool' and 'scanner'.
CVE-2026-47423.go:130-134README.md:1-3Requirements
- Target URL must be provided via -u or -url flag.
CVE-2026-47423.go:41-42 - Target must serve HTML containing <script> tags with src attributes pointing to JavaScript files.
CVE-2026-47423.go:76-77
Observed behavior
- Fetches the HTML of the target URL.
CVE-2026-47423.go:64 - Extracts JavaScript file paths from <script> tags using a regular expression.
CVE-2026-47423.go:76-77 - Fetches each extracted JavaScript file.
CVE-2026-47423.go:114 - Checks if the JavaScript content contains the case-insensitive strings 'dompurify' (or 'createdompurify') and 'selectedcontent'.
CVE-2026-47423.go:130-131 - Reports 'VULNERABILITY CONFIRMED' if both strings are found, otherwise reports no vulnerable signatures matched.
CVE-2026-47423.go:101-107CVE-2026-47423.go:110
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe tool connects to a target URL provided via command-line flags -u or -url. This is expected behavior for a vulnerability scanner.
CVE-2026-47423.go:64 - Network Connection
- Payload withheldThe tool fetches JavaScript files referenced in the target page's HTML to analyze their content. This is part of the stated detection logic.
CVE-2026-47423.go:114 - String Matching
- Payload withheldThe tool checks fetched JavaScript for these case-insensitive substrings to determine if a vulnerable DOMPurify version is present. This is the core detection logic.
CVE-2026-47423.go:130-131 - Tls Configuration
- Payload withheldThe HTTP client disables TLS certificate verification. This is a common practice in security tools to allow scanning of sites with self-signed or misconfigured certificates, but it reduces transport security.
CVE-2026-47423.go:18
What the analysis did not establish
- One non-text media file (CVE-2026-47423.JPG) is present but not included as text, so its content cannot be analyzed.
- The analysis is based solely on static code review; the code was not executed, and its actual behavior or effectiveness is not verified.
- One non-text media file (CVE-2026-47423.JPG) was flagged as binary and not analyzed; its content is unknown.
- The review is limited to the two text files provided; any other files in the repository were not included in the evidence packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubGalaxy-sc/CVE-2026-23830-SandBreak
Repository PoCStars: 2Created 2026-01-28ExploitCVE-2026-238302 files
Analysis
Technical assessment
A Go-based exploit generator for CVE-2026-23830 that produces JavaScript payloads to escape the SandboxJS sandbox via the unprotected AsyncFunction constructor, enabling arbitrary command execution on the host.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Go-based exploit generator for CVE-2026-23830. The code generates JavaScript payloads that exploit a sandbox escape vulnerability. No backdoor, concealed harmful behavior, or deceptive payload targeting the person running the PoC was observed. The tool's functionality is consistent with its stated purpose of generating exploit payloads for a known vulnerability.
Classification basis and observed behavior
Classification basis
The artifact is an exploit generator that produces JavaScript code designed to exercise the CVE-2026-23830 sandbox escape vulnerability. The README explicitly labels it an 'Exploit Generator & Auto-Pwn Tool' and describes it as exploiting the unprotected AsyncFunction constructor to execute arbitrary code. The Go source constructs payloads that break out of the sandbox and run OS commands (e.g., whoami, calc.exe), which is the definition of exploit code.
README.md:2README.md:8-10CVE-2026-23830.go:66CVE-2026-23830.go:69Requirements
- Target must be running a vulnerable version of SandboxJS (< 0.8.26) that does not isolate AsyncFunction.
README.md:8-10 - For OOB mode, an attacker-controlled HTTP/HTTPS listener (e.g., webhook.site) is required to receive exfiltrated command output.
CVE-2026-23830.go:50-53
Observed behavior
- Generates a JavaScript payload that obtains the native AsyncFunction constructor via (async()=>{}).constructor, then uses it to create a function that executes outside the sandbox.
CVE-2026-23830.go:66 - In OOB mode, the payload executes a user-supplied shell command, Base64-encodes the output, and sends it to a specified URL via Node.js http/https module.
CVE-2026-23830.go:66 - In calc mode, the payload spawns calc.exe on Windows as a proof of code execution.
CVE-2026-23830.go:69
Behaviors behind the backdoor verdict
Observables
- Exploit Payload Generation
- Payload withheldThis is the expected behavior of a PoC for CVE-2026-23830, which describes a sandbox escape via AsyncFunction.
CVE-2026-23830.go:66CVE-2026-23830.go:69 - Command Execution
- Payload withheldThis is the intended exploit behavior for the vulnerability, not a backdoor against the PoC user.
CVE-2026-23830.go:66CVE-2026-23830.go:69 - Data Exfiltration
- Payload withheldThis is a feature of the exploit tool for blind RCE scenarios, not a hidden exfiltration of the PoC user's data.
CVE-2026-23830.go:66
What the analysis did not establish
- The evidence includes only the exploit generator source code and README; no demonstration of successful exploitation or target environment is provided.
- The README references a video demonstration (line 66) that is not included in the evidence.
- Only the two text files (CVE-2026-23830.go and README.md) were reviewed. No binary files were present or analyzed.
- The review does not assess the safety of executing the generated JavaScript payloads on a target system, only whether the PoC itself contains a backdoor against the user.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubGalaxy-sc/CVE-2026-0920-WordPress-LA-Studio-Exploit
Repository PoCStars: 2Created 2026-01-22ExploitCVE-2026-09203 files
Analysis
Technical assessment
A Go-based exploit for CVE-2026-0920 that sends a crafted AJAX request to a vulnerable WordPress plugin to create an administrator account. It scrapes nonces and the AJAX URL from the target, constructs a JSON payload with 'lakit_bkrole' set to 'administrator', and sends it to the admin-ajax.php endpoint.
Backdoor review
No backdoor observed in reviewed code
The supplied Go source code and README implement a public proof-of-concept exploit for CVE-2026-0920. The code sends a crafted HTTP POST request to a target WordPress site to create an administrator account via the documented vulnerability. No concealed backdoor, unrelated payload, credential exfiltration, persistence mechanism, or operator-directed harm was observed. The artifact's behavior is consistent with its stated purpose.
Classification basis and observed behavior
Classification basis
The code actively constructs and sends a malicious request to create an administrator account on a vulnerable target, which is the definition of an exploit. It does not merely detect or report the vulnerability.
CVE-2026-0920.go:3-4CVE-2026-0920.go:203-215README.md:3-5Requirements
- Target URL of a page where the vulnerable LA-Studio Element Kit plugin is active and exposes the lakit_ajax action.
CVE-2026-0920.go:105 - Valid nonces (ajaxNonce and lakit-register-nonce) must be obtainable from the target page or provided manually.
CVE-2026-0920.go:146-150
Observed behavior
- Scrapes the target page to extract the global nonce, register nonce, and the admin-ajax.php URL.
CVE-2026-0920.go:135CVE-2026-0920.go:247-296 - Constructs a JSON payload containing a 'register' action with 'lakit_bkrole' set to 'administrator'.
CVE-2026-0920.go:178-195 - Sends an HTTP POST request to the discovered admin-ajax.php endpoint with the action 'lakit_ajax' and the malicious JSON payload.
CVE-2026-0920.go:203-215 - Checks the response for success indicators (e.g., '"success":true') to confirm administrator account creation.
CVE-2026-0920.go:230
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented exploit mechanism for CVE-2026-0920, matching the vulnerability description.
CVE-2026-0920.go:203-206CVE-2026-0920.go:192 - Network Communication
- Payload withheldStandard reconnaissance step for a PoC exploit; no data exfiltration to third parties.
CVE-2026-0920.go:135CVE-2026-0920.go:247-296 - Author Contact
- Payload withheldContact information displayed in the banner; not a backdoor indicator.
CVE-2026-0920.go:93
What the analysis did not establish
- One non-text media file (CVE-2026-0920.PNG) was not analyzed; it is a screenshot referenced in the README.
- The evidence does not include the vulnerable plugin source code; analysis is based solely on the exploit code and its description.
- One non-text media file (CVE-2026-0920.PNG) was present in the artifact but not analyzed; it is a screenshot referenced in the README and is unlikely to contain executable backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubGalaxy-sc/CVE-2025-12139-WordPress-Integrate-Google-Drive-Exploit
Repository PoCStars: 0Created 2025-12-21ScannerCVE-2025-121393 files
Analysis
Technical assessment
A Go program that fetches a target URL, searches the page source for a 'var igd' JavaScript variable, and parses it to check for exposed Google OAuth credentials and account data. It reports whether sensitive data was found but does not perform any exploitation actions.
Backdoor review
No backdoor observed in reviewed code
The supplied Go source code and README implement a straightforward proof-of-concept for CVE-2025-12139. The program fetches a target URL, extracts a JavaScript variable with a regex, parses JSON, and prints any discovered Google OAuth credentials. No hidden network calls, persistence mechanisms, credential exfiltration to a third party, or unrelated payloads are present. The behavior is fully consistent with the stated information-disclosure exploit.
Classification basis and observed behavior
Classification basis
The code only detects and reports the presence of exposed sensitive data; it does not perform any action to exploit the vulnerability such as using the credentials to access Google Drive or modify data. The README describes it as a 'Proof of Concept (PoC) exploit' but the code itself is a scanner.
CVE-2025-12139.go:1-134README.md:4Requirements
- Target URL must be provided via -u flag
CVE-2025-12139.go:53-54 - Target must have the Integrate Google Drive plugin active and exposing the 'igd' variable in page source
CVE-2025-12139.go:78-84
Observed behavior
- Fetches the target URL via HTTP GET
CVE-2025-12139.go:66-67 - Extracts the 'igd' JavaScript variable from the response body using a regex
CVE-2025-12139.go:78-79 - Parses the extracted JSON and checks for clientID, clientSecret, and Base64-encoded accounts data
CVE-2025-12139.go:89-127 - Prints whether the target is vulnerable based on the presence of sensitive data
CVE-2025-12139.go:129-133
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe only outbound connection is the intended exploit request to the victim WordPress site; no hardcoded attacker-controlled server is contacted.
CVE-2025-12139.go:67 - Credential Extraction
- Payload withheldMatches the described CVE-2025-12139 information disclosure; extracted data is only printed to stdout, not exfiltrated elsewhere.
CVE-2025-12139.go:99-121 - Author Contact
- Payload withheldDisplayed in the banner; no code uses this for communication or data exfiltration.
CVE-2025-12139.go:47
What the analysis did not establish
- One non-text file (proof.PNG) is present but not included in the text evidence; its content cannot be analyzed.
- The evidence packet reports complete_artifact_coverage: false, indicating not all files are represented, though all selected text files are complete.
- One non-text media file (proof.PNG, 13837 bytes) was flagged as metadata-only and not analyzed; its content could theoretically contain hidden instructions, but the text-based PoC code itself shows no backdoor behavior.
- The review covers only the supplied evidence packets; no runtime behavior or external dependencies were examined.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.