Amir Hossein Jamshidi
Source-scoped identity with 3 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
ExploitDBWordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover
ExploitDB exploitPublished 2026-05-26ExploitCVE-2026-75671 file
Analysis
Technical assessment
Python script that sends a crafted GET request to a WordPress site with the 'temp-login-token' parameter supplied as an array to bypass authentication and gain access as a temporary user.
Backdoor review
No backdoor observed in reviewed code
The provided Python script is a straightforward proof-of-concept for CVE-2026-7567. It demonstrates an authentication bypass by sending a crafted GET request with an array parameter to exploit a known vulnerability in the WordPress Temporary Login plugin. The script checks for the presence of a logged-in cookie and attempts to access the admin dashboard. It saves the obtained cookies to a local file for manual use. No backdoor, reverse shell, data exfiltration, or other malicious payload unrelated to the stated exploit is present.
Classification basis and observed behavior
Classification basis
The script actively sends a crafted request to exploit the authentication bypass vulnerability and uses the resulting session to access the admin dashboard, which constitutes exploitation rather than mere detection or scanning.
exploits/multiple/webapps/52575.txt:26-28exploits/multiple/webapps/52575.txt:38-41Requirements
- Target must have the Temporary Login plugin version <= 1.0.0 installed and at least one active temporary user.
exploits/multiple/webapps/52575.txt:49-51
Observed behavior
- Prompts the user for a target URL.
exploits/multiple/webapps/52575.txt:25 - Sends a GET request to the target's wp-admin endpoint with the 'temp-login-token' parameter supplied as an empty array.
exploits/multiple/webapps/52575.txt:26-28 - Checks the response for the presence of a 'wp-settings-time' cookie to determine if authentication was successful.
exploits/multiple/webapps/52575.txt:34 - If the cookie is found, attempts to access the WordPress admin dashboard using the obtained session cookies to confirm admin access.
exploits/multiple/webapps/52575.txt:38-41 - Saves the obtained session cookies to a local file for manual use.
exploits/multiple/webapps/52575.txt:53-56
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldThe crafted URL used to trigger the authentication bypass vulnerability.
exploits/multiple/webapps/52575.txt:26 - File Write
- Payload withheldThe script saves the session cookies obtained from the exploit to a local file for manual browsing, which is a common and expected action in a PoC to demonstrate successful authentication.
exploits/multiple/webapps/52575.txt:53-56
What the analysis did not establish
- Only the single text file from ExploitDB was analyzed; no external libraries or referenced resources were expanded.
- The code was not executed, so its actual behavior and effectiveness are not verified.
- The review is limited to the single text file provided. No external resources, libraries, or network destinations are analyzed.
- The script's behavior depends on the 'requests' library, which is not included in the evidence and is assumed to be a standard, unmodified Python library.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
ExploitDBD-Link DSL2600U - 'rom-0' Admin Password Disclosure
ExploitDB exploitPublished 2026-05-26ExploitUnlinked1 file
Analysis
Technical assessment
Python script that fetches the '/rom-0' file from a target D-Link DSL2600U router, decompresses a portion of it using LZS, and extracts the admin password via regex.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward Python script that fetches the /rom-0 file from a target D-Link router, decompresses a portion of it, and extracts a password. No obfuscation, secondary payloads, persistence mechanisms, or deceptive behavior is present. The script performs only the documented exploit action.
Classification basis and observed behavior
Classification basis
The script actively retrieves a sensitive file from a target device, processes it, and outputs the admin password, which constitutes exploitation rather than mere detection or scanning.
exploits/multiple/hardware/52576.txt:22-33Requirements
- Target must be a D-Link DSL2600U router with firmware version v1.08 and the '/rom-0' endpoint accessible.
exploits/multiple/hardware/52576.txt:1-8 - Requires the routersploit library for LZS decompression.
exploits/multiple/hardware/52576.txt:9
Observed behavior
- Prompts user for target URL.
exploits/multiple/hardware/52576.txt:32 - Sends HTTP GET request to '/rom-0' endpoint.
exploits/multiple/hardware/52576.txt:23 - Decompresses data starting at byte offset 8568 using LZS algorithm.
exploits/multiple/hardware/52576.txt:27-28 - Extracts password from decompressed data using regex matching printable characters of length 5 or more.
exploits/multiple/hardware/52576.txt:29-30 - Prints the extracted password to the console.
exploits/multiple/hardware/52576.txt:33
Behaviors behind the backdoor verdict
Observables
- Network Request
- Payload withheldThe script fetches the /rom-0 endpoint from a user-supplied URL, which is the documented target for the password disclosure exploit.
exploits/multiple/hardware/52576.txt:23 - Data Extraction
- Payload withheldThe script decompresses a portion of the fetched data and extracts a password string, consistent with the exploit's stated purpose.
exploits/multiple/hardware/52576.txt:27-29
What the analysis did not establish
- The analysis is based solely on the provided source code; no dynamic execution or validation of the exploit was performed.
- The script's functionality depends on the routersploit library, which was not provided or analyzed.
- Review is limited to the single text file provided; no external dependencies (e.g., routersploit.libs.lzs) were inspected.
- The script's behavior when executed against a real or malicious target is not assessed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.