xxconi
Source-scoped identity with 22 associated PoCs and 23 linked vulnerabilities.
Exploit catalog results
Showing 22 PoCs on this page
GitHubxxconi/CVE-2026-12415-or-CVE-2026-12416.py
Repository PoCStars: 0Created 2026-06-26StubCVE-2026-12415CVE-2026-124162 files
Analysis
Technical assessment
The artifact is a placeholder repository containing only a README and an empty Python file. The Python file contains a single comment line stating 'payload withheld', and the README merely repeats the filename. No exploit, scanner, or substantive technical analysis code is present.
Backdoor review
No backdoor observed in reviewed code
The repository contains only a placeholder Python file and a README. The Python file holds a single line of text ('payload withheld') and the README repeats the filename. No executable code, network calls, persistence mechanisms, or deceptive behavior is present. The content is inert and does not perform any actions.
Classification basis and observed behavior
Classification basis
The artifact contains no functional code. The sole Python file is a stub with a single comment, and the README provides no technical content. This is a materially incomplete artifact.
CVE-2026-12415-or-CVE-2026-12416.py:1README.md:1-2Observed behavior
- The Python file contains only a comment: 'payload withheld'.
CVE-2026-12415-or-CVE-2026-12416.py:1
Behaviors behind the backdoor verdict
Observables
- File Content
- Payload withheldThe sole Python file contains only a status message, not executable exploit or backdoor code.
CVE-2026-12415-or-CVE-2026-12416.py:1 - File Content
- Payload withheldThe README contains only a comment with the filename, providing no instructions or payload.
README.md:1-2
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage, but the only Python file contains a single comment and no executable code.
- Only the two text files in the repository were reviewed; no other files exist in the snapshot.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-49777-CVE-2026-10735
Repository PoCStars: 0Created 2026-06-21ExploitCVE-2026-10735CVE-2026-497773 files
Analysis
Technical assessment
Python script that performs a multi-step exploitation chain against WordPress sites running vulnerable ShapedPlugin plugins. It detects indicators of compromise, bypasses login using a hardcoded MD5 hash, writes a webshell via a REST API backdoor, executes arbitrary OS commands, and exfiltrates credentials.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a Python script that automates exploitation of known backdoors in vulnerable WordPress plugins. It does not contain any backdoor or deceptive payload aimed at the person running the PoC. All behavior is consistent with a public exploit tool: it scans targets, attempts login bypass, writes a webshell, executes commands, and exfiltrates data from the target server. No concealed operator-directed harm against the PoC runner was observed.
Classification basis and observed behavior
Classification basis
The script actively performs exploitation steps including login bypass, webshell deployment, remote command execution, and data exfiltration. It is not limited to detection or validation; it exercises the vulnerability to gain unauthorized access and control.
CVE-2026-49777.py:326-401Requirements
- Target must be running a vulnerable version of one of the affected ShapedPlugin plugins with the backdoor code present.
CVE-2026-49777.py:449-452
Observed behavior
- Detects backdoor indicators by checking for fake plugin directories, known IOC file paths, and a specific HTTP response header (X-Cache-Status).
CVE-2026-49777.py:91-125 - Bypasses WordPress login by sending a hardcoded MD5 hash as the password to wp-login.php.
CVE-2026-49777.py:130-167 - Writes a PHP webshell to the uploads directory via a POST request to a backdoored REST API endpoint (/wp-json/wc/v3/settings/apply).
CVE-2026-49777.py:172-199 - Executes arbitrary OS commands by sending a base64-encoded command to a backdoored diagnostics file or by injecting a command into the X-Forwarded-For header.
CVE-2026-49777.py:204-261 - Exfiltrates sensitive data including wp-config.php contents, database credentials, and checks for Adminer and file manager access.
CVE-2026-49777.py:266-321
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThe script implements a documented attack chain (IOC detection, login bypass, REST API backdoor, webshell RCE, data exfiltration) against vulnerable WordPress plugins. This is normal exploit behavior, not a backdoor against the user.
CVE-2026-49777.py:50-66CVE-2026-49777.py:88-125CVE-2026-49777.py:127-167CVE-2026-49777.py:169-199CVE-2026-49777.py:201-261CVE-2026-49777.py:263-321 - Hardcoded Credentials
- Payload withheldUsed as a login bypass token and REST API auth token against the target. This is part of the documented exploit, not a credential that harms the PoC runner.
CVE-2026-49777.py:51 - Output File
- Payload withheldThe script saves successful exploitation results locally. This is expected logging for an exploit tool and does not exfiltrate data from the runner's machine.
CVE-2026-49777.py:46CVE-2026-49777.py:82-86 - Contact Information
- Payload withheldDisplayed in the banner and README. This is author contact information, not executable behavior.
CVE-2026-49777.py:42README.md:2
What the analysis did not establish
- Evidence includes only the Python script and README; the repository contains one non-text file (likely an image) that was not analyzed.
- The script's actual effectiveness or safety is not verified; classification is based solely on code intent and structure.
- One non-text media file (82730 bytes) was present in the repository but was not analyzed; its content is unknown.
- The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2025-13407
Repository PoCStars: 0Created 2026-06-21ExploitCVE-2025-134073 files
Analysis
Technical assessment
Python script that exploits CVE-2025-13407 in Gravity Forms by uploading a PHP webshell via chunked file upload. It includes a multi-site scanner mode.
Backdoor review
No backdoor observed in reviewed code
The PoC is a Python script that exploits CVE-2025-13407 in Gravity Forms to upload a PHP file. It contains no concealed backdoor, credential theft, persistence mechanism, or unrelated payload. The script performs only the advertised exploit behavior: uploading a PHP webshell or phpinfo file to a vulnerable target.
Classification basis and observed behavior
Classification basis
The script actively uploads a PHP file (webshell) to a vulnerable target, which is the definition of an exploit. It does not merely detect the vulnerability; it exercises it to achieve code execution.
CVE-2025-13407.py:110-112CVE-2025-13407.py:136-141CVE-2025-13407.py:197-199Requirements
- Target must have a page containing a Gravity Forms multifile upload field.
CVE-2025-13407.py:120-123 - The upload path must be discoverable or enumerable.
CVE-2025-13407.py:192-195
Observed behavior
- Sends a chunked file upload request to /?gf_page=upload with a PHP payload disguised as a multi-part upload.
CVE-2025-13407.py:144-158 - Sends a second chunk to finalize the upload, referencing the hash and temp filename from the first chunk.
CVE-2025-13407.py:168-184 - Constructs a URL to the uploaded PHP file under wp-content/uploads/gravity_forms/ and reports it as a webshell.
CVE-2025-13407.py:192-199
Behaviors behind the backdoor verdict
Observables
- Telegram Contact
- Payload withheldThe script displays a Telegram group link in the banner and README, which is typical for PoC distribution but does not constitute backdoor behavior.
CVE-2025-13407.py:31README.md:3 - Output File
- Payload withheldThe script writes successful exploit results to a local file, which is expected behavior for a scanning tool and not a backdoor.
CVE-2025-13407.py:35
What the analysis did not establish
- One non-text media file (107511 bytes) was not analyzed; its content is unknown.
- The evidence does not confirm whether the exploit code was executed or is functional.
- One non-text file (likely an image) was present in the repository but not analyzed; its metadata-only inspection showed no executable content.
- The review is limited to the supplied text evidence and does not verify the script's runtime behavior or the safety of the uploaded PHP payload.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/2026-11551
Repository PoCStars: 0Created 2026-06-19ExploitCVE-2026-115512 files
Analysis
Technical assessment
Python exploit for CVE-2026-11551 targeting the Branda WordPress plugin (<=3.4.29). It performs unauthenticated privilege escalation by overwriting arbitrary user passwords via the plugin's password_1 field during registration or signup flows, then verifies the takeover by logging in and checking admin access.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python PoC script for CVE-2026-11551. The script performs automated exploitation of a known WordPress plugin vulnerability (privilege escalation via account takeover) and includes post-exploitation reconnaissance (listing users and plugins). No concealed backdoor, unrelated payload, or deceptive behavior targeting the PoC operator was observed. The script's actions are consistent with its stated purpose of demonstrating the vulnerability.
Classification basis and observed behavior
Classification basis
The script actively sends crafted HTTP requests to overwrite user passwords and then logs in to gain unauthorized access, which constitutes exploitation, not mere detection or scanning.
cve_2026_11551.py:205-254cve_2026_11551.py:422-561cve_2026_11551.py:600-770Requirements
- Target must run Branda plugin version <= 3.4.29 with registration or multisite signup enabled.
cve_2026_11551.py:3-5cve_2026_11551.py:135-173 - For single-site vector, user registration must be open and the password_1 field must be present.
cve_2026_11551.py:168-173 - For multisite vector, the target must be a WordPress multisite installation with signup enabled.
cve_2026_11551.py:161-165
Observed behavior
- Reconnaissance: detects Branda version, multisite status, registration openness, presence of password_1 field, and enumerates users via REST API and author archives.
cve_2026_11551.py:135-199 - Vector A (single-site): POSTs to wp-login.php?action=register with an existing username and attacker-chosen password_1, causing the vulnerable hook to immediately overwrite the user's password.
cve_2026_11551.py:205-254 - Vector B (multisite): POSTs to wp-signup.php to store password_1 in signup meta, then activates the signup via wp-activate.php to trigger the password overwrite.
cve_2026_11551.py:260-330 - Vector C (reset abuse): attempts to inject password_1 into the lostpassword flow as an alternative attack path.
cve_2026_11551.py:367-392 - Verification: logs in with the new password, confirms authenticated session, checks for admin dashboard access, and determines the user's role.
cve_2026_11551.py:422-561 - Post-exploitation: enumerates users and installed plugins using the compromised session.
cve_2026_11551.py:567-594 - Mass scanning: supports multi-threaded scanning of a target list from a file.
cve_2026_11551.py:855-904
Behaviors behind the backdoor verdict
Observables
- Post Exploitation Reconnaissance
- Payload withheldThis is expected behavior for a PoC demonstrating the impact of the vulnerability, not a backdoor targeting the operator.
cve_2026_11551.py:567-595 - Credential Saving
- Payload withheldThis is standard logging for a security testing tool and does not exfiltrate data to a remote server.
cve_2026_11551.py:96-107
What the analysis did not establish
- Evidence is limited to the supplied text files; no runtime behavior or external network interactions were observed.
- The artifact's complete_artifact_coverage is false, indicating the repository snapshot may contain additional files not included in the evidence packet.
- Only the two text files (README.md and cve_2026_11551.py) were provided; no binary files or other repository content were inspected.
- The review does not assess the safety of executing the script against authorized targets, only whether the script itself contains a backdoor or deceptive payload aimed at the operator.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-4782
Repository PoCStars: 0Created 2026-06-19ScannerCVE-2026-47822 files
Analysis
Technical assessment
Python script that checks for CVE-2026-4782 (arbitrary file read) and related vulnerabilities in Avada Builder for WordPress. It attempts to read sensitive files via path traversal, checks for directory listing, and optionally tests for SSRF, but does not deliver a payload or achieve code execution.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a Python script that exploits CVE-2026-4782 (arbitrary file read) in the Avada Builder WordPress plugin. It performs HTTP requests to a user-supplied target, attempts authentication, fetches a nonce, and sends crafted POST requests to read arbitrary files via path traversal. No backdoor, concealed payload, or operator-directed harm was observed. The script's behavior is consistent with a standard security testing tool.
Classification basis and observed behavior
Classification basis
The script sends crafted requests to detect and read arbitrary files via path traversal, but it only retrieves and displays file contents; it does not upload a shell, execute commands, or otherwise compromise the target beyond information disclosure. The primary operation is vulnerability scanning/validation, not exploitation.
CVE-2026-4782.py:122-196CVE-2026-4782.py:306-392Requirements
- WordPress site running Avada Builder <= 3.15.2
CVE-2026-4782.py:4 - Valid WordPress subscriber-level credentials (optional but recommended for authenticated exploitation)
CVE-2026-4782.py:88-115 - Nonce value from target site (auto-fetched or provided)
CVE-2026-4782.py:49-81
Observed behavior
- Fetches a nonce from the target WordPress site by scraping page source or REST API
CVE-2026-4782.py:49-81 - Optionally authenticates to WordPress using provided credentials
CVE-2026-4782.py:88-115 - Sends POST requests to /wp-admin/admin-ajax.php with path traversal payloads in the 'attachment' field to attempt reading sensitive files
CVE-2026-4782.py:122-196 - Checks for publicly listable fusion-forms upload directories
CVE-2026-4782.py:234-268 - Optionally tests for SSRF via form_to_url_action parameter
CVE-2026-4782.py:275-299 - Displays results in a table and optionally saves extracted file contents to a local file
CVE-2026-4782.py:370-392
Behaviors behind the backdoor verdict
Observables
- Network Requests
- Payload withheldThe script sends requests to the target specified via command-line arguments, which is expected for a PoC exploit.
CVE-2026-4782.py:57CVE-2026-4782.py:162-163 - File Write
- Payload withheldThe script writes retrieved file contents to a user-specified output file, which is a standard feature for saving scan results.
CVE-2026-4782.py:370-378 - Credential Handling
- Payload withheldThe script uses provided credentials to authenticate to the target WordPress site, which is necessary for testing authenticated exploits.
CVE-2026-4782.py:88-115
What the analysis did not establish
- Evidence is limited to the supplied source code; no runtime behavior or network traffic was observed.
- The script's effectiveness depends on the target's configuration and may not succeed in all cases.
- Only the two text files (CVE-2026-4782.py and README.md) were provided; no other files exist in the repository snapshot.
- The script imports third-party libraries (requests, rich, urllib3) which were not reviewed; their behavior is assumed to be benign.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-22356
Repository PoCStars: 0Created 2026-06-13WriteupCVE-2026-223562 files
Analysis
Technical assessment
The artifact is a README.md file that describes a Local File Inclusion (LFI) vulnerability in Jetpack CRM leading to Remote Code Execution (RCE) via log poisoning. It includes a code snippet showing the vulnerable function, an explanation of the attack vector, and a sample command execution output, but does not contain any executable exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a README.md file that documents the CVE-2026-22356 vulnerability in Jetpack CRM. It contains no executable code, no instructions to run a PoC, and no concealed or deceptive payload. The file describes the vulnerable code path and shows example command output, but does not itself perform any harmful action.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file containing a technical analysis of CVE-2026-22356, including a description of the vulnerable code, the attack methodology, and a sample output. It does not provide any executable code (exploit or scanner); the command line shown is a usage example, not the script itself. The file is a substantive technical writeup.
README.md:1-35Requirements
- The target must be running a vulnerable version of Jetpack CRM (<= 6.7.0).
README.md:1 - The attacker must be able to send HTTP requests to the target WordPress instance.
README.md:10
Observed behavior
- The document describes an LFI attack by sending a crafted 'page' parameter with path traversal and a null byte to include arbitrary PHP files.
README.md:31 - The document describes achieving RCE by poisoning Apache access logs with PHP code and then including the log file via the LFI vulnerability.
README.md:12-21
Behaviors behind the backdoor verdict
Observables
- Documentation
- Payload withheldThe file is purely informational and does not contain any backdoor or deceptive payload.
README.md:1-35
What the analysis did not establish
- The evidence packet contains only the README.md file. The repository contains one other file (non-text, 64907 bytes) that was not included, so the complete artifact coverage is not confirmed. The classification is based solely on the provided text.
- The README.md references an 'exploit.py' script but does not include its source code, so the artifact itself contains no executable code.
- One non-text media file (64907 bytes) was present in the repository but not included in the text evidence; its content is unknown.
- The analysis is limited to the single README.md file; no other source code or scripts were reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2025-6254
Repository PoCStars: 0Created 2026-06-11ExploitCVE-2025-62542 files
Analysis
Technical assessment
Python script that attempts to create a WordPress administrator account via the Doctreat Core plugin's AJAX registration handler (CVE-2025-6254). It sends crafted POST requests with a chosen role to wp-admin/admin-ajax.php, tries multiple action names and nonce values, and verifies the resulting admin access by logging in.
Backdoor review
No backdoor observed in reviewed code
The PoC is a Python script that exploits CVE-2025-6254 by sending HTTP requests to a target WordPress site to register an administrator user. All code is plain text with no obfuscation, no concealed payloads, and no operator-directed harm beyond the stated exploit behavior. The script performs only the described privilege escalation and optional admin login verification; it does not establish persistence, exfiltrate data, or execute unrelated commands.
Classification basis and observed behavior
Classification basis
The script actively sends crafted HTTP requests to create a new user with a specified role (default 'administrator') on a target WordPress site, and then verifies the resulting access by logging in. This constitutes exploitation, not mere detection or scanning.
CVE-2025-6254.py:180-211CVE-2025-6254.py:214-250Requirements
- Target must have a vulnerable version of the Doctreat Core plugin (<=1.6.8) installed and active, with the registration AJAX endpoint reachable.
CVE-2025-6254.py:47-52CVE-2025-6254.py:88
Observed behavior
- Generates random credentials (username, email, password) for a new user.
CVE-2025-6254.py:98-103 - Attempts to extract a nonce from common WordPress registration pages.
CVE-2025-6254.py:105-127 - Sends POST requests to wp-admin/admin-ajax.php with parameters including action, username, email, password, and a chosen role (default 'administrator'), iterating over multiple AJAX action names and nonce combinations.
CVE-2025-6254.py:154-177CVE-2025-6254.py:193-209 - If registration succeeds, attempts to log in to the WordPress admin panel with the created credentials to verify administrative access.
CVE-2025-6254.py:214-250 - Supports both single-target and mass-scanning modes, saving successful credentials to an output file.
CVE-2025-6254.py:254-313CVE-2025-6254.py:361-398
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldMatches the CVE description of unauthenticated privilege escalation via doctreat_process_registration()
CVE-2025-6254.py:154-177 - Credential Generation
- Payload withheldStandard PoC practice to avoid hardcoded credentials; no evidence of exfiltration
CVE-2025-6254.py:98-103 - Output File
- Payload withheldLocal logging only; no network exfiltration observed
CVE-2025-6254.py:77-82
What the analysis did not establish
- Only the Python script and README were provided; no network traffic or execution output is included.
- The script's actual effectiveness against a live target cannot be confirmed from the static code alone.
- Review is based solely on the supplied text files; no runtime behavior or network traffic was observed.
- The script imports standard libraries only; no third-party dependencies were inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-5718-PR-V-EXPLO-T
Repository PoCStars: 0Created 2026-06-10Not analyzedCVE-2026-57181 file
GitHubxxconi/CVE-2025-5947
Repository PoCStars: 0Created 2026-05-30ExploitCVE-2025-59473 files
Analysis
Technical assessment
Python script that exploits CVE-2025-5947, an authentication bypass in the Service Finder Bookings WordPress plugin, by sending a crafted cookie to log in as any user including admins.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python exploit script for CVE-2025-5947, a README, and a requirements file. The exploit script sends a crafted cookie to a target WordPress site to trigger an authentication bypass vulnerability. No backdoor, concealed payload, or operator-directed harm was observed. The script performs only the advertised exploit behavior.
Classification basis and observed behavior
Classification basis
The script actively sends crafted HTTP requests to exploit the vulnerability and gain unauthorized access, which is the definition of an exploit. It does not merely detect or report the vulnerability.
CVE-2025-5947.py:49-94CVE-2025-5947.py:10Requirements
- Target must have the vulnerable Service Finder Bookings plugin (<= 6.0) installed and the service_finder_switch_back AJAX action accessible.
CVE-2025-5947.py:33-43CVE-2025-5947.py:60-66
Observed behavior
- Sends a GET request to /wp-admin/admin-ajax.php?action=service_finder_switch_back with a cookie original_user_id set to a target user ID, attempting to log in as that user.
CVE-2025-5947.py:55-66 - Checks for success indicators: HTTP 301/302 redirect, Location header containing /wp-admin/, and Set-Cookie header containing wordpress_logged_in_.
CVE-2025-5947.py:75-79 - Includes a brute-force mode that iterates over a range of user IDs to find valid accounts.
CVE-2025-5947.py:96-123
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented exploit for CVE-2025-5947 authentication bypass. No additional requests or payloads are sent.
CVE-2025-5947.py:55-66 - Network Target
- Payload withheldThe script only connects to the target specified by the operator. No hardcoded external addresses or exfiltration endpoints are present.
CVE-2025-5947.py:138
What the analysis did not establish
- Evidence is limited to the supplied source code and README; no runtime execution or network traffic was observed.
- The exploit's effectiveness depends on the target's configuration and the presence of the vulnerable plugin version.
- No binary files were present in the artifact.
- Review is limited to the supplied text content; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-46275
Repository PoCStars: 0Created 2026-05-26ExploitCVE-2026-462753 files
Analysis
Technical assessment
Python exploit for CVE-2026-46725, an insecure deserialization vulnerability in the TYPO3 ceselector extension. The script detects the extension via a Set-Cookie header, constructs a PHP object injection payload using a Monolog gadget chain, sends it in a cookie to trigger unserialize(), and extracts command output to achieve remote code execution. It supports single-target exploitation, bulk scanning, and an interactive shell.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python proof-of-concept exploit for CVE-2026-46725, a TYPO3 ceselector extension insecure deserialization vulnerability. The code performs HTTP requests to detect the target, sends a PHP object injection payload via a cookie, and extracts command output from the response. No backdoor, concealed operator-directed harm, persistence, credential theft, or unrelated payload was observed. The artifact's behavior is consistent with a standard public exploit PoC.
Classification basis and observed behavior
Classification basis
The artifact is an exploit because it actively delivers a crafted payload to a target system to achieve remote code execution. The code constructs a PHP object injection payload (lines 325-364), sends it in an HTTP cookie (lines 486-498), and extracts the resulting command output (lines 397-426). It includes an interactive shell for repeated command execution (lines 646-732). This goes beyond detection or scanning; it exercises the vulnerability to execute arbitrary OS commands.
CVE-2026-46275.py:325-364CVE-2026-46275.py:486-498CVE-2026-46275.py:397-426CVE-2026-46275.py:646-732Requirements
- Target must have TYPO3 with the ceselector extension installed and the T3_ceselector_* cookie present in the Set-Cookie header.
CVE-2026-46275.py:218-315 - The TYPO3 configuration must have Persistent Mode: Static enabled for the vulnerability to be exploitable.
README.md:48
Observed behavior
- Sends an HTTP GET request to the target to detect TYPO3 and extract the T3_ceselector_* cookie name from the Set-Cookie header.
CVE-2026-46275.py:231-315 - Constructs a URL-encoded PHP serialized object (Monolog gadget chain) that executes an arbitrary OS command via system() when unserialized.
CVE-2026-46275.py:325-364 - Sends a second HTTP GET request with the malicious payload in the T3_ceselector_* cookie to trigger the deserialization vulnerability.
CVE-2026-46275.py:486-498 - Extracts and displays the command output from the HTTP response body using regex patterns (e.g., uid=... for the id command).
CVE-2026-46275.py:397-426 - Provides an interactive shell that repeatedly sends commands via the cookie and displays the output.
CVE-2026-46275.py:646-732
Behaviors behind the backdoor verdict
Observables
- Exploit Technique
- Payload withheldThe exploit sends a serialized PHP object in a cookie to trigger remote code execution on a vulnerable TYPO3 instance.
CVE-2026-46275.py:325-364cve-2026-46275-v2.py:228-276 - Command Execution
- Payload withheldThe payload uses a Monolog gadget chain ending in a call to system() with a user-supplied command.
CVE-2026-46275.py:325-349cve-2026-46275-v2.py:247-273 - Network Behavior
- Payload withheldThe script sends HTTP GET requests to the target URL with a malicious cookie to exploit the vulnerability.
CVE-2026-46275.py:486-498cve-2026-46275-v2.py:560-573 - Interactive Shell
- Payload withheldThe script includes an interactive shell feature that repeatedly sends commands to the compromised server.
CVE-2026-46275.py:646-732cve-2026-46275-v2.py:729-818
What the analysis did not establish
- The evidence includes two Python scripts (CVE-2026-46275.py and cve-2026-46275-v2.py) that appear to be versions of the same exploit; only the first was analyzed in detail.
- The CVE context provided in the envelope is for CVE-2026-46275 (a Linux kernel Bluetooth vulnerability), but the artifact's code and README consistently reference CVE-2026-46725 (TYPO3 ceselector). This mismatch is noted but does not affect classification of the artifact's behavior.
- The artifact's code was not executed; classification is based solely on static analysis of the provided source code.
- Only the three text files in the repository were reviewed; no binary files were present or analyzed.
- The review does not assess the safety or reliability of the exploit code when executed against a target.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-5364
Repository PoCStars: 0Created 2026-05-26ExploitCVE-2026-53643 files
Analysis
Technical assessment
Python exploit for CVE-2026-5364 that uploads a PHP webshell to vulnerable WordPress sites via a sanitize_file_name() bypass, then executes OS commands on the target.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python exploit script (CVE-2026-5364.py) and a README.md for CVE-2026-5364, an arbitrary file upload vulnerability in a WordPress plugin. The script performs standard exploit behavior: detecting the plugin, extracting a nonce, uploading a PHP webshell via a sanitize_file_name bypass, and verifying remote code execution. No backdoor, concealed operator-directed harm, or unrelated payload was observed. The script's functionality is fully disclosed in the README and inline comments.
Classification basis and observed behavior
Classification basis
The artifact is a fully functional exploit that performs all steps required to achieve remote code execution: plugin detection, nonce extraction, malicious file upload via a sanitize_file_name() bypass, shell verification, and interactive command execution. It is not a scanner because it actively uploads and executes a webshell, not merely detecting the vulnerability.
CVE-2026-5364.py:388-467CVE-2026-5364.py:511-573CVE-2026-5364.py:851-922Requirements
- Target must run WordPress with the vulnerable plugin (<=1.1.3) and have a page containing a CF7 form to extract the nonce.
CVE-2026-5364.py:284-324README.md:56
Observed behavior
- Detects the vulnerable plugin by checking readme.txt, JS files, and HTML signals.
CVE-2026-5364.py:227-278 - Extracts a nonce from a page containing a CF7 form to authenticate the AJAX upload request.
CVE-2026-5364.py:284-324 - Uploads a PHP webshell by appending a bypass character (e.g., '$') to the filename and extension, exploiting the sanitize_file_name() bypass.
CVE-2026-5364.py:388-467 - Verifies the uploaded shell by sending an OS command and checking the response against known RCE patterns.
CVE-2026-5364.py:511-573 - Provides an interactive shell for continuous command execution on the compromised target.
CVE-2026-5364.py:851-922 - Supports bulk scanning of multiple targets with multi-threading.
CVE-2026-5364.py:734-799
Behaviors behind the backdoor verdict
Observables
- Webshell Payloads
- Payload withheldThese are the payloads uploaded to the target during the exploit; they are standard webshells consistent with the stated CVE and are not a backdoor against the operator.
CVE-2026-5364.py:330-336 - Exploit Technique
- Payload withheldThe script uploads a file named shell.php$ which WordPress sanitizes to shell.php, achieving arbitrary file upload. This is the documented vulnerability mechanism.
CVE-2026-5364.py:388-403 - Interactive Shell
- Payload withheldThis is a standard post-exploitation feature for convenience, not a backdoor. It uses the same webshell URL obtained from the exploit.
CVE-2026-5364.py:851-922
What the analysis did not establish
- Evidence includes only two text files (Python exploit and README); one non-text file (likely an image) was not analyzed.
- The artifact was not executed; classification is based solely on static analysis of the provided source code.
- One non-text media file (42153 bytes) was present in the repository but not analyzed; its metadata-only inventory entry does not indicate executable behavior.
- The review is limited to the supplied text evidence; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-27384
Repository PoCStars: 0Created 2026-05-26ExploitCVE-2026-273843 files
Analysis
Technical assessment
Python exploit for CVE-2026-27384 targeting W3 Total Cache <= 2.9.1. It injects crafted HTML comments containing PHP code via WordPress comment forms or REST API, bypasses the mfunc security token using a missing space and regex metacharacter, and triggers eval() execution through page caching to achieve unauthenticated remote code execution.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python exploit script (CVE-2026-27384.py) and a README.md for CVE-2026-27384, targeting a known vulnerability in W3 Total Cache. The code performs vulnerability detection, payload injection via comment forms or REST API, and output extraction. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload aimed at the operator was observed. The script's behavior is consistent with a public proof-of-concept exploit for the stated CVE.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script that actively injects malicious payloads into a target WordPress site and triggers remote code execution. It does not merely detect the vulnerability; it performs the full exploit chain including payload generation, injection, cache triggering, and output extraction.
CVE-2026-27384.py:495-609Requirements
- Target must have W3 Total Cache <= 2.9.1 installed and active with page caching enabled.
CVE-2026-27384.py:225-268 - Target must have a WordPress post with comments open (HTML form or REST API).
CVE-2026-27384.py:274-318 - W3TC_DYNAMIC_SECURITY token must contain a regex metacharacter (e.g., '.').
README.md:40
Observed behavior
- Detects W3 Total Cache installation and version via readme.txt, HTML, and headers.
CVE-2026-27384.py:225-268 - Locates a WordPress post with an open comment form or accessible REST API endpoint.
CVE-2026-27384.py:274-318 - Generates 64 payload variants using different PHP execution functions, bypass characters, and encoding.
CVE-2026-27384.py:334-363 - Injects payloads as WordPress comments via REST API or HTML form.
CVE-2026-27384.py:369-406 - Triggers page caching by making multiple HTTP requests to the post URL, causing the injected PHP to be evaluated.
CVE-2026-27384.py:416-421 - Extracts command output from the cached page using regex patterns.
CVE-2026-27384.py:431-488 - Supports bulk scanning of multiple targets with multi-threading.
CVE-2026-27384.py:614-659
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the expected behavior of a PoC for CVE-2026-27384 and does not indicate a backdoor.
CVE-2026-27384.py:495-609 - Network Activity
- Payload withheldAll network activity is directed at the user-supplied target; no external or unrelated endpoints are contacted.
CVE-2026-27384.py:186-208 - Payload Generation
- Payload withheldThese are standard RCE payloads for the described vulnerability; no hidden or unrelated commands are embedded.
CVE-2026-27384.py:329-363
What the analysis did not establish
- Evidence includes only two text files (exploit script and README); a third file (likely requirements.txt) is omitted as non-text media.
- The exploit code is not executed; classification is based on static analysis of the provided source code.
- The README describes a separate scanner script (w3tc_rce.py) that is not included in the evidence, so analysis is limited to the provided CVE-2026-27384.py.
- One non-text media file (36371 bytes) was present in the repository but not analyzed; its metadata suggests it is a non-executable image and it is not referenced by the reviewed scripts.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-3296
Repository PoCStars: 0Created 2026-05-26ScannerCVE-2026-32962 files
Analysis
Technical assessment
A Python-based scanner for CVE-2026-3296 that detects the vulnerability by injecting a benign serialized PHP object payload into Everest Forms and checking for successful storage, without exploiting the deserialization flaw for code execution.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python scanner script and a README for CVE-2026-3296, a PHP Object Injection vulnerability in the Everest Forms WordPress plugin. The script automates vulnerability scanning and exploitation of the described CVE. It contains no concealed backdoor, deceptive payload, or operator-directed harm against the person running the PoC. All behavior is consistent with the stated purpose of testing the target vulnerability.
Classification basis and observed behavior
Classification basis
The primary artifact is a scanner. In --mode scan (the default), it injects a benign probe payload (stdClass with no magic methods) to test if the injection path is viable, and reports VULNERABLE without attempting to trigger deserialization or achieve code execution. The --mode inject and --mode full modes require admin credentials to trigger deserialization, but the artifact's default and primary stated operation is vulnerability detection, not exploitation.
CVE-2026-3296.py:19-23CVE-2026-3296.py:78-83CVE-2026-3296.py:646-653CVE-2026-3296.py:835-838Requirements
- Target must have Everest Forms plugin <= 3.4.3 installed and a public form accessible.
CVE-2026-3296.py:525-557
Observed behavior
- Detects the plugin by checking readme.txt, page content, and REST API endpoints.
CVE-2026-3296.py:525-557 - Parses public form pages to extract form IDs, nonces, and field names.
CVE-2026-3296.py:129-241 - Injects a benign stdClass serialized payload into form fields via POST request.
CVE-2026-3296.py:247-357 - Reports VULNERABLE status upon successful injection, indicating the payload was stored and awaits admin trigger.
CVE-2026-3296.py:646-653
Behaviors behind the backdoor verdict
Observables
- Vulnerability Scanner
- Payload withheldThe script automates injection of serialized PHP object payloads into vulnerable WordPress forms and optionally triggers deserialization via admin login. This is normal exploit behavior for the stated CVE.
CVE-2026-3296.py:1-921 - Payload Generation
- Payload withheldGenerates benign probe payloads (stdClass) and placeholders for RCE chains. The RCE placeholders are comments instructing the user to generate real payloads with PHPGGC; they are not executable code.
CVE-2026-3296.py:64-123 - Admin Credential Usage
- Payload withheldThe script accepts admin credentials as command-line arguments and uses them to log into the target WordPress site. This is required for the trigger phase of the exploit and is not a backdoor against the operator.
CVE-2026-3296.py:423-464
What the analysis did not establish
- The evidence includes only two text files (Python script and README); no binary or dependency files were inspected.
- The artifact's complete_artifact_coverage is false, indicating not all repository files were provided.
- The analysis is based solely on static code review; the code was not executed.
- Only the two text files (payload withheld and README.md) were reviewed. No binary files were present in the evidence packet.
- The review does not assess the safety or legality of using this exploit against third-party systems.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-5718
Repository PoCStars: 0Created 2026-05-26ExploitCVE-2026-57182 files
Analysis
Technical assessment
A Python script that automates the full exploitation chain for CVE-2026-5718, including nonce retrieval, form detection, non-ASCII filename bypass, PHP webshell upload, and remote command execution verification.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python exploit script (CVE-2026-5718.py) and a README.md documentation file for CVE-2026-5718. The Python script implements a scanner that exploits a known arbitrary file upload vulnerability in a WordPress plugin to upload a PHP webshell and verify remote code execution. The script's behavior is entirely consistent with the documented vulnerability: it retrieves a nonce, identifies vulnerable forms, uploads a PHP file using a non-ASCII filename bypass, and tests the uploaded shell. No concealed, deceptive, or unrelated harmful behavior was observed. The script does not contain persistence mechanisms, credential theft, unrelated payloads, or any actions beyond the described exploit chain. The README provides technical documentation and manual exploitation steps matching the script's logic.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script (CVE-2026-5718.py) that actively exploits the vulnerability by uploading a PHP webshell and executing commands on the target server. The README.md provides supporting documentation but the core artifact is functional exploit code.
CVE-2026-5718.py:1-3CVE-2026-5718.py:274-286CVE-2026-5718.py:411-437Requirements
- Target must have the vulnerable plugin (<= 1.3.9.6) installed and active with a CF7 form containing an [mfile] field configured with a custom blacklist-types attribute.
README.md:178-182
Observed behavior
- Retrieves a valid nonce by sending a request to the unprotected _wpcf7_check_nonce AJAX endpoint.
CVE-2026-5718.py:96-171 - Locates CF7 forms on the target site that contain file upload fields.
CVE-2026-5718.py:198-268 - Uploads a PHP webshell using a filename containing a non-ASCII character to bypass the wpcf7_antiscript_file_name() sanitization function.
CVE-2026-5718.py:274-376 - Constructs the URL of the uploaded webshell and verifies remote code execution by sending a command and checking the response for expected output.
CVE-2026-5718.py:385-437
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe script's sole purpose is to exploit the documented vulnerability. It builds and uploads a PHP shell, then tests it with a user-specified command. This is normal exploit behavior for the stated target.
CVE-2026-5718.py:274-355CVE-2026-5718.py:411-437 - Shell Payload
- Payload withheldThe script includes multiple PHP shell payloads selectable by the user. These are standard one-liner webshells used for post-exploitation verification, not a backdoor targeting the PoC runner.
CVE-2026-5718.py:74-90
What the analysis did not establish
- Evidence consists of two text files from a repository snapshot; no binary files or external dependencies were inspected.
- The analysis is based solely on static review of the provided source code; the code was not executed or tested.
- The README.md file contains manual exploitation steps and technical analysis, but the primary artifact for classification is the Python exploit script.
- Only the two text files (CVE-2026-5718.py and README.md) were provided and reviewed. No binary files were present in the evidence packet.
- The review does not assess the safety of executing the script against a live target, only whether the script itself contains backdoor behavior against the person running it.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-6741
Repository PoCStars: 0Created 2026-05-26ExploitCVE-2026-67412 files
Analysis
Technical assessment
A Python script that automates the full privilege escalation chain for CVE-2026-6741, including agent login, admin user ID discovery, customer-to-admin linking via the vulnerable ability, password reset triggering, and admin login verification. The script is designed to be executed against a target WordPress site to achieve administrator takeover.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python exploit script (CVE-2026-6741.py) and a README.md documentation file for CVE-2026-6741. The script automates a privilege escalation attack against a specific WordPress plugin (LatePoint <= 5.4.1) by linking a customer record to an administrator account and then resetting the administrator's password. All observed behavior is consistent with the stated exploit purpose: it performs HTTP requests to the target WordPress site to log in, enumerate users, call the vulnerable ability endpoint, trigger password resets, and verify admin access. No concealed backdoor, unrelated payload, credential exfiltration to an external party, persistence mechanism, or deceptive behavior was found. The script's output and file operations are limited to local result reporting and saving to a user-specified file. The README provides documentation and manual curl-based PoC steps that match the script's logic.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script that actively exploits the vulnerability by sending HTTP requests to perform the entire privilege escalation chain, including linking a customer to an admin account and changing the admin's password. It is not merely a scanner; it executes the exploit steps to achieve administrator takeover.
CVE-2026-6741.py:619-759CVE-2026-6741.py:1-21Requirements
- Valid credentials for a WordPress user with the latepoint_agent role.
CVE-2026-6741.py:19 - Target WordPress site running LatePoint plugin version <= 5.4.1 and WordPress 6.9+ with Abilities API enabled.
CVE-2026-6741.py:17-18 - A LatePoint customer record controlled by the attacker.
CVE-2026-6741.py:20
Observed behavior
- Authenticates to WordPress using provided agent credentials and retrieves a REST API nonce.
CVE-2026-6741.py:60-117 - Discovers administrator WordPress user IDs via REST API and author page enumeration.
CVE-2026-6741.py:171-249 - Sends a POST request to the vulnerable connect-customer-to-wp-user ability endpoint to link a customer record to an administrator's WordPress user ID.
CVE-2026-6741.py:304-380 - Triggers the LatePoint password reset flow for the linked customer, which sends a reset email.
CVE-2026-6741.py:386-434 - Completes the password reset using a provided token, which changes the administrator's WordPress password.
CVE-2026-6741.py:440-490 - Logs in as the administrator with the new password and verifies administrative access.
CVE-2026-6741.py:496-554
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe script performs the exact attack chain described in the CVE: agent login, admin user ID discovery, customer-to-admin linking, password reset initiation, and admin login verification. This is the intended exploit behavior, not a backdoor.
CVE-2026-6741.py:619-759 - Network Target
- Payload withheldAll network requests are directed to the target specified by the user via -u/--url or -l/--list. No hardcoded external C2 or exfiltration endpoints are present.
CVE-2026-6741.py:619-636 - File Output
- Payload withheldThe script writes JSON results and a summary line to a local file specified by the user. This is standard operational output for a security scanner, not a persistence or data-hiding mechanism.
CVE-2026-6741.py:781-787CVE-2026-6741.py:898-901
What the analysis did not establish
- The evidence includes a README.md file with manual exploitation steps and technical analysis, but the primary artifact is the Python exploit script.
- The script requires a manual step to obtain the password reset token from email, but it automates all other exploitation steps.
- Only the two text files (CVE-2026-6741.py and README.md) were provided and reviewed. No binary files or other repository content were inspected.
- The review does not assess whether the exploit works as claimed or whether the target plugin is actually vulnerable.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-5229
Repository PoCStars: 0Created 2026-05-26ScannerCVE-2026-52292 files
Analysis
Technical assessment
A Python-based scanner that detects the Form Notify WordPress plugin, discovers target user emails, and attempts to exploit CVE-2026-5229 (LINE OAuth authentication bypass) via cookie injection or email matching. It reports whether authentication was successful but primarily functions as a detection and validation tool.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python scanner and a README for CVE-2026-5229, a WordPress authentication bypass. The Python script performs reconnaissance, sets a cookie, and simulates an OAuth callback to test the vulnerability. No concealed executable behavior, unrelated payload, persistence, or operator-directed harm was observed. The code is consistent with a legitimate proof-of-concept exploit for the stated CVE.
Classification basis and observed behavior
Classification basis
The Python script (CVE-2026-5229.py) is a scanner that detects vulnerable plugin installations, discovers target emails, and attempts to trigger the authentication bypass. It reports success/failure but does not deliver a payload or perform post-exploitation actions. The README describes it as a 'scanner' and 'tarayıcı' (Turkish for scanner).
CVE-2026-5229.py:595README.md:1-3Requirements
- Target WordPress site with Form Notify plugin (<=1.1.10) and LINE Login active
CVE-2026-5229.py:170-226 - Target user email address (auto-discovered or manually provided)
CVE-2026-5229.py:60-164
Observed behavior
- Detects Form Notify plugin and LINE Login activation via REST endpoints, plugin files, and page source
CVE-2026-5229.py:170-226 - Discovers target user emails via WordPress REST API and page scraping
CVE-2026-5229.py:60-164 - Attempts Path A (cookie injection) by setting 'form_notify_line_email' cookie and simulating LINE OAuth callback
CVE-2026-5229.py:232-340 - Attempts Path B (email match) by initiating LINE OAuth flow and providing manual instructions
CVE-2026-5229.py:346-396 - Verifies successful authentication by checking WordPress auth cookies and calling /wp-json/wp/v2/users/me
CVE-2026-5229.py:402-422 - Outputs results with status indicators (AUTH_OK, WP-ADMIN, MANUAL, etc.) and writes successful bypasses to a file
CVE-2026-5229.py:525-587
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the expected behavior of a PoC for the described CVE-2026-5229 vulnerability.
CVE-2026-5229.py:60-164CVE-2026-5229.py:232-340CVE-2026-5229.py:346-396 - Network Communication
- Payload withheldAll network targets are controlled by the user running the script; no data is sent to an attacker-controlled server.
CVE-2026-5229.py:428-445CVE-2026-5229.py:436-437 - File Output
- Payload withheldOutput is limited to saving scan results for the operator's review.
CVE-2026-5229.py:545-550CVE-2026-5229.py:647-655
What the analysis did not establish
- complete_artifact_coverage is false; only two text files are included, and the repository may contain additional files not analyzed
- The scanner uses a mock authorization code ('mock_auth_code_path_a') for Path A, so full automated exploitation is not demonstrated without a real LINE OAuth code
- Review is limited to the two text files (CVE-2026-5229.py and README.md) supplied in the evidence packet. No binary files were identified or analyzed. The script's behavior when executed with real LINE OAuth tokens is not verified.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-6271
Repository PoCStars: 0Created 2026-05-26ExploitCVE-2026-62712 files
Analysis
Technical assessment
Python script that automates unauthenticated arbitrary file upload and remote code execution against the Career Section WordPress plugin (CVE-2026-6271). It discovers job listing pages, extracts a public nonce, uploads a PHP webshell disguised as a PDF, brute-forces the timestamp-based filename, and executes a system command to confirm RCE.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python exploit script (CVE-2026-6271.py) and a README.md for CVE-2026-6271, an unauthenticated arbitrary file upload vulnerability in the Career Section WordPress plugin. The script automates exploitation of the described vulnerability: it discovers job listing URLs, extracts a public nonce, uploads a PHP webshell disguised as a PDF, and brute-forces the timestamp-based filename to achieve remote code execution. All behavior is consistent with a standard proof-of-concept exploit targeting the stated CVE. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed. The code is readable Python with no obfuscation or opaque executable payloads.
Classification basis and observed behavior
Classification basis
The Python script actively uploads a PHP webshell and executes commands on the target, which constitutes exploitation, not just detection or scanning. The README describes the same exploit steps manually and calls the script a 'scanner', but the code's primary operation is exploitation.
CVE-2026-6271.py:194-228CVE-2026-6271.py:276-310README.md:177-178Requirements
- Target must run Career Section plugin version <= 1.7 with at least one published job listing.
README.md:93-94 - The upload directory must allow PHP execution (no .htaccess restriction).
README.md:72
Observed behavior
- Discovers job listing URLs via sitemap, REST API, and common slug guessing.
CVE-2026-6271.py:84-128 - Extracts the csaf_form_nonce from the public HTML of a job listing page.
CVE-2026-6271.py:146-152 - Uploads a PHP webshell file with a spoofed application/pdf MIME type via the job application form.
CVE-2026-6271.py:194-228 - Brute-forces the upload timestamp to locate the uploaded shell and executes a command (default 'id') to confirm RCE.
CVE-2026-6271.py:276-310
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe script performs the exact steps described in the CVE and README to demonstrate the vulnerability. No actions outside the scope of the exploit were identified.
CVE-2026-6271.py:194-268CVE-2026-6271.py:276-310CVE-2026-6271.py:316-375 - Webshell Payload
- Payload withheldThese are standard webshells used to demonstrate RCE on the vulnerable plugin. They are not hidden or unrelated to the exploit.
CVE-2026-6271.py:52-68 - Network Communication
- Payload withheldAll network activity is directed at the target specified by the user and is necessary for the exploit. No external callbacks or data exfiltration to third parties were found.
CVE-2026-6271.py:84-128CVE-2026-6271.py:169-188CVE-2026-6271.py:194-268CVE-2026-6271.py:276-310
What the analysis did not establish
- Evidence is limited to the supplied text files; no runtime behavior or external network interactions were observed.
- The artifact is labeled as a scanner in its own documentation, but the code performs exploitation actions.
- Only the two text files (CVE-2026-6271.py and README.md) were reviewed; no other files from the repository were provided.
- The review is static and does not include dynamic analysis or execution of the script.
- The artifact's network behavior was not observed at runtime; the analysis is based solely on the source code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-2942
Repository PoCStars: 0Created 2026-05-26ScannerCVE-2026-29422 files
Analysis
Technical assessment
A Python-based scanner that checks for CVE-2026-2942, an unauthenticated arbitrary file upload vulnerability in the ProSolution WP Client WordPress plugin. It attempts to extract a nonce from public pages, upload a PHP webshell using MIME type spoofing, and optionally verify remote code execution. The tool is designed for bulk scanning and reporting, not for delivering a single targeted exploit payload.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python scanner (CVE-2026-2942.py) and a README.md that together implement and document a proof-of-concept exploit for CVE-2026-2942, an unauthenticated arbitrary file upload vulnerability in the ProSolution WP Client WordPress plugin. The scanner automates nonce extraction, uploads a PHP webshell with a spoofed MIME type, and optionally verifies remote code execution. All behavior is consistent with the stated exploit objective. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a scanner. It is designed to check multiple targets for the presence of the vulnerability, report status, and optionally verify RCE. It includes bulk scanning, progress reporting, and output file writing, which are characteristic of a vulnerability scanner rather than a single-use exploit. The README explicitly calls it a 'scanner' and 'tarayıcı' (Turkish for scanner).
CVE-2026-2942.py:3README.md:1README.md:144CVE-2026-2942.py:374CVE-2026-2942.py:428-445Requirements
- Target must have the ProSolution WP Client plugin (<= 1.9.9) active with a public page containing the [prosolfrontend] shortcode to expose the nonce.
README.md:7README.md:52-53
Observed behavior
- Scans a single URL or a list of URLs. For each target, it fetches the homepage and other common paths to extract a nonce from the prosolObj JavaScript object.
CVE-2026-2942.py:79-154CVE-2026-2942.py:272-315 - Sends a POST request to /wp-admin/admin-ajax.php with action=proSol_fileUploadProcess, the extracted nonce, and a PHP file disguised with image/jpeg MIME type.
CVE-2026-2942.py:182-246 - Parses the JSON response to determine if the PHP file was uploaded successfully (extension remains .php).
CVE-2026-2942.py:214-239 - Optionally verifies RCE by requesting the uploaded shell URL with a command parameter and checking for expected output (e.g., 'uid=').
CVE-2026-2942.py:252-266CVE-2026-2942.py:307-312 - Reports results with color-coded status messages (UPLOADED, BLOCKED, NO_NONCE, etc.) and writes successful shell URLs to an output file.
CVE-2026-2942.py:321-366CVE-2026-2942.py:422-425
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe scanner performs the exact steps described in the CVE and README to exploit the file upload vulnerability. This is normal exploit behavior, not a backdoor.
CVE-2026-2942.py:182-246CVE-2026-2942.py:252-266CVE-2026-2942.py:272-315 - Webshell Payload
- Payload withheldThe payloads are standard PHP webshells used to demonstrate RCE on the target. They are part of the advertised exploit and do not indicate a backdoor against the operator.
CVE-2026-2942.py:160-176
What the analysis did not establish
- Evidence is limited to the two text files provided; no binary or additional source files were inspected.
- The artifact's complete_artifact_coverage is false, indicating not all repository files were included, though the two provided files appear complete.
- Classification is based solely on static analysis of the provided source code; the code was not executed, and its actual behavior is not verified.
- Only the two text files (CVE-2026-2942.py and README.md) were provided and reviewed. No binary files were present. The analysis does not cover any external dependencies (e.g., the 'requests' library) or the runtime behavior of the Python interpreter.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-41940
Repository PoCStars: 0Created 2026-05-23Not analyzedCVE-2026-419404 files
GitHubxxconi/CVE-2026-6279
Repository PoCStars: 0Created 2026-05-23ExploitCVE-2026-62792 files
Analysis
Technical assessment
A Python exploit for CVE-2026-6279 that achieves unauthenticated remote code execution on Avada Builder <= 3.15.2 by injecting PHP functions via the 'wp_conditional_tags' case in call_user_func(). It includes nonce extraction, Cloudflare origin IP bypass, an interactive shell, and batch scanning.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a Python script and README that exploit CVE-2026-6279 (unauthenticated RCE in Avada Builder) by sending crafted AJAX requests to a target WordPress site. The code performs only the advertised exploit behavior: nonce extraction, AJAX endpoint discovery, and command execution via call_user_func injection. No concealed backdoor, unrelated payload, credential exfiltration to an external party, or persistence mechanism was observed. The script includes an interactive shell, batch scanning, file upload/download, and reverse shell features, all of which are standard post-exploitation utilities consistent with the stated vulnerability and do not constitute a backdoor.
Classification basis and observed behavior
Classification basis
The artifact is a fully functional exploit that actively sends malicious payloads to achieve remote code execution. It does not merely detect or report the vulnerability; it exploits it by calling system(), passthru(), and other PHP functions to run arbitrary commands on the target.
CVE-2026-6279.py:718-724CVE-2026-6279.py:732-826Requirements
- Target must have Avada Builder <= 3.15.2 installed and active.
CVE-2026-6279.py:32 - Target must expose the fusion_load_nonce, which requires a public page containing the [fusion_post_cards] or [fusion_table_of_contents] shortcode.
CVE-2026-6279.py:106-118
Observed behavior
- Extracts the fusion_load_nonce from public pages by searching for specific JavaScript patterns.
CVE-2026-6279.py:121-132 - Sends crafted POST requests to the wp_ajax_nopriv_fusion_get_widget_markup endpoint with a base64-encoded JSON payload that calls arbitrary PHP functions like system() or file_get_contents().
CVE-2026-6279.py:413-445 - Attempts to bypass Cloudflare by resolving origin IP addresses and sending requests directly.
CVE-2026-6279.py:363-397 - Provides an interactive shell for command execution, file upload/download, and system reconnaissance.
CVE-2026-6279.py:948-1006 - Supports batch scanning of multiple targets from a file.
CVE-2026-6279.py:1014-1103
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the exact exploit chain described in CVE-2026-6279 and the README. No additional hidden actions were found.
CVE-2026-6279.py:418-445CVE-2026-6279.py:468-496 - Post Exploitation Features
- Payload withheldThese are standard post-exploitation capabilities for a verified RCE PoC. They operate only against the targeted host and do not exfiltrate data to an unrelated third party.
CVE-2026-6279.py:948-1006CVE-2026-6279.py:1145-1226 - Contact Information
- Payload withheldContact information is present but does not constitute a backdoor. The script does not phone home or transmit data to this Telegram channel.
README.md:284
What the analysis did not establish
- Evidence is limited to the provided repository snapshot; no external network or runtime behavior was observed.
- The artifact's effectiveness depends on the target's configuration and the presence of required shortcodes, which cannot be verified from the evidence alone.
- Only the two text files (CVE-2026-6279.py and README.md) were provided and reviewed. No binary files were present.
- The script uses eval-like PHP constructs (assert) and system command execution, which are inherent to the RCE exploit and not a separate backdoor.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-9018
Repository PoCStars: 1Created 2026-05-23ExploitCVE-2026-90182 files
Analysis
Technical assessment
Python script that exploits CVE-2026-9018, an unauthenticated privilege escalation vulnerability in the Easy Elements for Elementor WordPress plugin. The script fetches a nonce from a public page, then sends a crafted AJAX request to overwrite the wp_capabilities user meta key, creating a new administrator account.
Backdoor review
No backdoor observed in reviewed code
The PoC script (CVE-2026-9018.py) and its README.md describe and implement a standard privilege escalation exploit for CVE-2026-9018. The script sends a crafted POST request to the target's AJAX endpoint to overwrite user meta and create an administrator account, then optionally verifies the login. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm beyond the stated exploit were observed.
Classification basis and observed behavior
Classification basis
The Python script actively exploits the vulnerability by sending a crafted request to create an administrator account, which is the definition of exploit code. It does not merely detect or report the vulnerability.
CVE-2026-9018.py:74-82CVE-2026-9018.py:89-90Requirements
- WordPress user registration must be enabled on the target site.
README.md:34 - A page with the plugin's Login/Register widget must be publicly accessible and expose the easy_elements_nonce in the DOM.
README.md:35-36
Observed behavior
- Fetches the easy_elements_nonce from a specified page by matching regex patterns against the HTML.
CVE-2026-9018.py:32-60 - Sends a POST request to /wp-admin/admin-ajax.php with action=eel_register and custom_meta[wp_capabilities][administrator]=1 to create a new administrator user.
CVE-2026-9018.py:63-107 - Optionally verifies the new administrator account by logging into /wp-login.php and checking for /wp-admin/ in the redirect URL.
CVE-2026-9018.py:110-137
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented vulnerability exploitation step; it matches the CVE description and is the core of the PoC.
CVE-2026-9018.py:74-82 - Exploit Behavior
- Payload withheldRequired prerequisite for the exploit; the nonce is publicly exposed by the vulnerable plugin.
CVE-2026-9018.py:32-60 - Exploit Behavior
- Payload withheldPost-exploit verification step; confirms the newly created account has administrative privileges.
CVE-2026-9018.py:110-137 - Network Target
- Payload withheldThe script only interacts with the target specified by the user; no hardcoded external callbacks or data exfiltration endpoints.
CVE-2026-9018.py:146-147
What the analysis did not establish
- Only the two supplied text files (CVE-2026-9018.py and README.md) were reviewed; no other repository files were inspected.
- No dynamic or runtime analysis was performed; the review is based solely on static source code analysis.
- Binary files were flagged as metadata-only and not analyzed, though none were reported in this artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubxxconi/CVE-2026-6960
Repository PoCStars: 0Created 2026-05-23ExploitCVE-2026-69602 files
Analysis
Technical assessment
Python script that exploits CVE-2026-6960, an unauthenticated arbitrary file upload vulnerability in BookingPress Pro <= 5.6, by uploading a PHP web shell via a data URI in a signature custom field and then verifying remote code execution.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward exploit for CVE-2026-6960. It uploads a PHP web shell via a data URI in a signature field, then verifies execution. No concealed backdoor, unrelated payload, or deceptive behavior was observed. The shell code is clearly disclosed and its purpose is consistent with the stated vulnerability.
Classification basis and observed behavior
Classification basis
The Python script actively uploads a PHP web shell to a target server and then executes commands on it, which constitutes exploitation, not just detection or scanning.
CVE-2026-6960.py:38CVE-2026-6960.py:187-225CVE-2026-6960.py:231-247Requirements
- A signature-type custom field must be configured in the BookingPress booking form by the site admin.
CVE-2026-6960.py:274-275 - At least one active service must exist to generate a valid timeslot.
README.md:39 - A page with the BookingPress booking form widget must be publicly accessible.
README.md:40
Observed behavior
- Fetches a WordPress nonce from a booking page.
CVE-2026-6960.py:57-85 - Fetches a timeslot transient key via an AJAX request.
CVE-2026-6960.py:91-133 - Fetches a pre-booking verification token via an AJAX request.
CVE-2026-6960.py:139-181 - Uploads a PHP web shell by sending a data URI in the 'bookingpress_signature_field' parameter to the 'bookingpress_book_appointment_booking' AJAX action.
CVE-2026-6960.py:187-225 - Verifies remote code execution by requesting the uploaded shell with a 'cmd' parameter and checking for command output.
CVE-2026-6960.py:231-247
Behaviors behind the backdoor verdict
Observables
- Web Shell Payload
- Payload withheldThe PoC deploys a simple PHP web shell to demonstrate RCE, which is the expected outcome of the described arbitrary file upload vulnerability.
CVE-2026-6960.py:38 - Exploit Flow
- Payload withheldThe entire exploit flow is dedicated to exploiting the CVE-2026-6960 vulnerability. No steps perform unrelated actions.
CVE-2026-6960.py:57-247
What the analysis did not establish
- Evidence is limited to the supplied text files; no binary or opaque content was present.
- The artifact's behavior is inferred from static analysis of the source code; the code was not executed.
- The README.md file describes a v2 correction based on community feedback, but the evidence does not include the v1 code for comparison.
- Only the two text files (CVE-2026-6960.py and README.md) were reviewed. No binary files were present in the evidence packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.