matesz44
Source-scoped identity with 8 associated PoCs and 9 linked vulnerabilities.
Exploit catalog results
Showing 8 PoCs on this page
GitHubmatesz44/cve-2026-39987
Repository PoCStars: 0Created 2026-08-12ExploitCVE-2026-399875 files
Analysis
Technical assessment
Go-based exploit for CVE-2026-39987 that connects to the unauthenticated /terminal/ws WebSocket endpoint on Marimo <0.23.0 to obtain a PTY shell and execute arbitrary system commands.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Go-based proof-of-concept (PoC) exploit for CVE-2026-39987, a pre-authentication remote code execution vulnerability in Marimo. The provided source code (main.go) and documentation (README.md) describe and implement a straightforward WebSocket client that connects to the vulnerable /terminal/ws endpoint and executes user-supplied commands. No concealed, deceptive, or operator-directed harmful behavior beyond the advertised exploit functionality was observed in the reviewed text files.
Classification basis and observed behavior
Classification basis
The artifact is a command-line tool that actively exploits the missing authentication on the /terminal/ws endpoint to execute arbitrary commands on the target. The README and main.go show it takes a target URL, connects via WebSocket, and runs commands (default 'uname -a', custom via -c, or interactive shell via -i). This is exploitation, not just detection or scanning.
README.md:14cmd/cve-2026-39987/main.go:14-15cmd/cve-2026-39987/main.go:17-19README.md:47-81Requirements
- Target running Marimo <0.23.0 with the /terminal/ws WebSocket endpoint exposed.
README.md:14
Observed behavior
- Connects to the target WebSocket URL without authentication.
cmd/cve-2026-39987/main.go:17 - Executes a default command (uname -a) or a user-specified command on the remote host via the terminal session.
README.md:47-55README.md:57-66 - Supports an interactive mode that provides a live shell to the attacker.
README.md:68-81
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe PoC implements the advertised CVE-2026-39987 exploit by connecting to the vulnerable endpoint and running commands, which is the expected behavior for a PoC.
cmd/cve-2026-39987/main.go:14-15cmd/cve-2026-39987/main.go:17-19cmd/cve-2026-39987/main.go:31-36 - Dependency
- Payload withheldStandard WebSocket library used for the exploit connection; no indication of malicious modification.
go.mod:6
What the analysis did not establish
- The runner package (pkg/runner) that contains the actual WebSocket connection and command execution logic is not included in the supplied text files; only main.go, README.md, go.mod, and go.sum are provided.
- The evidence does not include the go.sum file content for the runner package, so the exact implementation of the exploit connection and shell interaction cannot be verified from the supplied text alone.
- The pkg/runner package source is not included in the selected text files; its implementation is unknown.
- One file (likely a binary or non-text file) was omitted from the text evidence and not analyzed.
- The go.sum file was provided as text but its binary content was not inspected for tampering.
- The review is limited to static analysis of the provided text; no dynamic execution or network behavior was observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubmatesz44/CVE-2025-64512
Repository PoCStars: 4Created 2026-07-19ExploitCVE-2025-645125 files
Analysis
Technical assessment
The artifact contains a complete exploit for CVE-2025-64512, consisting of a malicious pickle generator (mkpickle.py) and a malicious PDF generator (mkpdf.py) that triggers arbitrary code execution in pdfminer.six via pickle deserialization.
Backdoor review
No backdoor observed in reviewed code
The supplied text evidence is a straightforward Proof of Concept (PoC) for CVE-2025-64512. It demonstrates how to create a malicious PDF and a corresponding pickle payload to trigger arbitrary code execution in a vulnerable version of pdfminer.six. The scripts' behavior is entirely consistent with the documented vulnerability and contains no concealed, deceptive, or operator-directed harmful actions beyond the stated exploit. The two binary files (payload withheld and ex-poc.pdf) were not analyzed, but their purpose is fully explained by the text scripts.
Classification basis and observed behavior
Classification basis
The artifact includes code that generates a malicious payload (mkpickle.py) and a trigger (mkpdf.py) designed to exercise the vulnerability and achieve arbitrary code execution, as demonstrated in the README. This is an exploit, not merely a scanner or writeup.
mkpickle.py:12-17mkpdf.py:17-25README.txt:33-45Requirements
- A target system running a vulnerable version of pdfminer.six (< 20251107) that processes the generated malicious PDF.
README.txt:1 - The generated malicious pickle file must be placed at a path accessible to the target, either via upload or by specifying an absolute path in the PDF.
README.txt:37
Observed behavior
- mkpickle.py creates a gzipped pickle file containing a malicious class that executes an arbitrary OS command upon deserialization.
mkpickle.py:12-17 - mkpdf.py generates a PDF that embeds a crafted font encoding path, which pdfminer.six interprets as a file path to load and deserialize the malicious pickle file.
mkpdf.py:17-25 - The README demonstrates a full attack chain: generating a pickle that runs 'touch /tmp/a', uploading it, generating a PDF pointing to it, and confirming the file was created.
README.txt:33-45
Behaviors behind the backdoor verdict
Observables
- Command Execution
- Payload withheldThe mkpickle.py script creates a pickle payload that executes an arbitrary command provided by the user. This is the core of the CVE-2025-64512 PoC.
mkpickle.py:14 - File Creation
- Payload withheldThe mkpickle.py script generates a gzipped pickle file containing the exploit payload.
mkpickle.py:16-17 - File Creation
- Payload withheldThe mkpdf.py script generates a malicious PDF designed to trigger the deserialization of the pickle payload.
mkpdf.py:43-44
What the analysis did not establish
- Two binary files (payload withheld and ex-poc.pdf) are present but were not analyzed; their content is inferred from the text scripts and README.
- The evidence does not include the execution output of the exploit; the README describes a successful run but this is not independently verified.
- Two binary files (payload withheld, ex-poc.pdf) were present in the artifact but were not analyzed. Their content could not be verified against the text scripts that purportedly generated them.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubmatesz44/CVE-2025-47812
Repository PoCStars: 0Created 2026-02-15ExploitCVE-2025-478121 file
Analysis
Technical assessment
A shell script that exploits CVE-2025-47812 in Wing FTP Server 7.4.3 by sending a crafted HTTP POST request with a null byte and injected Lua code to achieve unauthenticated remote code execution, then retrieves the command output via a second request.
Backdoor review
No backdoor observed in reviewed code
The PoC is a single shell script that exploits CVE-2025-47812 by sending a crafted HTTP POST with a null byte and Lua injection to execute a user-supplied command on a vulnerable Wing FTP Server, then retrieves the output. The script performs only the advertised exploit behavior; no concealed backdoor, unrelated payload, or operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by sending a crafted payload that injects Lua code to execute an arbitrary system command, then retrieves the output. This is not a scanner or writeup; it is functional exploit code.
CVE-2025-47812.sh:17-20Requirements
- Target running Wing FTP Server 7.4.3 with anonymous access enabled
CVE-2025-47812.sh:8 - curl must be installed on the attacker's machine
CVE-2025-47812.sh:9
Observed behavior
- Sends an HTTP POST request to /loginok.html with a username containing a null byte and injected Lua code that executes a system command via io.popen
CVE-2025-47812.sh:17 - Extracts a UID cookie from the response
CVE-2025-47812.sh:18 - Sends a second HTTP GET request to /dir.html with the extracted UID cookie to retrieve the command output
CVE-2025-47812.sh:19-20
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe script constructs a POST body with 'username=anonymous%00]]%0dlocal+h+%3d+io.popen(...' to inject Lua code into a session file, consistent with the CVE description.
CVE-2025-47812.sh:17 - Command Execution
- Payload withheldThe script takes a second argument CMD and interpolates it into the Lua injection payload, executing it on the target server.
CVE-2025-47812.sh:15-17 - Output Retrieval
- Payload withheldThe script extracts a session cookie from the login response and uses it to fetch the command output from /dir.html, then filters the response.
CVE-2025-47812.sh:18-20
What the analysis did not establish
- Only the shell script source is provided; no execution output or environment details are included.
- The script assumes anonymous access is enabled; it may not work if authentication is required.
- Only the single text file CVE-2025-47812.sh was reviewed; no other files exist in the artifact.
- The review does not assess whether the exploit is effective or safe to run.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubmatesz44/CVE-2025-6018-19
Repository PoCStars: 0Created 2026-02-11ExploitCVE-2025-6018CVE-2025-60191 file
Analysis
Technical assessment
A shell script that implements a two-stage local privilege escalation chain: first, it creates a .pam_environment file to elevate an unprivileged user to an 'allow_active' Polkit session (CVE-2025-6018); second, it uses udisks to mount a crafted XFS image containing a SUID-root shell, then triggers a filesystem resize to execute the shell and gain root (CVE-2025-6019).
Backdoor review
No backdoor observed in reviewed code
The supplied PoC script (CVE-2025-6018-19.sh) implements the described local privilege escalation chain for CVE-2025-6018 and CVE-2025-6019. It creates a SUID-root shell on an XFS image, sets environment variables to gain allow_active status, and uses udisks to mount the image for root access. No concealed backdoor, unrelated payload, or deceptive behavior was observed.
Classification basis and observed behavior
Classification basis
The script contains complete, executable code that actively performs privilege escalation steps: it writes a malicious pam_environment file to gain allow_active status, crafts a SUID-root XFS image, and uses udisks to mount and execute it, resulting in a root shell. This is exploitation, not mere detection or scanning.
CVE-2025-6018-19.sh:15-36CVE-2025-6018-19.sh:38-55Requirements
- Local unprivileged user access (e.g., via SSH).
CVE-2025-6018-19.sh:1 - Target system must be SUSE 15 with vulnerable PAM and libblockdev/udisks.
CVE-2025-6018-19.sh:2 - Ability to transfer a crafted XFS image to the target.
CVE-2025-6018-19.sh:9
Observed behavior
- Creates ~/.pam_environment with XDG_SEAT and XDG_VTNR overrides to spoof an active local session.
CVE-2025-6018-19.sh:15-21 - Builds a 300MB XFS image, copies /bin/bash into it, and sets the SUID bit and root ownership.
CVE-2025-6018-19.sh:38-55 - Kills gvfs-udisks2-volume-monitor, sets up a loop device for the XFS image, and triggers a udisks filesystem resize to mount the image with root privileges.
CVE-2025-6018-19.sh:30-33 - Executes the SUID-root bash shell from the mounted image to gain root.
CVE-2025-6018-19.sh:35
Behaviors behind the backdoor verdict
Observables
- SUID Binary Creation
- Payload withheldThe xfs() function creates a SUID-root bash binary on a crafted XFS image, which is the core of the CVE-2025-6019 exploit.
CVE-2025-6018-19.sh:50-52 - Environment Variable Manipulation
- Payload withheldThe pam() function sets environment variables to trick PAM into granting allow_active status, as described in CVE-2025-6018.
CVE-2025-6018-19.sh:16 - Privilege Escalation Trigger
- Payload withheldThe root() function mounts the crafted XFS image via udisks, triggering the CVE-2025-6019 vulnerability to gain root access.
CVE-2025-6018-19.sh:31-33
What the analysis did not establish
- Evidence is a single shell script; no execution or runtime verification was performed.
- The script references an external advisory URL (line 2) not included in the evidence.
- The script assumes specific vulnerable SUSE 15 configurations; no environment validation is performed.
- Only the single text file CVE-2025-6018-19.sh was reviewed; no other files were present in the artifact.
- The script's behavior was assessed statically; dynamic execution or side effects were not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubmatesz44/CVE-2025-49132
Repository PoCStars: 1Created 2026-02-10ExploitCVE-2025-491321 file
Analysis
Technical assessment
A shell script that exploits CVE-2025-49132, an unauthenticated local file inclusion (LFI) vulnerability in Pterodactyl Panel, to achieve remote code execution (RCE) via pearcmd. The script constructs a malicious request to write a PHP webshell to /tmp, then uses a second request to execute an arbitrary system command through that webshell.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a single shell script that exploits CVE-2025-49132 to achieve remote code execution on a vulnerable Pterodactyl Panel instance. All actions are consistent with the stated exploit goal: it uses the LFI and pearcmd technique to write a webshell and then execute a user-supplied command. No concealed backdoor, unrelated payload, persistence mechanism, or credential exfiltration was observed.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by sending crafted requests to write a webshell and then execute arbitrary commands on the target, which is the definition of exploit code.
CVE-2025-49132.sh:23-24CVE-2025-49132.sh:26-27Requirements
- A target Pterodactyl Panel instance vulnerable to CVE-2025-49132 (version < 1.11.11).
CVE-2025-49132.sh:2 - The 'encode' tool (from payload withheld) is optional for URL-encoding the command; otherwise, manual encoding is required.
CVE-2025-49132.sh:8CVE-2025-49132.sh:15-16 - Standard Unix utilities: curl, uuidgen, awk.
CVE-2025-49132.sh:8CVE-2025-49132.sh:17-18CVE-2025-49132.sh:27
Observed behavior
- Accepts a target URL and a command to execute as command-line arguments.
CVE-2025-49132.sh:6-7CVE-2025-49132.sh:13-14 - Generates random names for the webshell file and the GET parameter used to pass commands.
CVE-2025-49132.sh:17-18 - Iterates over a list of common PHP PEAR include paths and sends a crafted HTTP request to the /locales/locale.json endpoint. The request exploits an LFI to invoke pearcmd and write a PHP webshell containing eval($_GET[param]) to /tmp.
CVE-2025-49132.sh:21-24 - Sends a second HTTP request to the same endpoint, using the LFI to include the newly created webshell from /tmp and passing the attacker-supplied command via the generated GET parameter to system().
CVE-2025-49132.sh:26-27 - Parses the HTTP response to extract and display the command output.
CVE-2025-49132.sh:27
Behaviors behind the backdoor verdict
Observables
- Exploit Technique
- Payload withheldThe script leverages the CVE-2025-49132 vulnerability to write a PHP webshell to /tmp/ and then execute a command through it.
CVE-2025-49132.sh:23CVE-2025-49132.sh:26-27 - Dependency
- Payload withheldThe script optionally uses an external tool 'encode' for URL encoding. The tool is not bundled and its absence only results in a warning; the script still functions.
CVE-2025-49132.sh:8CVE-2025-49132.sh:15-16
What the analysis did not establish
- Only the single shell script file was provided; no other repository files (e.g., README, auxiliary tools) were included.
- The script's effectiveness depends on the target having a writable /tmp directory and one of the hardcoded PEAR paths being correct.
- The analysis is based solely on static review of the provided text; the code was not executed.
- The review is limited to the single text file CVE-2025-49132.sh. No binary files or other artifacts were present in the evidence packet.
- The script references an external tool (payload withheld) that was not provided for review. Its behavior is not assessed, but the script does not download or execute it.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubmatesz44/CVE-2025-9074
Repository PoCStars: 0Created 2026-02-09ExploitCVE-2025-90741 file
Analysis
Technical assessment
A shell script that exploits CVE-2025-9074 by using curl to interact with the unauthenticated Docker Engine API on a default Docker Desktop subnet address. It lists images, creates a new container from an existing image with a reverse shell payload and host filesystem bind mounts, then starts the container to gain code execution and host filesystem access.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC script (CVE-2025-9074.sh) is a straightforward shell script that exploits the described Docker Desktop vulnerability to create and start a container with a reverse shell and host filesystem bind mounts. No backdoor, deceptive payload, or concealed operator-directed harm is present. The script's behavior is fully consistent with a public proof-of-concept for the stated CVE.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by sending API calls to create and start a malicious container that executes a reverse shell and mounts the host filesystem. It does not merely detect or report the vulnerability; it performs the exploitation steps.
CVE-2025-9074.sh:19-22Requirements
- A reverse shell listener must be started before running the script (e.g., nc -l 9002).
CVE-2025-9074.sh:5 - The script must be executed with four arguments: target Docker API IP, port, attacker LHOST, and LPORT.
CVE-2025-9074.sh:6-7CVE-2025-9074.sh:12 - The attacking container must have bash and curl available.
CVE-2025-9074.sh:8
Observed behavior
- Fetches the list of Docker images from the target API and extracts the first image's RepoTags.
CVE-2025-9074.sh:19 - Constructs a JSON payload to create a new container using the discovered image, with a command that spawns a bash reverse shell to the attacker's LHOST:LPORT.
CVE-2025-9074.sh:20 - The container creation payload includes HostConfig Binds to mount the host root filesystem (/mnt/host/c:/host_root_win and /:/host_root_nix), enabling host filesystem access.
CVE-2025-9074.sh:20 - Sends the container creation request to the Docker API and extracts the new container ID from the response.
CVE-2025-9074.sh:21 - Starts the newly created container via the Docker API, triggering the reverse shell and host mount.
CVE-2025-9074.sh:22
Behaviors behind the backdoor verdict
Observables
- Reverse Shell
- Payload withheldThe script creates a Docker container that connects back to a user-supplied IP and port, which is standard PoC behavior for demonstrating code execution.
CVE-2025-9074.sh:20 - Host Mount
- Payload withheldThe script mounts host filesystem paths into the container, demonstrating the privilege escalation impact described in the CVE.
CVE-2025-9074.sh:20
What the analysis did not establish
- Only one file (CVE-2025-9074.sh) is provided; no other repository contents (e.g., README, Dockerfile) are included.
- The script's behavior is inferred from static analysis; it was not executed, and its effectiveness or safety is not verified.
- The evidence packet reports complete_artifact_coverage, but the repository may contain additional files not included in this packet.
- Only the single text file CVE-2025-9074.sh was reviewed; no other files exist in the repository snapshot.
- The script's behavior depends on the user-supplied parameters; the review does not assess the safety of the target environment or the user's intent.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubmatesz44/CVE-2025-24367
Repository PoCStars: 1Created 2026-01-15ExploitCVE-2025-243671 file
Analysis
Technical assessment
A shell script that authenticates to a Cacti instance, exploits CVE-2025-24367 to create a PHP webshell containing an attacker-supplied command, triggers its execution, and retrieves the command output.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a single shell script that automates exploitation of CVE-2025-24367 in Cacti. It logs in, injects a PHP payload via a crafted graph request, triggers execution, and retrieves the output of a user-supplied command. All behavior is consistent with a legitimate proof-of-concept for the described vulnerability; no concealed backdoor, unrelated payload, or operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The script actively exploits CVE-2025-24367 by authenticating, injecting a payload to create a PHP webshell, executing it, and retrieving command output. This constitutes an exploit, not a scanner or writeup.
CVE-2025-24367.sh:2CVE-2025-24367.sh:21-22CVE-2025-24367.sh:24CVE-2025-24367.sh:26Requirements
- Valid Cacti credentials (USER, PW) and target URL.
CVE-2025-24367.sh:2 - curl must be installed on the attacker's machine.
CVE-2025-24367.sh:4
Observed behavior
- Authenticates to the Cacti web application by extracting CSRF token and session cookie, then submitting login credentials.
CVE-2025-24367.sh:12-17 - Sends a crafted POST request to graphs.php that injects a command into a graph template parameter, causing the server to create a PHP file (a.php) containing a webshell that executes the attacker's command.
CVE-2025-24367.sh:21-22 - Triggers execution of the created PHP file by requesting graph_json.php.
CVE-2025-24367.sh:24 - Fetches the webshell output and parses the command result.
CVE-2025-24367.sh:26
Behaviors behind the backdoor verdict
Observables
- Command Execution
- Payload withheldThe script accepts a user-supplied command as the fourth argument and encodes spaces for shell injection into the PHP payload.
CVE-2025-24367.sh:9 - Payload Injection
- Payload withheldThe payload exploits Cacti's graph creation functionality to write a PHP file containing the user-supplied command, matching the CVE description.
CVE-2025-24367.sh:21-22 - Remote Code Execution
- Payload withheldThe script fetches the generated PHP file to execute the injected command and parses the output, demonstrating successful RCE.
CVE-2025-24367.sh:26
What the analysis did not establish
- Only one file (CVE-2025-24367.sh) is provided; no other repository contents are available.
- The script is not executed; analysis is based solely on static review of the shell script.
- Only the single text file CVE-2025-24367.sh was reviewed; no other files exist in the repository snapshot.
- The script's behavior depends on the target Cacti version and configuration; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubmatesz44/CVE-2009-2265
Repository PoCStars: 0Created 2026-01-12ExploitCVE-2009-22651 file
Analysis
Technical assessment
Shell script that generates a JSP reverse shell payload with msfvenom, uploads it to a vulnerable FCKeditor instance via a directory traversal in the upload path, and then triggers the payload via curl.
Backdoor review
No backdoor observed in reviewed code
The single shell script (CVE-2009-2265.sh) is a straightforward proof-of-concept exploit for CVE-2009-2265. It generates a reverse shell payload with msfvenom, uploads it via the vulnerable FCKeditor connector using a null-byte injection, triggers the payload with curl, and cleans up the local file. No backdoor, deceptive payload, or operator-directed harm beyond the stated exploit is present.
Classification basis and observed behavior
Classification basis
The script actively exploits CVE-2009-2265 by uploading a JSP reverse shell payload to a vulnerable FCKeditor connector and then executing it, which goes beyond mere detection or scanning.
CVE-2009-2265.sh:7-11Requirements
- Target must be running a vulnerable version of Adobe ColdFusion 8 with FCKeditor connector enabled and accessible at the default path.
CVE-2009-2265.sh:2CVE-2009-2265.sh:8 - Attacker must have network access to the target and a listener ready to receive the reverse shell on the specified LHOST and LPORT.
CVE-2009-2265.sh:4CVE-2009-2265.sh:7
Observed behavior
- Generates a random lowercase filename using uuidgen and tr.
CVE-2009-2265.sh:6 - Creates a JSP reverse shell payload using msfvenom and saves it to a .txt file.
CVE-2009-2265.sh:7 - Uploads the payload to the target via a crafted HTTP POST request to the FCKeditor upload endpoint, using a null byte injection in the CurrentFolder parameter to bypass extension checks and place the file as a .jsp.
CVE-2009-2265.sh:8-9 - Deletes the local payload file after upload.
CVE-2009-2265.sh:10 - Triggers execution of the uploaded JSP reverse shell by requesting it via HTTP.
CVE-2009-2265.sh:11
Behaviors behind the backdoor verdict
Observables
- Reverse Shell Payload
- Payload withheldThe script generates a Metasploit reverse shell payload targeting the operator-supplied LHOST and LPORT. This is the expected exploit behavior for the stated CVE.
CVE-2009-2265.sh:7 - Exploit Upload Mechanism
- Payload withheldThe script uploads the generated payload to the target server using the FCKeditor upload vulnerability with a null-byte injection to bypass extension checks. This matches the described CVE-2009-2265 exploitation technique.
CVE-2009-2265.sh:8-9 - Payload Trigger
- Payload withheldThe script triggers the uploaded JSP reverse shell by requesting it via HTTP. This is the final step of the exploit chain.
CVE-2009-2265.sh:11
What the analysis did not establish
- Only one file (CVE-2009-2265.sh) was provided; no other repository contents were inspected.
- The script's actual functionality (e.g., msfvenom payload generation) was not executed or verified.
- Review is based solely on the supplied text of the single shell script; no binary files or external dependencies were analyzed.
- The script's behavior depends on the operator-supplied arguments (LHOST, LPORT, TARGET); the review does not assess the safety of the generated Metasploit payload itself, which is a standard reverse shell.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.