Jenderal92
Source-scoped identity with 25 associated PoCs and 25 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
GitHubJenderal92/CVE-2026-49049
Repository PoCStars: 0Created 2026-08-02ScannerCVE-2026-490492 files
Analysis
Technical assessment
A Python 2.7 mass scanner that checks Joomla sites for CVE-2026-49049 by sending a crafted POST request to the Helix3 com_ajax endpoint and then verifying whether a PHP payload was executed or stored as raw text.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python 2 script that implements a mass scanner for CVE-2026-49049. The script sends crafted POST requests to a Joomla Helix3 endpoint to upload a PHP file and then checks whether the PHP code is executed. All behavior is consistent with the stated purpose of vulnerability scanning. No concealed operator-directed harm, credential theft, persistence, or unrelated payloads were observed.
Classification basis and observed behavior
Classification basis
The artifact's primary operation is checking for vulnerability without exploiting it. It sends a request to trigger file upload and then inspects the response to determine if code execution occurred, classifying targets as vulnerable or not. It does not provide an interactive shell or perform post-exploitation actions; it only detects and reports exposure.
cve-2026-49049.py:46-132README.md:1-3Requirements
- Python 2.7 and requests library
README.md:32-33 - Target list file with one URL per line
README.md:54-55
Observed behavior
- Sends POST request to /index.php?option=com_ajax&plugin=helix3&format=json with payload containing directory traversal path, PHP file name, and PHP content
cve-2026-49049.py:57-95 - Checks if uploaded PHP file is accessible and whether PHP code was executed or displayed as raw text
cve-2026-49049.py:100-118 - Classifies target as VULNERABLE if PHP code executed, RAW PHP if uploaded but not executed, or NOT VULNERABLE otherwise
cve-2026-49049.py:107-129 - Saves results to results.txt (vulnerable) and rez.txt (raw PHP)
cve-2026-49049.py:31-44
Behaviors behind the backdoor verdict
Observables
- Uploaded Payload
- Payload withheldThe payload is uploaded to the target server as part of the vulnerability check. It is a standard proof-of-concept payload that echoes a string and provides an upload form, consistent with demonstrating remote code execution.
cve-2026-49049.py:69-86 - Network Request
- Payload withheldThe script targets the vulnerable endpoint described in CVE-2026-49049 to test for the vulnerability.
cve-2026-49049.py:57cve-2026-49049.py:98 - Output File
- Payload withheldThe script writes results to local files, which is normal for a scanner.
cve-2026-49049.py:17-18cve-2026-49049.py:37-44
What the analysis did not establish
- Evidence is limited to static source code analysis; no runtime behavior or network traffic was observed.
- The artifact is described as a scanner in its own documentation and code comments, but classification is based on code logic, not self-labeling.
- Only the two text files (README.md and cve-2026-49049.py) were reviewed; no binary files or network captures were provided.
- The review does not assess the safety of the uploaded PHP payload on a target system, only whether the scanner itself contains backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/CVE-2026-56290
Repository PoCStars: 4Created 2026-07-08ExploitCVE-2026-562902 files
Analysis
Technical assessment
A Python 2.7 mass exploitation tool for CVE-2026-56290 that uploads a PHP web shell to vulnerable Joomla Page Builder CK instances via an unauthenticated file upload vulnerability.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python 2 exploit script (CVE-2026-56290.py) and a README.md file. The script targets CVE-2026-56290, an unauthenticated file upload vulnerability in the Joomla Page Builder CK extension. It extracts a CSRF token, uploads a PHP web shell to a known writable directory, and confirms successful upload. The uploaded shell provides a file upload form and displays system information. No backdoor, deceptive payload, or concealed operator-directed harm targeting the person running the PoC was observed. The script's behavior is consistent with a standard proof-of-concept exploit for the stated vulnerability.
Classification basis and observed behavior
Classification basis
The artifact is classified as an exploit because its primary purpose is to exercise the CVE-2026-56290 vulnerability by uploading a functional PHP web shell to a target system, thereby achieving remote code execution. The code actively exploits the vulnerability rather than merely detecting it.
CVE-2026-56290.py:94-141CVE-2026-56290.py:103README.md:17Requirements
- A list of target Joomla URLs, one per line, provided as a command-line argument.
CVE-2026-56290.py:181-189 - Python 2.7 with requests and colorama libraries installed.
README.md:42-50
Observed behavior
- Fetches a CSRF token from the target Joomla site's homepage.
CVE-2026-56290.py:62-92 - Uploads a PHP web shell to the /payload withheld directory via an unauthenticated POST request to index.php?option=com_pagebuilderck&task=browse.ajaxAddPicture.
CVE-2026-56290.py:94-141 - Confirms successful shell upload by sending a GET request to the uploaded file and checking for the string 'Shinday' in the response.
CVE-2026-56290.py:128-133 - Saves the URL of the confirmed web shell to a local file (payload withheld) for later access.
CVE-2026-56290.py:32-37
Behaviors behind the backdoor verdict
Observables
- Uploaded Web Shell
- Payload withheldThe PHP code uploaded to the target server. It displays a banner, system information, and a file upload form. This is a standard web shell used to demonstrate remote code execution on the vulnerable target, not a payload targeting the exploit operator.
CVE-2026-56290.py:103 - Target Upload Path
- Payload withheldThe directory on the target Joomla server where the PHP shell is uploaded. This path is specific to the vulnerable component and is used to achieve RCE on the target.
CVE-2026-56290.py:100 - Output File
- Payload withheldThe local file where successful shell URLs are saved. This is standard output logging for a mass exploitation tool and does not indicate backdoor behavior.
CVE-2026-56290.py:23
What the analysis did not establish
- The evidence includes only the Python exploit script and its README; no network traffic, execution logs, or target environment details are provided to confirm the exploit's effectiveness.
- Review is limited to the supplied text files (CVE-2026-56290.py and README.md). No binary files were present. The script is not executed, and dynamic behavior is not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/CVE-2026-48908
Repository PoCStars: 3Created 2026-07-07ExploitCVE-2026-489082 files
Analysis
Technical assessment
A Python 2.7 script that exploits CVE-2026-48908, an unauthenticated arbitrary file upload vulnerability in the SP Page Builder Joomla extension, to achieve remote code execution by uploading a PHP web shell.
Backdoor review
No backdoor observed in reviewed code
The PoC exploits CVE-2026-48908 by uploading a ZIP containing a PHP webshell. The webshell code is fully visible and provides a file upload interface and server information, consistent with the stated RCE goal. No concealed, unrelated, or operator-directed harmful behavior (e.g., credential theft, persistence, unrelated payload) is present. Commented-out alternative payloads are inert and do not execute.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script that actively uploads a PHP web shell to a vulnerable target and verifies its execution, which is the definition of an exploit. The README explicitly describes it as a 'Proof-of-concept exploit'.
CVE-2026-48908.py:76-105README.md:1-3Requirements
- Target must be running a vulnerable version of SP Page Builder (1.0.0 - 6.6.1) with the uploadCustomIcon task exposed.
README.md:16 - Python 2.7 and the 'requests' library are required to run the script.
README.md:70-71
Observed behavior
- Constructs a ZIP archive mimicking a valid icon-font package containing a PHP web shell at 'fonts/shxt.php' or 'fonts/shxt.PHP'.
CVE-2026-48908.py:26-50 - Sends a multipart POST request to the vulnerable 'asset.uploadCustomIcon' endpoint to upload the crafted ZIP file without authentication.
CVE-2026-48908.py:52-59 - Verifies successful exploitation by sending a GET request to the uploaded shell and checking for the presence of the string 'Shinday' in the response.
CVE-2026-48908.py:61-68 - Logs the URL of the successfully uploaded web shell to 'result.txt'.
CVE-2026-48908.py:130-131
Behaviors behind the backdoor verdict
Observables
- Webshell Payload
- Payload withheldThe active PHP webshell embedded in the uploaded ZIP. It displays server information and provides a file upload form, which is standard for a PoC demonstrating RCE.
CVE-2026-48908.py:29 - Commented Out Payload
- Payload withheldA commented-out PHP payload that would fetch and execute remote code. It is never assigned to shell_bytes or written to the ZIP; it remains inert.
CVE-2026-48908.py:31
What the analysis did not establish
- The evidence is limited to the provided source code and README; no runtime behavior, network traffic, or target system state was observed.
- The script is written for Python 2.7, which is end-of-life, and its functionality on modern systems is not verified.
- Review is based solely on the supplied text files; no dynamic analysis was performed.
- The commented-out payload (line 31) references an external URL that could be malicious if activated, but the script does not use it.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/laravel-filemanager-unrestricted-upload
Repository PoCStars: 2Created 2026-06-28ExploitCVE-2025-563993 files
Analysis
Technical assessment
The artifact is a Python 2.7 script (lfm.py) that automates the exploitation of CVE-2025-56399 in alexusmai/laravel-file-manager. It detects vulnerable endpoints, extracts CSRF tokens, uploads a PHP web shell disguised as a GIF, and verifies remote code execution by accessing the shell.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2025-56399. The Python script (lfm.py) automates the documented attack chain: detecting a vulnerable FileManager, extracting a CSRF token, uploading a PHP web shell disguised as a GIF, and verifying its execution. The uploaded PHP payload provides a file upload form and system information, which is standard behavior for a web shell used in a PoC. No concealed backdoor, unrelated remote access, credential theft, persistence mechanism, or deceptive payload targeting the PoC operator was observed. The script's actions are consistent with the described exploit and do not exhibit hidden harmful functionality.
Classification basis and observed behavior
Classification basis
The script actively uploads a PHP web shell to a target server and verifies its execution, which constitutes exploitation, not just detection or scanning. The README explicitly describes it as a 'Proof of Concept (PoC)' that 'automates the entire process' of achieving RCE.
lfm.py:126-132README.md:10-17Requirements
- Valid authentication credentials for the target Laravel application.
lfm.py:1 - The target must have alexusmai/laravel-file-manager (≤ 3.3.1) installed and accessible.
README.md:10
Observed behavior
- Probes common FileManager paths to detect the presence of the vulnerable component.
lfm.py:38-43 - Extracts CSRF token from the page source to authenticate subsequent requests.
lfm.py:55-63 - Uploads a .htaccess file and a PHP web shell (shxt_<timestamp>.php) with a GIF MIME type to the server.
lfm.py:117-132 - Verifies successful exploitation by accessing the uploaded shell with a specific parameter and checking for a unique string.
lfm.py:148-153 - Saves the URL of the verified web shell to a file named valid.txt.
lfm.py:152-153
Behaviors behind the backdoor verdict
Observables
- Web Shell Payload
- Payload withheldThis is the payload uploaded to the target server as part of the PoC. It is a standard web shell used to demonstrate RCE, not a backdoor targeting the PoC operator.
lfm.py:126 - Uploaded File
- Payload withheldThe script attempts to upload an .htaccess file to the target server. This is part of the exploit to potentially bypass restrictions, not a backdoor against the operator.
lfm.py:117-124
What the analysis did not establish
- The evidence does not include any authentication credentials or session handling logic; the script assumes the user is already authenticated or that the target does not require authentication for the file manager endpoints.
- The script uses Python 2.7, which is end-of-life, and may not function correctly in modern environments without modification.
- The evidence is limited to the source code and README; no network traffic, server responses, or execution logs are provided to confirm the exploit's effectiveness.
- Only the three text files in the repository were reviewed; no binary or non-text files were present.
- The review does not assess the safety or legality of executing the PoC against any system.
- The analysis is limited to the supplied evidence and does not inspect external dependencies or runtime behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/CVE-2026-8206
Repository PoCStars: 3Created 2026-06-02ExploitCVE-2026-82062 files
Analysis
Technical assessment
A Python 2.7 script that exploits CVE-2026-8206 in the Kirki WordPress plugin (≤ 6.0.6) by sending a crafted POST request to the unauthenticated REST endpoint `payload withheld` with an arbitrary attacker-controlled email address, causing the password reset link to be sent to the attacker.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward exploit for CVE-2026-8206. It sends crafted password-reset requests to a vulnerable WordPress REST endpoint using attacker-supplied email and harvested nonces. No concealed backdoor, unrelated payload, or operator-directed harm is present. The code performs only the advertised exploit behavior.
Classification basis and observed behavior
Classification basis
The script actively sends a crafted POST request to the vulnerable endpoint to trigger the password reset email being sent to the attacker's address, which constitutes exploitation, not mere detection.
CVE-2026-8206.py:149-173README.md:6Requirements
- Target must run a vulnerable version of the Kirki plugin (≤ 6.0.6).
CVE-2026-8206.py:59 - A valid WordPress username must be known or enumerable.
CVE-2026-8206.py:175-184 - A valid WordPress nonce must be extractable from the target site.
CVE-2026-8206.py:83-115
Observed behavior
- Detects the Kirki plugin version by reading readme.txt and kirki.min.css.
CVE-2026-8206.py:49-81 - Enumerates usernames via the WordPress REST API or falls back to 'admin'.
CVE-2026-8206.py:175-184 - Harvests nonces from multiple common WordPress paths using regex patterns.
CVE-2026-8206.py:83-147 - Sends a POST request to the vulnerable endpoint with the target username, attacker email, and harvested nonce.
CVE-2026-8206.py:149-173 - Writes successfully exploited targets to payload withheld.
CVE-2026-8206.py:223-224
Behaviors behind the backdoor verdict
Observables
- Attacker Email
- Payload withheldHardcoded placeholder email used in exploit payload; user is instructed to replace it with their own.
CVE-2026-8206.py:13 - Exploit Endpoint
- Payload withheldThe vulnerable REST endpoint targeted by the exploit.
CVE-2026-8206.py:160 - Output File
- Payload withheldFile where successful exploit results are logged; contains target URL, username, and attacker email.
CVE-2026-8206.py:223-224
What the analysis did not establish
- Evidence is limited to the supplied source code and README; no runtime behavior or network traffic was observed.
- The script is written for Python 2.7, which may affect execution in modern environments.
- Only the two text files (CVE-2026-8206.py and README.md) were reviewed; no binary or other files were present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/CVE-2026-8732
Repository PoCStars: 3Created 2026-05-30ExploitCVE-2026-87322 files
Analysis
Technical assessment
A Python 2.7 script that exploits CVE-2026-8732 in WP Maps Pro. It extracts a publicly available nonce, sends a crafted AJAX request to obtain a magic login token, then uses the authenticated session to create a new administrator user via the WordPress admin panel, resulting in full site takeover.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a Python 2.7 script that exploits CVE-2026-8732 by extracting a nonce, obtaining a token via an AJAX endpoint, and then creating a new administrator user on vulnerable WordPress sites. All observed behavior is consistent with the stated exploit purpose. No concealed backdoor, unrelated payload, or operator-directed harm was found in the reviewed text files.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by obtaining a token and then creating a new administrator account on the target system. It goes beyond detection or scanning by performing the full privilege escalation chain, including account creation and credential persistence.
CVE-2026-8732.py:165-233README.md:8-10Requirements
- Target must be running a vulnerable version of WP Maps Pro (<= 6.1.0) with the wpgmp_temp_access_ajax endpoint exposed.
CVE-2026-8732.py:182-188 - The target's frontend must embed the fc-call-nonce or wpgmp_local nonce in the page source.
CVE-2026-8732.py:40-45
Observed behavior
- Extracts a nonce from the target's homepage HTML by searching for wpgmp_local or fc-call-nonce patterns.
CVE-2026-8732.py:34-48 - Sends a POST request to /wp-admin/admin-ajax.php with action=wpgmp_temp_access_ajax, the extracted nonce, and check_temp=false to obtain a magic login token.
CVE-2026-8732.py:182-201 - Parses the AJAX response to extract a token and an optional redirect URL, then visits the redirect URL to establish an authenticated session.
CVE-2026-8732.py:77-109CVE-2026-8732.py:210-216 - Uses the authenticated session to access /wp-admin/user-new.php, extracts the create-user nonce, and submits a form to create a new administrator user with a hardcoded password.
CVE-2026-8732.py:111-163 - Saves the created administrator credentials (domain, username, password, email) to admin_created.txt.
CVE-2026-8732.py:63-75
Behaviors behind the backdoor verdict
Observables
- Credential Creation
- Payload withheldThe script creates a new administrator account on the target site using these hardcoded values. This is the intended exploit outcome described in the CVE and README.
CVE-2026-8732.py:18-20CVE-2026-8732.py:218-223 - File Output
- Payload withheldThe script writes discovered tokens and created admin credentials to local files. This is standard PoC logging and does not indicate exfiltration to an external party.
CVE-2026-8732.py:15-16CVE-2026-8732.py:50-75 - Network Request
- Payload withheldThis is the vulnerable AJAX endpoint described in the CVE. The script sends the extracted nonce and handler parameters to trigger the privilege escalation.
CVE-2026-8732.py:182-201
What the analysis did not establish
- The evidence consists of static source code and documentation; the code was not executed, so its actual behavior and reliability are not verified.
- The README.md contains minor inaccuracies (e.g., refers to 'WP Google Map Pro' and version '1.5.0' instead of 'WP Maps Pro' and '6.1.0'), but the code targets the correct CVE.
- Only the two text files (CVE-2026-8732.py and README.md) were reviewed; no binary or other file types were present in the evidence packet.
- The review does not assess whether the exploit works as claimed or whether the target plugin is actually vulnerable.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/CVE-2025-55182-React2shell
Repository PoCStars: 6Created 2026-05-25ExploitCVE-2025-551822 files
Analysis
Technical assessment
A Python 2.7 script that exploits CVE-2025-55182, a pre-authentication RCE vulnerability in React Server Components, by sending a crafted multipart request to execute arbitrary system commands on a target Next.js server and extracting the output from the redirect response.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python 2.7 exploit script (CVE-2025-55182.py) and its README.md. The script sends crafted HTTP requests to exploit CVE-2025-55182 (a React Server Components deserialization vulnerability) to achieve remote code execution. It provides an interactive shell and a mass-scanning mode. All behavior is consistent with a public proof-of-concept exploit for the stated CVE. No concealed executable behavior, persistence mechanisms, credential theft, unrelated payloads, or operator-directed harm beyond the declared exploit functionality were observed.
Classification basis and observed behavior
Classification basis
The script actively sends a malicious payload to a target server to achieve remote code execution, as demonstrated by the execute_cmd function that constructs and sends an exploit request and extracts command output. This is exploitation, not mere detection or scanning.
CVE-2025-55182.py:35-86README.md:3-4Requirements
- Target must be running a vulnerable version of React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) with a Server Function endpoint.
CVE-2025-55182.py:1 - Python 2.7 and the 'requests' library must be installed on the attacker's machine.
README.md:22-26
Observed behavior
- Sends a crafted multipart/form-data POST request to the target URL (appending '/login' if path is empty) with specific headers (Next-Action, X-Nextjs-Request-Id, X-Nextjs-Html-Request-Id) and a JSON payload that exploits prototype pollution to inject a malicious JavaScript prefix.
CVE-2025-55182.py:35-75 - The injected prefix uses child_process.execSync to execute an attacker-supplied system command and throws an error containing the command output in a redirect digest.
CVE-2025-55182.py:46-47 - Extracts the command output from the 'x-action-redirect' response header by parsing the '/login?a=' parameter.
CVE-2025-55182.py:76-84 - Provides an interactive shell for a single target, allowing repeated command execution, and a mass scan mode that tests multiple URLs from a file using multithreading.
CVE-2025-55182.py:143-191CVE-2025-55182.py:103-141
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe script constructs a payload that abuses __proto__:then and constructor:constructor to inject a malicious _prefix containing child_process.execSync() for command execution, consistent with the described CVE-2025-55182 vulnerability.
CVE-2025-55182.py:35-86 - Command Execution
- Payload withheldThe execute_cmd function sends the crafted payload and extracts command output from the x-action-redirect header. The interactive_shell and mass_scan functions allow user-supplied commands to be executed on vulnerable targets.
CVE-2025-55182.py:35-86CVE-2025-55182.py:143-191CVE-2025-55182.py:88-101 - Network Communication
- Payload withheldThe script uses the requests library to send the exploit payload to the target. It sets specific headers (Next-Action, X-Nextjs-Request-Id) required for the vulnerability.
CVE-2025-55182.py:66-75 - File Output
- Payload withheldIn mass scan mode, the script appends the domain and command output to a user-specified output file. This is standard logging for a scanning tool.
CVE-2025-55182.py:95-99
What the analysis did not establish
- Review is limited to the two text files provided; no binary or non-text files were present in the artifact.
- The script requires the 'requests' library, which is an external dependency not included in the artifact; its behavior is not reviewed here.
- The artifact is a proof-of-concept exploit; its use against unauthorized targets is illegal, but the code itself contains no backdoor.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/CVE-2026-4885
Repository PoCStars: 0Created 2026-05-23ExploitCVE-2026-48852 files
Analysis
Technical assessment
A Python 2 script that exploits CVE-2026-4885, an unauthenticated arbitrary file upload vulnerability in Piotnet Addons for Elementor Pro ≤ 7.1.70. It uploads a PHP web shell via the pafe_ajax_form_builder AJAX handler, leaks the shell URL, and verifies execution.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward mass-exploitation script for CVE-2026-4885. It uploads a PHP webshell to vulnerable WordPress sites using the documented vulnerability. The embedded shell provides server info and a file upload form, which is standard post-exploitation behavior. No concealed backdoor, credential theft, persistence mechanism, or unrelated payload was observed. The script's behavior is fully described in the README and implemented transparently in the Python code.
Classification basis and observed behavior
Classification basis
The script actively uploads a PHP web shell to a vulnerable target, leaks its URL, and verifies remote code execution. This is exploitation, not mere detection or scanning.
CVE-2026-4885.py:188-200CVE-2026-4885.py:271-284README.md:3-5Requirements
- Target must run Piotnet Addons for Elementor Pro ≤ 7.1.70 with a form containing a file upload field.
CVE-2026-4885.py:1
Observed behavior
- Detects plugin version via homepage asset regex or known CSS/JS paths.
CVE-2026-4885.py:97-129 - Crawls target pages to extract post_id, form_id, and file upload field name from Piotnet-specific HTML attributes.
CVE-2026-4885.py:153-186 - Uploads a PHP web shell (with GIF89a header) via multipart POST to wp-admin/admin-ajax.php?action=pafe_ajax_form_builder, trying multiple extensions (.phtml, .php3, .php4, .phps, .pht, .php2).
CVE-2026-4885.py:188-200CVE-2026-4885.py:238-245 - Leaks the uploaded shell URL by requesting pafe_export_database and parsing the CSV response.
CVE-2026-4885.py:202-215 - Verifies shell execution by fetching the leaked URL and checking for the 'Logic_Internet' string, then saves the URL to payload withheld.
CVE-2026-4885.py:271-284
Behaviors behind the backdoor verdict
Observables
- Embedded Webshell
- Payload withheldThe script uploads this PHP code to the target server as part of the exploit. It is a simple webshell that displays system information and provides a file upload form. This is the intended payload for the CVE-2026-4885 exploit and is not hidden or deceptive.
CVE-2026-4885.py:27-35 - Output File
- Payload withheldSuccessful shell URLs are saved to this file. This is a standard feature for mass exploitation tools to collect results.
CVE-2026-4885.py:16CVE-2026-4885.py:275-276 - Network Behavior
- Payload withheldThese requests exploit the vulnerable plugin endpoints to upload a file and leak its URL. This is the documented exploit path for CVE-2026-4885.
CVE-2026-4885.py:195-200CVE-2026-4885.py:204
What the analysis did not establish
- Only the two text files (CVE-2026-4885.py and README.md) were reviewed. No binary files were present in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/CVE-2026-5118
Repository PoCStars: 0Created 2026-05-21ExploitCVE-2026-51182 files
Analysis
Technical assessment
Python 2 script that exploits CVE-2026-5118 by sending a crafted multipart POST request to /wp-admin/admin-ajax.php with role=administrator to create an administrator account on vulnerable Divi Form Builder installations.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python 2 exploit script (CVE-2026-5118.py) and its README.md documentation. The script performs exactly the privilege escalation attack described in CVE-2026-5118: it extracts a nonce, sends a crafted POST request with role=administrator to admin-ajax.php, and logs successful registrations. No concealed backdoor, unrelated payload, persistence mechanism, credential exfiltration to an external party, or deceptive behavior beyond the stated exploit was observed. The script's actions are limited to the documented vulnerability exploitation and local result logging.
Classification basis and observed behavior
Classification basis
The script actively sends a crafted HTTP request to create an administrator account on a remote target, which is the definition of an exploit. It does not merely detect the vulnerability; it exercises it to achieve privilege escalation.
CVE-2026-5118.py:68-107README.md:10-14Requirements
- Target must run a vulnerable version of Divi Form Builder (<= 5.1.2) with a registration form that exposes fb_nonce.
CVE-2026-5118.py:32-55README.md:1 - Target URL must be reachable and the registration endpoint must accept the crafted role parameter.
CVE-2026-5118.py:68-107
Observed behavior
- Normalizes a supplied URL and fetches the target homepage to extract a fb_nonce value using multiple regex patterns.
CVE-2026-5118.py:24-55 - Constructs a multipart/form-data POST request to /wp-admin/admin-ajax.php containing action=de_fb_ajax_submit_ajax_handler, the extracted nonce, role=administrator, and attacker-controlled username, password, and email.
CVE-2026-5118.py:68-98 - Sends the request and checks the response for success keywords (e.g., 'registration successful', 'user_id') to determine if an administrator account was created.
CVE-2026-5118.py:100-107 - Saves successful target admin URLs and credentials to payload withheld and prints a success message.
CVE-2026-5118.py:109-115 - Uses multi-threading (default 20 threads) to iterate over a list of targets from a file, calling the exploit function on each.
CVE-2026-5118.py:117-130CVE-2026-5118.py:147-182
Behaviors behind the backdoor verdict
Observables
- Credential Creation
- Payload withheldHardcoded credentials used for the privilege escalation attack; consistent with the documented exploit behavior.
CVE-2026-5118.py:16-18 - Exploit Target
- Payload withheldThe core exploit mechanism matching the CVE description; no additional or unrelated actions are performed.
CVE-2026-5118.py:68-107 - Output File
- Payload withheldSuccessful exploit results are saved locally in the format 'admin_url|username|password'; no network exfiltration is performed.
CVE-2026-5118.py:109-115
What the analysis did not establish
- Evidence is limited to the supplied text files; no runtime behavior or network traffic was observed.
- The script is written for Python 2 and may not run in modern environments without modification, but this does not affect its classification as an exploit.
- Only the two text files (CVE-2026-5118.py and README.md) were provided; no other repository files were inspected.
- The script uses Python 2 and imports urllib2, threading, and Queue; no third-party dependencies or binary payloads are present.
- The analysis is static and does not execute the code; dynamic behavior is not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/CVE-2026-8181
Repository PoCStars: 0Created 2026-05-16ExploitCVE-2026-81813 files
Analysis
Technical assessment
A Python 2.7 script that exploits CVE-2026-8181 in the Burst Statistics WordPress plugin. It bypasses REST API authentication using a crafted header, retrieves application passwords, verifies privileged access, and creates a new administrator user on vulnerable targets.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward Python 2.7 exploit for CVE-2026-8181. It performs authentication bypass, credential retrieval, and admin user creation on vulnerable WordPress sites, all consistent with the described vulnerability. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed. The script writes results to local files (res_login.txt, full_res_login.txt) as documented, with no external exfiltration or hidden actions.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by sending crafted requests to bypass authentication, retrieve credentials, and create a new admin user. It does not merely detect the vulnerability; it performs the full attack chain described in the CVE.
CVE-2026-8181.py:199-236README.md:1-3Requirements
- Target must be running a vulnerable version of the Burst Statistics plugin (3.4.0 to 3.4.1.1).
README.md:9 - Attacker must know or be able to enumerate an administrator username.
CVE-2026-8181.py:41-63
Observed behavior
- Enumerates a WordPress username via the REST API or author redirects.
CVE-2026-8181.py:41-63 - Sends a crafted request with X-BURSTMAINWP header and Basic auth to test authentication bypass.
CVE-2026-8181.py:65-71 - Retrieves an application password token from the /burst/v1/mainwp-auth endpoint.
CVE-2026-8181.py:73-101 - Verifies privileged access by reading WordPress settings, plugins, and admin users.
CVE-2026-8181.py:103-126 - Creates a new administrator user account via the REST API.
CVE-2026-8181.py:128-152 - Saves obtained credentials to local files (res_login.txt, full_res_login.txt).
CVE-2026-8181.py:154-197
Behaviors behind the backdoor verdict
Observables
- Credential Harvesting
- Payload withheldThis is the intended exploit behavior for CVE-2026-8181, not a backdoor.
CVE-2026-8181.py:73-101CVE-2026-8181.py:128-152 - Local File Write
- Payload withheldDocumented output behavior; no evidence of remote exfiltration.
CVE-2026-8181.py:154-197
What the analysis did not establish
- One file (unclassified, 2875 bytes) was omitted from the packet; its content is unknown.
- The evidence was not executed; classification is based solely on static analysis of the provided source code.
- One file (metadata-only) was not inspected; it is a non-text file with no content provided, but its metadata shows no executable code.
- The review does not assess the safety of running the script on a system, only whether the script itself contains backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/magento-upload-auto-submit-zoneh
Repository PoCStars: 0Created 2026-05-13Model review verdict: Suspicious behavior.ExploitCVE-2025-542362 files
AnalysisSuspicious behavior
Technical assessment
Python script that exploits CVE-2025-54236 in Adobe Commerce/Magento by uploading an arbitrary file via the /customer/address_file/upload endpoint, verifying its public accessibility, and automatically submitting the defacement to Zone-H.
Backdoor review
Suspicious behaviorThe PoC for CVE-2025-54236 is a Magento file upload exploit. After a successful upload, the script automatically submits the defacement URL to the Zone-H defacement archive without any operator configuration or opt-in. This automatic submission is a materially concealed, non-consensual data exfiltration that sends exploit results to a third party, contradicting the tool's stated purpose of authorized security testing.
Classification basis and observed behavior
Classification basis
The script actively uploads a file containing a defacement message to a target server and verifies its public accessibility, which constitutes exploitation rather than mere detection or scanning.
blabla.py:96-155blabla.py:186-195Requirements
- Target must be running a vulnerable version of Adobe Commerce/Magento with the /customer/address_file/upload endpoint exposed.
blabla.py:126 - Attacker must provide a list of target hosts in a text file.
blabla.py:200
Observed behavior
- Sends a POST request to /customer/address_file/upload with a crafted multipart form containing a file payload disguised as a country_id custom attribute.
blabla.py:110-132 - Parses the JSON response to extract the uploaded file path and verifies the file is publicly accessible by requesting it from multiple potential media directories.
blabla.py:137-148 - Automatically submits the URL of the successfully uploaded file to the Zone-H defacement archive.
blabla.py:157-179
Behaviors behind the backdoor verdict
Flagged behaviors
- The script automatically submits the URL of a successfully uploaded file to the Zone-H defacement archive (payload withheld) without any operator configuration, opt-in, or disclosure in the README. This sends the target's domain and the fact of a successful exploit to a third party, which is a concealed harm separate from the disclosed exploit.
blabla.py:157-179blabla.py:192
Observables
- Url
- Payload withheldThird-party defacement archive endpoint to which successful exploit results are automatically submitted.
blabla.py:173 - Domain
- Payload withheldDomain of the third-party service receiving automatic submissions.
blabla.py:173
What the analysis did not establish
- The review does not assess the validity or reachability of the Zone-H endpoint.
- The review does not determine whether the operator is aware of or consents to the Zone-H submission.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/CVE-2026-41940
Repository PoCStars: 4Created 2026-05-01ExploitCVE-2026-419403 files
Analysis
Technical assessment
A Python 2.7 script that performs a multi-stage authentication bypass against WHM/cPanel (CVE-2026-41940) using CRLF injection, then changes the root password to 'payload withheld' on successfully exploited targets.
Backdoor review
No backdoor observed in reviewed code
The PoC is a Python 2.7 script that exploits CVE-2026-41940, an authentication bypass in WHM/cPanel. It performs a multi-stage attack to gain root access and then changes the root password to a hardcoded value ('payload withheld'). The script's behavior is fully disclosed in the README and source code. All network actions target the operator-supplied remote hosts; no local persistence, data exfiltration to third parties, or concealed unrelated payloads were found. The hardcoded password and output format are transparently described.
Classification basis and observed behavior
Classification basis
The script actively performs a multi-stage attack to bypass authentication and then changes the root password on the target system. This is exploitation, not merely detection or scanning.
CVE-2026-41940.py:233-238CVE-2026-41940.py:276-353Requirements
- Target must be running a vulnerable version of WHM/cPanel on port 2087 (or a specified port).
CVE-2026-41940.py:34-47 - The script requires Python 2.7 and the 'requests', 'urllib3', and 'futures' packages.
requirements.txt:1-3
Observed behavior
- Sends a POST request to /login/?login_only=1 with invalid credentials to obtain a whostmgrsession cookie.
CVE-2026-41940.py:93-120 - Sends a GET request with a malicious Authorization header containing a Base64-encoded CRLF injection payload to inject fake session parameters.
CVE-2026-41940.py:122-143 - Accesses /scripts2/listaccts to trigger the do_token_denied mechanism and propagate the injected session.
CVE-2026-41940.py:145-162 - Verifies root access by calling /json-api/version, then calls /json-api/passwd to change the root password to 'payload withheld'.
CVE-2026-41940.py:164-274 - Saves successfully exploited targets (host:port|root|payload withheld) to payload withheld.
CVE-2026-41940.py:391-399
Behaviors behind the backdoor verdict
Observables
- Hardcoded Password
- Payload withheldThe exploit changes the root password of the target WHM/cPanel server to this value. This is the disclosed payload of the exploit.
CVE-2026-41940.py:237README.md:21 - Output File
- Payload withheldThe script writes successfully exploited targets in the format 'domain:port|root|payload withheld' to this local file. This is the disclosed output mechanism.
CVE-2026-41940.py:396-398 - Exploit Stages
- Payload withheldThe exploit follows a documented 4-stage process to bypass authentication and change the root password on the target.
README.md:217-267
What the analysis did not establish
- The evidence packet contains only the three text files from the repository snapshot; no binary files or external dependencies were inspected.
- The analysis is based solely on static review of the provided source code; the code was not executed, and its actual behavior on a live target is not verified.
- Only the three text files in the repository were reviewed; no compiled binaries or external dependencies were inspected.
- The review does not assess the validity or safety of the exploit against any specific target.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/livewire-vuln-scanner
Repository PoCStars: 0Created 2026-01-30ScannerCVE-2025-540682 files
Analysis
Technical assessment
A Python 2.7 script that passively scans websites for Livewire versions by inspecting HTML/JavaScript content and flags targets running versions below 3.6.4 as vulnerable. It does not exploit the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python 2.7 script that passively scans websites for Livewire versions and flags those below 3.6.4 as vulnerable. It performs only HTTP GET requests to user-supplied targets, extracts version strings from responses, and writes vulnerable domains to a local file. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed source code or documentation.
Classification basis and observed behavior
Classification basis
The README explicitly states the tool 'does not exploit any vulnerability' and only analyzes public page content to detect versions. The code performs HTTP GET requests and version comparison without any payload delivery or command execution, consistent with a scanner.
README.md:6-8livewire_scan.py:67-91Requirements
- A list of target URLs in a text file.
livewire_scan.py:98-100
Observed behavior
- Fetches the homepage of each target URL via HTTP GET.
livewire_scan.py:67-73 - Searches the response body for Livewire version strings using regular expressions.
livewire_scan.py:77-80 - Compares the detected version against 3.6.4 and prints VULN or SAFE.
livewire_scan.py:82-91 - Writes domains identified as vulnerable to vuln.txt.
livewire_scan.py:85-87
Behaviors behind the backdoor verdict
Observables
- Network Behavior
- Payload withheldThe script fetches page content to detect Livewire versions; no data exfiltration or command-and-control communication is implemented.
livewire_scan.py:67-73 - File Write
- Payload withheldOutput is a simple list of domains matching the version condition; no executable payload or persistence mechanism is written.
livewire_scan.py:85-87
What the analysis did not establish
- Only the two text files in the repository snapshot were reviewed; no binary or non-text files were present.
- The review does not assess the safety of the external link in the README disclaimer (line 100).
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubJenderal92/WP-CVE-2025-6934
Repository PoCStars: 0Created 2025-10-05ExploitCVE-2025-69342 files
Analysis
Technical assessment
Python 2 script that exploits CVE-2025-6934 by sending crafted registration requests to the Opal Estate Pro WordPress plugin, attempting to create a new user with the 'administrator' role without authentication.
Backdoor review
No backdoor observed in reviewed code
The PoC is a Python 2 script that exploits CVE-2025-6934 by sending crafted registration requests to a vulnerable WordPress plugin. The code performs only the advertised privilege escalation: it extracts a nonce, constructs POST requests with a hardcoded 'administrator' role, and saves successful credentials locally. No concealed payload, persistence mechanism, credential exfiltration to a remote server, or unrelated behavior was observed.
Classification basis and observed behavior
Classification basis
The script actively sends crafted HTTP requests to create a new user with the 'administrator' role on a vulnerable WordPress site, which constitutes exploitation rather than mere detection or scanning.
CVE-2025-6934.py:106-225README.md:6Requirements
- Target must be running a vulnerable version (<= 1.7.5) of the Opal Estate Pro plugin with the registration endpoint exposed.
CVE-2025-6934.py:1 - Attacker must provide a list of target URLs in a file.
CVE-2025-6934.py:252
Observed behavior
- Fetches the target homepage to extract a registration nonce from an input field or inline script.
CVE-2025-6934.py:65-101 - Sends POST requests to wp-admin/admin-ajax.php with action 'opalestate_register_form' and a payload that includes 'role': 'administrator' to create a new administrator account.
CVE-2025-6934.py:126-164 - Checks the response for success indicators (JSON status true or keywords like 'success', 'registered') and saves the created credentials to payload withheld.
CVE-2025-6934.py:173-206
Behaviors behind the backdoor verdict
Observables
- Credential Save
- Payload withheldSuccessful exploit credentials are appended to a local file 'payload withheld' in the working directory. This is consistent with the stated purpose of recording vulnerable targets and does not indicate exfiltration.
CVE-2025-6934.py:227-234 - Hardcoded Password
- Payload withheldThe script uses a fixed password for all registration attempts. This is a weak operational choice but does not constitute a backdoor or hidden payload.
CVE-2025-6934.py:116
What the analysis did not establish
- Evidence is limited to static source code analysis; the script was not executed, and its effectiveness or safety is not verified.
- The README references an external image and disclaimer link that were not provided in the evidence.
- The review is based solely on the supplied text files; no runtime behavior or external dependencies were analyzed.
- The script is written in Python 2, which is end-of-life, but this does not by itself indicate malicious intent.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.