SecureWithUmer
Source-scoped identity with 75 associated PoCs and 109 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
GitHubCVE-2026-46300
Curated repository PoCStars: 34Created 2026-07-08ExploitCVE-2026-463007 files
Analysis
Technical assessment
Go exploit for CVE-2026-46300 that patches the page-cache of /usr/bin/su by triggering in-place AES-GCM decryption over shared page-cache fragments, then executes the patched binary to gain a root shell.
Backdoor review
No backdoor observed in reviewed code
The supplied Go source code implements a local privilege escalation (LPE) exploit for CVE-2026-46300. It uses TCP_ULP espintcp and splice to trigger in-place AES-GCM decryption into the page cache of /usr/bin/su, overwriting it with a root-shell payload. The code performs only the described exploit behavior: patching a system binary to gain root, then executing a shell. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload targeting the PoC runner was observed.
Classification basis and observed behavior
Classification basis
The code actively exploits CVE-2026-46300 to achieve local privilege escalation. It implements a byte-by-byte write primitive to overwrite /usr/bin/su in the page cache with attacker-controlled shellcode, then executes the modified binary to gain root. This is a full exploit, not merely a scanner or writeup.
Koshmare-Blossom-Fragnesia-go-64640f0/main.go:3-14Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:110-151Koshmare-Blossom-Fragnesia-go-64640f0/main.go:55-65Requirements
- Local unprivileged user access to a vulnerable Linux kernel (3.9 through 7.1-rc4) with CONFIG_ESPINTCP enabled.
Koshmare-Blossom-Fragnesia-go-64640f0/main.go:1-100 - Ability to create user and network namespaces (CLONE_NEWUSER, CLONE_NEWNET).
Koshmare-Blossom-Fragnesia-go-64640f0/main.go:84-85 - Target file /usr/bin/su must exist and be readable.
Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:31
Observed behavior
- Spawns a child process in new user and network namespaces to isolate the exploit.
Koshmare-Blossom-Fragnesia-go-64640f0/main.go:80-98 - Builds a 256-entry AES-GCM keystream table to map desired XOR values to IV nonces.
Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:75-97 - Iterates over a 192-byte shellcode payload, reading each byte of /usr/bin/su and computing the required keystream byte to XOR the current byte into the desired shellcode byte.
Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:112-138 - For each byte, establishes a TCP connection to localhost, splices a page of /usr/bin/su into the receive queue, then sets TCP_ULP to espintcp, causing the kernel to decrypt the queued data in-place over the page-cache page.
Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:156-275 - After patching, verifies the entry point bytes of /usr/bin/su match the shellcode.
Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:143-148 - If patching succeeds, executes /usr/bin/su via a PTY to obtain a root shell.
Koshmare-Blossom-Fragnesia-go-64640f0/main.go:60-64
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe code's stated purpose is to demonstrate the CVE-2026-46300 vulnerability. It reads /usr/bin/su, XORs bytes using a keystream derived from AES-GCM, and writes a 192-byte shellcode that executes /bin/sh. This is consistent with the described exploit chain and does not constitute a backdoor.
Koshmare-Blossom-Fragnesia-go-64640f0/main.go:3-14Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:110-151 - Payload
- Payload withheldThe payload is embedded in the exploit and is written to /usr/bin/su. It is the intended exploit payload, not a hidden backdoor.
Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:43-56 - Privilege Escalation
- Payload withheldThis is a standard technique for LPE exploits requiring network namespace isolation. It is part of the documented exploit chain.
Koshmare-Blossom-Fragnesia-go-64640f0/main.go:74-99
What the analysis did not establish
- Evidence includes only two Go source files; 5 additional files are present in the artifact but were not provided as text and are flagged as unclassified binary or non-text content.
- The analysis is based solely on static review of the provided source code; the code was not executed, and its reliability or effectiveness is not verified.
- The exploit relies on specific kernel configurations (CONFIG_ESPINTCP) and timing assumptions that may not hold in all environments.
- Only the two Go source files (main.go, trigger.go) were provided and reviewed. The artifact metadata indicates 5 additional unclassified files totaling 10,748 bytes were present in the repository unit but were not included in the evidence packet. Their content is unknown and could contain additional behavior not assessed here.
- The review is based solely on static analysis of the provided text; the code was not executed, and dynamic behavior cannot be confirmed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-29909
Curated repository PoCStars: 34Created 2026-07-08ScannerCVE-2026-299091 file
Analysis
Technical assessment
The artifact is a README.md file that describes CVE-2026-29909, an unauthenticated directory enumeration vulnerability in MRCMS V3.1.2. It provides a single HTTP GET request as a 'Proof of Concept' that lists directory contents without authentication, which is a scanner behavior (detecting/reporting the vulnerability) rather than an exploit that achieves code execution or deeper compromise.
Backdoor review
No backdoor observed in reviewed code
The artifact consists solely of a README.md file describing CVE-2026-29909 and providing a simple HTTP GET request as a proof-of-concept. No executable code, scripts, or binaries are present. The PoC is a standard, non-obfuscated HTTP request that demonstrates the claimed directory enumeration vulnerability. There is no evidence of concealed behavior, credential theft, persistence mechanisms, or any other backdoor activity.
Classification basis and observed behavior
Classification basis
The artifact contains only a single HTTP request that lists directory contents, which demonstrates the vulnerability (scanner) but does not include code to leverage the enumeration for further compromise (exploit). The file is a writeup with a PoC example, but the PoC itself is a scanner.
qflksheep-CVE-2026-29909-MRCMS-vulnerability-cc063d5/README.md:9-13Requirements
- Target must be running MRCMS V3.1.2 with the vulnerable /admin/file/list.do endpoint exposed.
qflksheep-CVE-2026-29909-MRCMS-vulnerability-cc063d5/README.md:7
Observed behavior
- Sends an unauthenticated HTTP GET request to /admin/file/list.do with a path parameter to enumerate server directory contents.
qflksheep-CVE-2026-29909-MRCMS-vulnerability-cc063d5/README.md:10-13
Behaviors behind the backdoor verdict
Observables
- Http Request
- Payload withheldThe PoC demonstrates the claimed unauthenticated directory enumeration vulnerability by sending a path traversal request to the target endpoint. This is consistent with the CVE description and does not indicate a backdoor.
qflksheep-CVE-2026-29909-MRCMS-vulnerability-cc063d5/README.md:11-12
What the analysis did not establish
- Only one text file (README.md) is provided; no executable code or additional scripts are included.
- The artifact is a documentation file, not an executable PoC script.
- Only the README.md file was provided; no other files from the repository unit were included. The review is limited to the supplied text content.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-1492
Curated repository PoCStars: 34Created 2026-07-08ExploitCVE-2026-14923 files
Analysis
Technical assessment
A Python script that implements a full, multi-stage attack chain to exploit CVE-2026-1492. It automatically discovers vulnerable WordPress sites, registers new users, injects an 'administrator' role via a crafted AJAX request, and verifies the resulting admin access.
Backdoor review
No backdoor observed in reviewed code
The PoC script CVE-2026-1492.py implements a multi-step exploit chain against a known WordPress plugin vulnerability (CVE-2026-1492). It performs automated discovery, user registration, and role injection to escalate privileges to administrator. All observed behavior is consistent with the stated exploit goal. No concealed backdoor, unrelated payload, or deceptive operator-directed harm was found in the reviewed source code or README.
Classification basis and observed behavior
Classification basis
The artifact is a Python script that actively exploits CVE-2026-1492 by performing unauthorized privilege escalation. It registers a user and then sends a crafted AJAX request to inject an 'administrator' role, which is the core exploit action. The README explicitly describes it as a 'Proof-of-Concept (PoC) exploitation script'.
Nxploited-CVE-2026-1492-d0e78b1/README.md:45Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:743-753Requirements
- Target must be a WordPress site running the User Registration & Membership plugin version <= 5.1.2.
Nxploited-CVE-2026-1492-d0e78b1/README.md:33 - The target site must have a membership registration page and the vulnerable AJAX handler accessible.
Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:144-202
Observed behavior
- Discovers candidate registration and pricing pages on the target WordPress site.
Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:144-202 - Extracts membership plan IDs, form nonces, and AJAX parameters from the discovered pages.
Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:205-431 - Registers a new user account via the 'user_registration_user_form_submit' AJAX action.
Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:638-739 - Sends a crafted 'user_registration_membership_register_member' AJAX request with 'role': 'administrator' in the 'members_data' payload to escalate privileges.
Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:743-753Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:756-842 - Verifies the created account has administrator privileges by logging in and checking for admin dashboard indicators.
Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:934-1072 - Writes successfully created admin credentials to a file named 'Nx_admin.txt'.
Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:100-102
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the core exploit logic for CVE-2026-1492, as described in the CVE context and README.
Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:638-739Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:743-842 - Credential Logging
- Payload withheldThis is a standard output mechanism for a PoC exploit, logging the results of the attack for the operator.
Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:100-102 - Hardcoded Password
- Payload withheldThis is a fixed password for the exploit, not a backdoor credential. It is user-configurable.
Nxploited-CVE-2026-1492-d0e78b1/CVE-2026-1492.py:40
What the analysis did not establish
- Evidence coverage is COMPLETE_FOR_READABLE_SELECTED_TEXT, but one unclassified file of 1480 bytes was omitted from the packet. The analysis is based on the provided Python script and README.
- The artifact's behavior is analyzed from its source code; the code was not executed, and its effectiveness or safety is not verified.
- The review is limited to the two text files provided in the evidence packet. No binary files were present.
- The script's behavior depends on external network interactions with target WordPress sites, which were not observed.
- The script imports standard third-party libraries (requests, rich) which were not reviewed for supply-chain risks.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-31431
Curated repository PoCStars: 34Created 2026-07-08ExploitCVE-2026-314312 files
Analysis
Technical assessment
A Python exploit for CVE-2026-31431 that leverages a vulnerability in the Linux kernel's algif_aead interface to write arbitrary data into the page cache of any readable file, bypassing permissions. It includes a specific escalation mode that patches /etc/passwd to remove the root password and then executes 'su root'.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script for CVE-2026-31431. The script implements a page-cache write primitive via AF_ALG AEAD operations and provides a local privilege escalation path by modifying /etc/passwd in memory. All code is consistent with the described vulnerability exploitation; no concealed backdoor, unrelated payload, or operator-directed harm beyond the stated exploit behavior was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, self-contained Python script (exploit.py) that implements a vulnerability to achieve privilege escalation. The README explicitly describes it as an 'exploit' and the code performs actions to modify system state (page cache) and execute a shell with elevated privileges, which is the definition of an exploit.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/README.md:63Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:1-405Requirements
- Target file must be readable by the attacker.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/README.md:18 - The kernel must have CONFIG_CRYPTO_USER_API_AEAD enabled and the 'authencesn(hmac(sha256),cbc(aes))' algorithm available.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/README.md:17 - The target file must be at least (offset + data_length + 4) bytes in size.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/README.md:127
Observed behavior
- Opens an AF_ALG socket and configures it for AEAD decryption.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:121-125 - Sends attacker-controlled data as AAD via sendmsg, where the last 4 bytes are the value to be written.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:128-129 - Uses splice() to inject pages from the target file into the kernel's crypto scatterlist.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:132-135 - Triggers the decryption operation via recv(), causing the kernel to write the attacker's 4-byte value into the target file's page cache at a controlled offset.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:140-141 - In 'escalate' mode, patches the root line in /etc/passwd to remove the password and then executes 'su root'.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:235-305Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:390-402
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe exploit uses sendmsg with attacker-controlled AAD and splice to inject file pages into the crypto scatterlist, causing authencesn to write seqno_lo into the page cache before HMAC verification fails.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:94-147 - Exploit Behavior
- Payload withheldThe escalate_passwd function modifies the root password field in the page cache of /etc/passwd and then executes 'su root' to gain root access.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:235-305Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:390-402 - File Operation
- Payload withheldThe script creates a backup of /etc/passwd before modification, which is a standard safety measure in PoC exploits.
Sndav-CVE-2026-31431-Advanced-Exploit-7621384/exploit.py:243-245
What the analysis did not establish
- Evidence is limited to the two text files provided; no binary files were inspected.
- The artifact's behavior is analyzed based on static code review; the code was not executed.
- Only the two text files (README.md and exploit.py) were reviewed; no binary files were present in the evidence packet.
- The review does not assess whether the exploit actually works or is safe to execute.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-0265
Curated repository PoCStars: 34Created 2026-07-08ScannerCVE-2026-02656 files
Analysis
Technical assessment
A Python-based scanner that determines if a PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 by sending a single anonymous GET request to /global-protect/prelogin.esp and analyzing the response for CAS configuration and version information, without exploiting the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The artifact is a Python-based vulnerability detector for CVE-2026-0265. It performs a single anonymous HTTP GET request to a target's GlobalProtect portal to determine vulnerability status based on the response content. No backdoor, deceptive payload, or concealed harmful behavior was observed. The code is well-documented, its logic is transparent, and it does not execute any payloads, establish persistence, or exfiltrate data.
Classification basis and observed behavior
Classification basis
The artifact's primary stated operation is to 'determine whether a PAN-OS GlobalProtect portal is vulnerable' by sending a single anonymous GET request and analyzing the response. It does not attempt to authenticate, modify state, or exercise the vulnerability. The README explicitly states it 'determine[s] whether a ... portal is vulnerable ... without authenticating any session or modifying any state' and the code only performs detection and version comparison, not exploitation.
BishopFox-CVE-2026-0265-check-da4afb5/README.md:3BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:8-19Requirements
- Target must be a reachable PAN-OS GlobalProtect portal
BishopFox-CVE-2026-0265-check-da4afb5/README.md:120-121 - Prelogin response must not be gated by mTLS or aggressive User-Agent checks
BishopFox-CVE-2026-0265-check-da4afb5/README.md:122
Observed behavior
- Sends a single anonymous GET request to /global-protect/prelogin.esp on the target
BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:293-299 - Checks for <cas-auth>yes</cas-auth> in the response to confirm CAS is attached
BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:352-353BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:384-386 - Decodes an embedded JWT token from the prelogin response to extract the PanOSversion string
BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:310-329BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:391-396 - Cross-references the extracted version against a hardcoded advisory matrix to produce a verdict (VULNERABLE, PATCHED, NOT-AFFECTED-*, UNDETERMINED-*)
BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:129-186BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:398-405 - Outputs a JSON object or brief tab-separated line per target with the verdict and version
BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:449-461
Behaviors behind the backdoor verdict
Observables
- Network Request
- Payload withheldThe script sends a single, read-only HTTP GET request to the target to retrieve vulnerability indicators. No authentication or state modification is attempted.
BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:293 - Data Processing
- Payload withheldThe extracted version is used solely for advisory comparison to determine vulnerability status. No credentials or sensitive data are collected.
BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:310-329 - Output
- Payload withheldOutput is limited to vulnerability assessment data. No system information, credentials, or unrelated data is included.
BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:449-461
What the analysis did not establish
- Evidence includes only readable text files; two unclassified files (1101 bytes) are present but not analyzed, though they are unlikely to change the classification given the complete coverage of the main scanner script and documentation.
- The review is based solely on the supplied text files. No binary files were present or analyzed. The artifact's behavior at runtime depends on the Python environment and network targets, which were not executed or observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-30655
Curated repository PoCStars: 34Created 2026-07-08WriteupCVE-2026-306551 file
Analysis
Technical assessment
The artifact is a technical writeup describing CVE-2026-30655, an SQL injection vulnerability in esiclivre. It provides a summary, affected versions, technical details, impact, and mitigation recommendations, but contains no exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a README.md file describing CVE-2026-30655, an SQL injection vulnerability in esiclivre. The file contains no executable code, no instructions for the reviewer to perform any action, and no concealed or deceptive payload. It is a plain-text documentation of a known vulnerability.
Classification basis and observed behavior
Classification basis
The artifact is a Markdown file containing a vulnerability summary, technical details, and mitigation advice. It does not include any executable code, proof-of-concept exploit, or scanner logic. Its purpose is to document the vulnerability, which aligns with a technical writeup.
brynax-CVE-2026-30655-1a813f5/README.md:1-32Observed behavior
- The writeup describes that an unauthenticated attacker can inject SQL via the 'cpfcnpj' POST parameter to the '/reset/index.php' endpoint, potentially gaining unauthorized access to sensitive information.
brynax-CVE-2026-30655-1a813f5/README.md:4brynax-CVE-2026-30655-1a813f5/README.md:12-14
Behaviors behind the backdoor verdict
Observables
- Vulnerability Documentation
- Payload withheldThe README.md describes the vulnerability, affected versions, technical details, and mitigation. It is a standard vulnerability disclosure document.
brynax-CVE-2026-30655-1a813f5/README.md:1-32
What the analysis did not establish
- The evidence consists of a single README.md file. No exploit or scanner code is present in the supplied text.
- The analysis is based solely on the provided text content; no external verification or execution was performed.
- Only the README.md file was provided; no other files from the repository unit were included in the evidence packet.
- The analysis scope confirms no executable source code was identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-42208
Curated repository PoCStars: 34Created 2026-07-08ScannerCVE-2026-422082 files
Analysis
Technical assessment
A Python script that probes a target URL for accessible LiteLLM endpoints and attempts basic SQL injection payloads on public endpoints to detect potential CVE-2026-42208 exposure. It does not exploit the vulnerability to read or modify data.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a Python script that scans a target URL for LiteLLM endpoints and tests for SQL injection using hardcoded payloads. It performs only the advertised vulnerability scanning behavior: sending HTTP GET requests to known LiteLLM paths and appending SQLi payloads to query parameters. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is present in the reviewed evidence.
Classification basis and observed behavior
Classification basis
The script is explicitly described as a 'Vulnerability Scanner' in its banner and docstring. It probes endpoints and sends SQLi payloads to detect potential vulnerability, but does not extract, exfiltrate, or modify data. It only reports findings, which is characteristic of a scanner.
ridhinva-litellm-scanner-1c26469/litellm_scanner.py:3-5ridhinva-litellm-scanner-1c26469/litellm_scanner.py:11-14Requirements
- Target URL or file containing target URLs must be supplied as a command-line argument.
ridhinva-litellm-scanner-1c26469/litellm_scanner.py:72-82
Observed behavior
- Iterates over a list of known LiteLLM endpoints and sends HTTP GET requests to each.
ridhinva-litellm-scanner-1c26469/litellm_scanner.py:45-49 - Checks response body for 'litellm' or 'model' strings to confirm a LiteLLM instance.
ridhinva-litellm-scanner-1c26469/litellm_scanner.py:52-53 - On public endpoints, sends GET requests with SQL injection payloads appended as query parameters and compares response length to flag possible injection.
ridhinva-litellm-scanner-1c26469/litellm_scanner.py:56-62 - Prints findings to stdout, including discovered endpoints, LiteLLM confirmation, and possible SQL injection indicators.
ridhinva-litellm-scanner-1c26469/litellm_scanner.py:87-90
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldSource repository hosting the PoC; no malicious content observed in the script.
ridhinva-litellm-scanner-1c26469/litellm_scanner.py:1-96
What the analysis did not establish
- Only one text file (litellm_scanner.py) is included; the artifact directory contains an additional unclassified file (1076 bytes) that is not analyzed.
- The scanner uses a limited set of SQLi payloads and a simple response-length heuristic, which may produce false positives or false negatives.
- The evidence does not include any output or execution results, so the scanner's effectiveness cannot be verified.
- Only the supplied text file (litellm_scanner.py) was reviewed; no other files from the repository unit were provided or analyzed.
- The script's behavior depends on the target server's response; the review does not assess the safety or correctness of the scanning activity itself.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-20131
Curated repository PoCStars: 34Created 2026-07-08ScannerCVE-2026-2013117 files
Analysis
Technical assessment
A Flask-based honeypot that emulates a Cisco FMC login page to detect and safely log Java deserialization attacks targeting CVE-2026-20131. It inspects incoming POST bodies for Java serialization magic bytes, extracts command-like strings and URLs using regex, optionally fetches second-stage payloads in a sandboxed manner, and logs events. It does not exploit the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a Flask-based honeypot that emulates a Cisco FMC login page, accepts POST data, inspects it for Java serialization magic bytes, extracts URLs and shell-like commands via regex, and optionally fetches second-stage payloads using requests with network safeguards. No backdoor, concealed operator-directed harm, or deceptive payload targeting the person running the PoC was observed.
Classification basis and observed behavior
Classification basis
The artifact is a honeypot that detects and logs Java deserialization attacks without exploiting the target vulnerability. It does not send a crafted serialized object to a real Cisco FMC device to achieve code execution; it only receives and inspects incoming payloads. This matches the scanner classification: code that checks for a vulnerability without exploiting it.
Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:1-3Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/parser.py:1-4Requirements
- Deploy the honeypot application to receive unsolicited attack traffic.
Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/deploy.sh:1-17
Observed behavior
- Serves a fake Cisco FMC login page on GET requests.
Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:86-91 - Inspects POST body for Java serialization magic bytes (0xACED0005) or base64-encoded equivalent.
Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:98-106 - Extracts shell-like commands (wget, curl, tftp, bash -c) and URLs from the serialized payload using regex without deserializing Java objects.
Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/parser.py:93-157 - Optionally fetches second-stage payloads from extracted URLs in a sandboxed manner (HTTP/HTTPS only, blocks private/reserved IPs).
Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/harvester.py:95-133 - Logs detection events to a JSON file and optionally sends Telegram alerts.
Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/logger.py:52-90
Behaviors behind the backdoor verdict
Observables
- Honeypot Behavior
- Payload withheldThe artifact is explicitly documented as a honeypot trap for CVE-2026-20131 exploitation attempts, not a backdoor.
Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:1-3Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:83-153 - Second Stage Fetch
- Payload withheldThe fetch is a documented honeypot feature to collect attacker payloads; it does not execute them and includes safeguards against internal network access.
Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/harvester.py:1-3Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/harvester.py:44-71Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/harvester.py:95-133 - Telegram Notification
- Payload withheldThis is a standard honeypot notification mechanism, not a backdoor; it requires explicit operator configuration.
Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/logger.py:36-49Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/logger.py:85-90
What the analysis did not establish
- complete_artifact_coverage is false; 10 unclassified files (14445 bytes) are present but not included in the text evidence, so the analysis is based solely on the 7 provided text files.
- 10 unclassified files (14445 bytes) were not analyzed; they are flagged as metadata-only and could contain unobserved content.
- The review is limited to the supplied text evidence; no runtime behavior or external dependencies were examined.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-3854
Curated repository PoCStars: 34Created 2026-07-08ScannerCVE-2026-3854CVE-2026-4821CVE-9999-999923 files
Analysis
Technical assessment
The artifact is a Python script that prints 'GHES CVE Scanner' and a status message, functioning as a placeholder scanner entry point with no vulnerability detection or exploitation logic.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a single Python file (scanner.py) that prints two static strings. No network activity, file operations, command execution, obfuscation, or any other behavior is present. The code does not exhibit backdoor, deceptive, or harmful functionality.
Classification basis and observed behavior
Classification basis
The script is named 'scanner.py', prints 'GHES CVE Scanner', and contains only a main function that outputs initialization messages. It does not contain any code to exploit or detect a vulnerability, making it a scanner stub.
isagoakira-ghes-cve-scanner-a4fba0a/scanner.py:1-9Observed behavior
- Prints 'GHES CVE Scanner' and 'G0: 项目初始化完成' to stdout.
isagoakira-ghes-cve-scanner-a4fba0a/scanner.py:5-6
Behaviors behind the backdoor verdict
Observables
- Static Print
- Payload withheldThe script prints a static banner string.
isagoakira-ghes-cve-scanner-a4fba0a/scanner.py:5 - Static Print
- Payload withheldThe script prints a static initialization message.
isagoakira-ghes-cve-scanner-a4fba0a/scanner.py:6
What the analysis did not establish
- Only one file (scanner.py) is included in the evidence; 22 other files in the artifact are unclassified and not analyzed.
- The evidence coverage is incomplete for the artifact as a whole, so the classification is based solely on the provided scanner.py file.
- Only one text file (scanner.py) was selected for review; 22 unclassified files totaling 88,820 bytes were not analyzed and are not included in the evidence packet. Their content is unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-21509
Curated repository PoCStars: 34Created 2026-07-08ScannerCVE-2026-215093 files
Analysis
Technical assessment
PowerShell script that checks for and applies a COM Kill-Bit registry mitigation for CVE-2026-21509. It does not exploit the vulnerability; it only detects exposure and applies a workaround.
Backdoor review
No backdoor observed in reviewed code
The artifact is a PowerShell script and README that manage a COM Kill-Bit for CVE-2026-21509. The script reads and writes specific registry keys, creates a harmless RTF test file, and queries installed hotfixes. No backdoor, concealed executable payload, credential theft, persistence, or unrelated remote access behavior is present. The script's operations are limited to the documented mitigation actions.
Classification basis and observed behavior
Classification basis
The script only reads registry state, writes a mitigation value, and checks for patches. It does not contain any code that triggers or exercises the vulnerability (e.g., loading a malicious COM object to achieve code execution). The README explicitly states the test file is safe and contains no executable code.
suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:1-390suuhm-CVE-2026-21509-handler-f004e70/README.md:111Requirements
- Administrator rights required to modify registry
suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:3 - Windows 10/11 with Office 2016+ installed
suuhm-CVE-2026-21509-handler-f004e70/README.md:24
Observed behavior
- Checks registry for presence of Kill-Bit (Compatibility Flags = 0x400) for CLSID {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}
suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:43-65 - Applies Kill-Bit by creating registry key and setting Compatibility Flags DWORD to 0x400
suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:81-114 - Creates a benign RTF test file containing the CLSID to verify Kill-Bit blocks COM object activation
suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:116-131 - Checks for installed KB5002694 and KB5002695 patches via Get-HotFix
suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:157-179
Behaviors behind the backdoor verdict
Observables
- Registry Modification
- Payload withheldThis is the documented Kill-Bit mitigation for the CVE; it disables the vulnerable COM object.
suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:99 - File Creation
- Payload withheldThe file is a non-executable test artifact to verify the Kill-Bit blocks the COM object; it contains no active content.
suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:119-121 - System Information Disclosure
- Payload withheldThis is a local diagnostic check for the official patches; no data is exfiltrated.
suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:163
What the analysis did not establish
- Evidence consists of two text files; one unclassified file (likely binary) is present but not analyzed, though it is not required for classification of the primary artifact.
- One unclassified file (11357 bytes) is present in the artifact inventory but was not inspected; its content is unknown.
- The review is based solely on the supplied text files; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-48710
Curated repository PoCStars: 34Created 2026-07-08ScannerCVE-2026-4871012 files
Analysis
Technical assessment
A detection-only scanner for CVE-2026-48710 (BadHost) in Starlette/FastAPI. It sends crafted HTTP requests with malformed Host headers to test if authentication middleware can be bypassed, and reports differential findings without exploiting the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The PoC is a detection-only scanner for CVE-2026-48710 (BadHost) in Starlette/FastAPI. It sends crafted HTTP requests to test for Host-header auth bypass and reports results. All reviewed source code, documentation, and lab files are consistent with a legitimate security testing tool. No concealed executable behavior, persistence, credential theft, unrelated payloads, or operator-directed harm was observed.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script (badhost_openapi_scanner.py) that is explicitly described as a 'Detection-only scanner' in its own docstring and README. It sends crafted requests to detect the vulnerability and reports findings, but does not contain any code to exploit the vulnerability for malicious purposes such as extracting data or gaining unauthorized access. The included lab applications are for local testing of the scanner, not for exploitation.
Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/README.md:3Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:6Requirements
- Target URL of a Starlette/FastAPI application
Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:1083-1084 - OpenAPI specification file or URL, or manual protected paths
Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:1107
Observed behavior
- Sends a baseline unauthenticated request to a protected endpoint and verifies it is denied (401/403).
Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:481 - Sends a crafted request with a malformed Host header (e.g., 'host:port/health?x=') to attempt to bypass authentication.
Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:374-379 - Compares the baseline and test responses to classify the result as CONFIRMED, SUSPECT, BLOCKED, etc.
Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:382-406 - Outputs a text summary, JSON, or CSV report of vulnerable endpoints.
Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:1231-1244
Behaviors behind the backdoor verdict
Observables
- Network Behavior
- Payload withheldCore functionality of the CVE-2026-48710 scanner; documented in README and implemented in badhost_openapi_scanner.py
Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:250-355Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/README.md:6-10 - File Operation
- Payload withheldUsed to generate probe requests for scanning; implemented in load_json_or_yaml_like function
Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:575-600 - Output
- Payload withheldStandard reporting for a security scanner; no exfiltration of sensitive data
Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:1231-1244
What the analysis did not establish
- Evidence does not include the full repository snapshot; only selected text files from the PoC unit are provided.
- The analysis is based solely on static code review; the scanner was not executed against a live target.
- 4 unclassified binary files totaling 1741 bytes were present in the artifact but not analyzed; their metadata-only inventory does not indicate executable payloads.
- The review is limited to the supplied text evidence; the actual runtime behavior of the scanner was not executed or observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-24688
Curated repository PoCStars: 34Created 2026-07-08ExploitCVE-2026-246885 files
Analysis
Technical assessment
The artifact contains a PDF generator (create_malicious_pdf.py) that crafts a PDF with circular outline references, and a reader script (simple_read_pdf.py) that triggers the infinite loop vulnerability in pypdf by accessing reader.outline. The README explicitly describes this as a PoC for CVE-2026-24688 and provides instructions to run the exploit.
Backdoor review
No backdoor observed in reviewed code
The supplied text files (README.md, create_malicious_pdf.py, simple_read_pdf.py) describe and implement a proof-of-concept for CVE-2026-24688, an infinite loop vulnerability in pypdf's outline parsing. The Python scripts construct a malicious PDF with circular outline references and read it to trigger the documented denial-of-service behavior. No backdoor, concealed payload, or operator-directed harm is present in the reviewed text. One binary PDF (malicious_circular_outline.pdf) was flagged as metadata-only and not analyzed; its purpose is consistent with the PoC and no suspicious behavior is indicated by the surrounding text.
Classification basis and observed behavior
Classification basis
The artifact includes code that generates a malicious PDF and code that exercises the vulnerability by reading the outline, which triggers the infinite loop. This is an exploit, not a scanner, because it actively triggers the vulnerability rather than merely detecting it.
Fomovet-cve-2026-24688-0b13ba0/create_malicious_pdf.py:25-93Fomovet-cve-2026-24688-0b13ba0/simple_read_pdf.py:76-84Fomovet-cve-2026-24688-0b13ba0/README.md:3Requirements
- pypdf version < 6.6.2 must be installed
Fomovet-cve-2026-24688-0b13ba0/README.md:44 - The malicious PDF must be generated or provided
Fomovet-cve-2026-24688-0b13ba0/README.md:15
Observed behavior
- Generates a PDF with circular outline references (A -> B -> A)
Fomovet-cve-2026-24688-0b13ba0/create_malicious_pdf.py:25-93 - Opens the malicious PDF and accesses reader.outline, triggering an infinite loop
Fomovet-cve-2026-24688-0b13ba0/simple_read_pdf.py:76-84 - Consumes memory and CPU until system crash or manual interruption
Fomovet-cve-2026-24688-0b13ba0/README.md:7-9
Behaviors behind the backdoor verdict
Observables
- Binary File Not Analyzed
- Payload withheldThe PDF is the exploit artifact generated by create_malicious_pdf.py. It was not analyzed for embedded active content, but the text scripts describe it as a PDF with circular outline references designed to trigger an infinite loop in pypdf.
Fomovet-cve-2026-24688-0b13ba0/README.md:15Fomovet-cve-2026-24688-0b13ba0/create_malicious_pdf.py:25-93
What the analysis did not establish
- One binary file (malicious_circular_outline.pdf) is present but not analyzed; its content is flagged as binary and metadata only.
- The test_pypdf.sh script is listed in the README but not included in the text evidence.
- One binary file (malicious_circular_outline.pdf, 754 bytes) was flagged as metadata-only and not analyzed for embedded active content. The review cannot confirm the PDF contains only the described circular outline structure.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-1999
Curated repository PoCStars: 34Created 2026-07-08Not analyzedCVE-2026-19992 files
GitHubCVE-2026-40175
Curated repository PoCStars: 34Created 2026-07-08Not analyzedCVE-2026-401753 files
GitHubCVE-2026-10520
Curated repository PoCStars: 34Created 2026-07-08ScannerCVE-2026-105206 files
Analysis
Technical assessment
The artifact is a Python script that prints a banner and a message directing users to an external GitLab repository for the actual PoC. It does not contain exploit or scanner code itself; it is a placeholder that refers to an external resource. The README provides a curl command that demonstrates the vulnerability, but the primary Python file is a stub.
Backdoor review
No backdoor observed in reviewed code
The artifact is a PoC for CVE-2026-10520. The main Python file (CVE-2026-10520-X7.py) only prints its docstring and a message directing the user to an external GitLab repository for the actual exploit code; it performs no network connections, file operations, or command execution. The README documents the vulnerability and provides a curl command for manual exploitation. No concealed, deceptive, or operator-directed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The primary Python file (CVE-2026-10520-X7.py) only prints a banner and a message directing to an external link; it contains no exploit or scanning logic. The README provides a curl command that could be used to exploit the vulnerability, but the Python script itself is a stub. The artifact is classified as a scanner because the README documents a detection/validation command, but the primary code is a placeholder.
error-inside-CVE-2026-10520-f910f57/CVE-2026-10520-X7.py:41-43error-inside-CVE-2026-10520-f910f57/README.md:28-35Requirements
- Target must be running a vulnerable version of Ivanti Sentry (before R10.5.2, R10.6.2, R10.7.1) with the MICS API endpoint exposed.
error-inside-CVE-2026-10520-f910f57/README.md:16-24
Observed behavior
- The Python script prints a banner and a message stating it is a mirror and directing users to an external GitLab link for the PoC.
error-inside-CVE-2026-10520-f910f57/CVE-2026-10520-X7.py:41-43 - The README documents a curl command that sends a POST request with an XML-wrapped OS command to the vulnerable endpoint, which would execute the command if the target is vulnerable.
error-inside-CVE-2026-10520-f910f57/README.md:28-35
Behaviors behind the backdoor verdict
Observables
- External Reference
- Payload withheldThe Python script prints a message directing the user to this external GitLab link for the actual PoC, but the script itself does not fetch or execute any content from it.
error-inside-CVE-2026-10520-f910f57/CVE-2026-10520-X7.py:43 - Exploit Command
- Payload withheldThe README provides a curl command demonstrating the CVE-2026-10520 OS command injection against a vulnerable Ivanti Sentry endpoint. This is the documented exploit behavior for the stated target.
error-inside-CVE-2026-10520-f910f57/README.md:30-34
What the analysis did not establish
- The Python script is a stub that does not implement any exploit or scanning functionality; it only prints a message.
- The actual exploit code is hosted on an external GitLab repository not included in the evidence.
- The evidence does not include any binary or compiled files, but the Python script is complete and readable.
- The Python script references an external GitLab repository (payload withheld) which is not included in the evidence; its contents are unknown and could contain malicious code.
- Only the text content of the four selected files was reviewed; no binary analysis was performed, though no binary files were identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-22241
Curated repository PoCStars: 34Created 2026-07-08WriteupCVE-2026-222411 file
Analysis
Technical assessment
A payload withheld file providing a technical summary of CVE-2026-22241, an arbitrary file upload vulnerability in Open eClass. It describes the vulnerability, affected versions, root cause, and mitigation, but contains no exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a payload withheld file that documents the CVE-2026-22241 vulnerability. It contains no executable code, no instructions to execute anything, and no concealed or deceptive payload. The content is a standard vulnerability disclosure with summary, affected versions, mitigation, and references.
Classification basis and observed behavior
Classification basis
The artifact is a single payload withheld file that provides a substantive technical analysis of CVE-2026-22241, including a vulnerability summary, affected versions, root cause, and mitigation. It contains no executable code, exploit, or scanner logic, fitting the definition of a writeup.
0xBlackash-CVE-2026-22241-2df026c/README.md:1-82Requirements
- An authenticated administrator account is required to access the Theme Import feature.
0xBlackash-CVE-2026-22241-2df026c/README.md:18
Observed behavior
- The document describes the vulnerability, its impact (Remote Code Execution), and provides mitigation advice. It does not perform any actions.
0xBlackash-CVE-2026-22241-2df026c/README.md:14-55
Behaviors behind the backdoor verdict
Observables
- File Content
- Payload withheldThe only file in the evidence is a Markdown documentation file describing CVE-2026-22241. It contains no scripts, commands, or executable payloads.
0xBlackash-CVE-2026-22241-2df026c/README.md:1-82
What the analysis did not establish
- The evidence consists of a single Markdown file; no source code, scripts, or binaries are present to confirm the presence of exploit or scanner functionality.
- The analysis is based solely on the supplied text; the document's claims about the vulnerability are not independently verified.
- Only the payload withheld file was provided; no other files from the repository directory were included in the evidence packet. The analysis scope confirms complete coverage of the selected text, but the artifact may contain additional files not reviewed here.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-33824
Curated repository PoCStars: 34Created 2026-07-08Model review verdict: Suspicious behavior.ExploitCVE-2026-338242 files
AnalysisSuspicious behavior
Technical assessment
The artifact is a C++ exploit for CVE-2026-33824, a double-free vulnerability in the Windows IKE Extension. It sends crafted IKE packets over UDP to trigger the vulnerability, uses heap grooming and ROP chains to achieve code execution, and deploys a reverse shell listener.
Backdoor review
Suspicious behaviorThe PoC for CVE-2026-33824 contains a concealed, non-disclosed command that disables Windows Defender via PowerShell, executed locally on the operator's machine. This behavior is materially misrepresented as it is not part of the disclosed IKE exploit and is hidden within the code without documentation.
Classification basis and observed behavior
Classification basis
The code is designed to actively exploit a vulnerability. It includes functions to trigger a double-free (trigger_double_free), build a ROP chain (init_rop_module), and deploy a reverse shell (start_shell_listener), which are hallmarks of an exploit.
EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:9545EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:8414EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:11185Requirements
- Target IP address and port must be provided as command-line arguments.
EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:2347 - The target must be running a vulnerable version of the Windows IKE service.
EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:1
Observed behavior
- Sends crafted IKE packets to a target to trigger a double-free vulnerability.
EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:8467 - Constructs and deploys a ROP chain to execute shellcode.
EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:8414 - Starts a reverse shell listener to receive a connection from the compromised target.
EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:11185
Behaviors behind the backdoor verdict
Flagged behaviors
- The code executes a hidden PowerShell command to disable Windows Defender real-time monitoring, behavior monitoring, IOAV protection, script scanning, and on-access protection on the operator's machine. This is unrelated to the disclosed IKE double-free exploit and is not documented in the PoC's purpose.
EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:10557
Observables
- Command Execution
- Payload withheldThis command is executed via CreateProcessA on the operator's machine, disabling multiple Windows Defender protection features without the operator's knowledge or consent.
EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:10557-10558
What the analysis did not establish
- Evidence is a bounded excerpt of a single large C++ file; the full artifact is not available, so analysis is based on the provided excerpts.
- The evidence is excerpted and does not include the full function context or call chain for the PowerShell command execution, so it is not possible to determine if this code path is always reached or under what conditions it is triggered.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-22738
Curated repository PoCStars: 34Created 2026-07-08Not analyzedCVE-2026-227381 file
GitHubCVE-2026-22200
Curated repository PoCStars: 34Created 2026-07-08StubCVE-2026-222004 files
Analysis
Technical assessment
The artifact provides a Docker-based lab environment for osTicket 1.18.1, intended for defensive validation and secure configuration testing related to CVE-2026-22200. It contains no exploit, scanner, or substantive technical analysis code. The files only set up the vulnerable application and describe how to run it, without any code to exercise, detect, or analyze the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The artifact contains a Docker-based lab environment for osTicket 1.18.1, intended for defensive validation of CVE-2026-22200. All four text files (Dockerfile, README.md, compose.yaml, entrypoint.sh) are standard infrastructure-as-code and documentation. No backdoor, deceptive payload, or concealed harmful behavior is present.
Classification basis and observed behavior
Classification basis
The artifact contains only infrastructure code (Dockerfile, compose.yaml, entrypoint.sh) and documentation (README.md) to deploy a vulnerable osTicket instance. There is no exploit code, no scanner logic, and no technical writeup analyzing the vulnerability. The README explicitly states the lab is for 'defensive validation and hardening practice' and does not include any PoC or detection code. The packet reports complete_artifact_coverage, confirming no other files exist. Therefore, the artifact is a stub.
Remnant-DB-CVE-2026-22200-a0d1333/README.md:1-9Remnant-DB-CVE-2026-22200-a0d1333/Dockerfile:1-46Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:1-42Remnant-DB-CVE-2026-22200-a0d1333/entrypoint.sh:1-25Observed behavior
- Builds a Docker image for osTicket 1.18.1 with Apache and PHP 8.2.
Remnant-DB-CVE-2026-22200-a0d1333/Dockerfile:1-46 - Defines a Docker Compose service for the osTicket lab and a MariaDB database.
Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:1-42 - Provides a startup script that copies the sample configuration and starts Apache.
Remnant-DB-CVE-2026-22200-a0d1333/entrypoint.sh:1-25 - README describes the lab as for defensive validation and hardening practice, with instructions to start and stop the environment.
Remnant-DB-CVE-2026-22200-a0d1333/README.md:1-111
Behaviors behind the backdoor verdict
Observables
- Infrastructure
- Payload withheldThe lab sets up a vulnerable osTicket instance for local security testing, consistent with the stated CVE-2026-22200 educational purpose.
Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:1-42Remnant-DB-CVE-2026-22200-a0d1333/Dockerfile:1-46 - Credential
- Payload withheldHardcoded credentials are for a local lab environment and are explicitly documented; they do not indicate a backdoor.
Remnant-DB-CVE-2026-22200-a0d1333/compose.yaml:29-32Remnant-DB-CVE-2026-22200-a0d1333/README.md:73-76
What the analysis did not establish
- Evidence is limited to the four text files provided; no other files exist in the artifact. The artifact does not contain any exploit, scanner, or writeup code, so classification is based solely on the absence of such content.
- Only the four text files in the evidence packet were reviewed; no binary files were present or analyzed.
- The review does not verify the safety of the osTicket application itself or the Docker base images, only the supplied PoC files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-1512
Curated repository PoCStars: 34Created 2026-07-08Not analyzedCVE-2026-1404CVE-2026-151217 files
GitHubCVE-2026-44578
Curated repository PoCStars: 34Created 2026-07-08ExploitCVE-2026-445783 files
Analysis
Technical assessment
Python script that both scans for and exploits CVE-2026-44578, a Next.js SSRF vulnerability. It sends crafted WebSocket upgrade requests to proxy HTTP GET requests to attacker-specified internal targets, including cloud metadata endpoints, and includes automated credential extraction chains for AWS and Azure.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a Python script that exploits CVE-2026-44578 (Next.js SSRF) to scan targets, detect cloud providers, and extract cloud metadata/credentials. All behavior is consistent with the stated vulnerability and documented functionality. No concealed executable payload, persistence mechanism, credential exfiltration to an attacker-controlled destination, or other backdoor behavior was observed.
Classification basis and observed behavior
Classification basis
The script's primary purpose is to exploit CVE-2026-44578. It contains functions (ssrf, exploit_aws, exploit_azure) that actively send malicious requests to cause the target server to proxy to internal destinations and extract sensitive data. The banner and docstring explicitly label it as 'Scanner & Exploit', and the code includes automated credential exfiltration chains.
ynsmroztas-nextssrf-01adb79/nextssrf.py:4ynsmroztas-nextssrf-01adb79/nextssrf.py:88-118ynsmroztas-nextssrf-01adb79/nextssrf.py:219-325Requirements
- Target must be a self-hosted Next.js application (versions 13.4.13-15.5.15 or 16.0.0-16.2.4) using the built-in Node.js server.
ynsmroztas-nextssrf-01adb79/nextssrf.py:6-7 - Target must be reachable over the network; the exploit sends a raw HTTP request to the target host and port.
ynsmroztas-nextssrf-01adb79/nextssrf.py:88-101
Observed behavior
- Sends a crafted HTTP GET request with WebSocket upgrade headers to the target, where the request path is an attacker-controlled URL (e.g., http://169.254.169.254/latest/meta-data/). The vulnerable server proxies this request to the specified internal destination.
ynsmroztas-nextssrf-01adb79/nextssrf.py:88-118 - Automatically extracts AWS credentials by chaining multiple SSRF requests to the IMDS endpoint, retrieving instance metadata, IAM role names, and temporary security credentials (AccessKeyId, SecretAccessKey, Token).
ynsmroztas-nextssrf-01adb79/nextssrf.py:219-325 - Automatically extracts Azure managed identity tokens by requesting an OAuth2 token from the Azure IMDS endpoint.
ynsmroztas-nextssrf-01adb79/nextssrf.py:327-365 - Provides an interactive shell for manual SSRF exploration, allowing the user to send arbitrary HTTP requests through the vulnerable target.
ynsmroztas-nextssrf-01adb79/nextssrf.py:369-489 - Includes a scanning mode that detects Next.js versions, checks vulnerability status, and tests for SSRF by probing cloud metadata endpoints.
ynsmroztas-nextssrf-01adb79/nextssrf.py:523-609
Behaviors behind the backdoor verdict
Observables
- Credential Extraction
- Payload withheldThe script extracts cloud credentials from the exploited target's metadata service and displays them to the operator. This is the intended exploit outcome for CVE-2026-44578 and does not exfiltrate credentials to a third party.
ynsmroztas-nextssrf-01adb79/nextssrf.py:219-325ynsmroztas-nextssrf-01adb79/nextssrf.py:327-365 - Network Connection
- Payload withheldThe script sends crafted WebSocket upgrade requests to the target host, which proxies them to internal metadata endpoints. This is the core exploit mechanism described in the CVE.
ynsmroztas-nextssrf-01adb79/nextssrf.py:88-118 - File Write
- Payload withheldThe script writes results to a user-specified output file. No hidden or unauthorized file writes are performed.
ynsmroztas-nextssrf-01adb79/nextssrf.py:712-718
What the analysis did not establish
- Only one text file (nextssrf.py) was provided; the artifact contains additional non-text media files (343,477 bytes) and unclassified files (8,625 bytes) that were not analyzed.
- Complete artifact coverage is false; the analysis is based solely on the selected readable text file.
- The code was not executed; classification is based on static analysis of the source code.
- Only the single text file (nextssrf.py) was provided; no other files from the repository unit were included in the evidence packet.
- Binary or non-text media files (if any) were flagged as metadata-only and not analyzed, though none were reported in this packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-32013
Curated repository PoCStars: 34Created 2026-07-08ScannerCVE-2026-31994CVE-2026-32011CVE-2026-32013CVE-2026-32015CVE-2026-32024CVE-2026-32025CVE-2026-32032CVE-2026-32042CVE-2026-32048CVE-2026-32049+3 linked vulnerabilities9 files
Analysis
Technical assessment
A bash script that detects the installed version of OpenClaw and compares it against a known secure version to report vulnerability status. It does not exploit any vulnerability; it only checks the version and displays static CVE information.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a single bash script (cve-scan.sh) that acts as a version scanner and informational reporter for OpenClaw CVEs. It detects the installed OpenClaw version, compares it against a hardcoded latest secure version, and displays pre-written CVE descriptions and statistics. No backdoor, concealed executable behavior, or operator-directed harm is present. The script does not download, execute, or install any payload; it only reads local version information and prints text to stdout.
Classification basis and observed behavior
Classification basis
The script's primary function is to check the version of OpenClaw and report whether it is vulnerable based on a hardcoded comparison. It does not contain any code to exploit a vulnerability, such as sending malicious payloads, triggering command injection, or performing unauthorized actions. It only detects and reports exposure, which is characteristic of a scanner.
hargabyte-cve-scanner-ba936e9/cve-scan.sh:1-420Requirements
- OpenClaw must be installed and accessible in the system PATH for automatic version detection.
hargabyte-cve-scanner-ba936e9/cve-scan.sh:58-66
Observed behavior
- Detects the installed OpenClaw version by executing 'openclaw --version'.
hargabyte-cve-scanner-ba936e9/cve-scan.sh:58-66 - Compares the detected version against a hardcoded latest secure version (v2026.3.1) to determine if the installation is vulnerable.
hargabyte-cve-scanner-ba936e9/cve-scan.sh:124-133 - Displays a static list of CVE identifiers and descriptions, along with general statistics about OpenClaw vulnerabilities.
hargabyte-cve-scanner-ba936e9/cve-scan.sh:153-189 - Outputs a recommendation to update OpenClaw if the version is found to be vulnerable.
hargabyte-cve-scanner-ba936e9/cve-scan.sh:247-252
Behaviors behind the backdoor verdict
Observables
- Script Purpose
- Payload withheldThe script's sole function is to check the local OpenClaw version and display vulnerability information. It contains no network calls, file writes, or process execution beyond reading the OpenClaw version.
hargabyte-cve-scanner-ba936e9/cve-scan.sh:1-420 - Hardcoded Urls
- Payload withheldThese URLs appear only in the generated report text and are not fetched or used by the script. They are informational references.
hargabyte-cve-scanner-ba936e9/cve-scan.sh:355-357
What the analysis did not establish
- The evidence packet contains only one text file (cve-scan.sh) out of 9 total files in the artifact. The other 8 files are unclassified and their content is not provided, so the analysis is based solely on the supplied script.
- The script's vulnerability database is referenced as a separate JSON file (vulnerability-db.json) which is not included in the evidence, so the completeness of its CVE data cannot be verified.
- Only the single text file cve-scan.sh was provided; 8 unclassified files totaling 53685 bytes were present in the artifact but not analyzed. Their content is unknown.
- The review is based solely on static analysis of the supplied text; the script was not executed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-31802
Curated repository PoCStars: 34Created 2026-07-08Model review verdict: Suspicious behavior.ExploitCVE-2026-318022 files
AnalysisSuspicious behavior
Technical assessment
The artifact contains a Node.js script (payload withheld) that programmatically creates a tar archive with a drive-relative symlink (C:../../../target.txt) and then extracts it using the vulnerable tar.x() function, demonstrating file overwrite outside the extraction directory. The accompanying README.md describes the vulnerability and provides instructions for downloading and running a pre-built executable, but the included script itself is a functional exploit.
Backdoor review
Suspicious behaviorThe README.md instructs the operator to download and execute an external binary from a third-party repository, while the included payload withheld is a legitimate local PoC script. The README's instructions materially contradict the disclosed CVE context by directing the user to an unrelated executable, creating a deceptive lure.
Classification basis and observed behavior
Classification basis
The file payload withheld contains executable code that actively exploits CVE-2026-31802 by crafting a malicious tar archive and extracting it to overwrite a file outside the intended directory. This is code intended to exercise a vulnerability, not merely detect it.
Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:1-23Requirements
- Node.js runtime with the 'tar' npm package installed (version < 7.5.11)
Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:1-3 - Write access to the current working directory and its parent directory
Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:5-9
Observed behavior
- Creates a file 'target.txt' in the parent directory with content 'ORIGINAL'
Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:9 - Constructs a tar header with a symbolic link entry pointing to 'C:../../../target.txt'
Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:11-16 - Writes the crafted tar archive to 'poc.tar'
Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:18 - Extracts the tar archive using tar.x(), which follows the symlink and writes outside the extraction directory
Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:20 - Overwrites the symlink target with 'PWNED' and prints the content of the overwritten file to stdout
Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:21-22
Behaviors behind the backdoor verdict
Flagged behaviors
- The README.md presents itself as a PoC for CVE-2026-31802 but instructs the user to download and run an external .exe or .zip file from a different GitHub repository (Recorded-texteditor120/CVE-2026-31802). The actual PoC code (payload withheld) is a local Node.js script and does not require any external download. This misdirection conceals the true nature of the downloaded executable.
Recorded-texteditor120-CVE-2026-31802-f7f5553/README.md:3Recorded-texteditor120-CVE-2026-31802-f7f5553/README.md:35Recorded-texteditor120-CVE-2026-31802-f7f5553/README.md:43Recorded-texteditor120-CVE-2026-31802-f7f5553/README.md:55-59
Observables
- Url
- Payload withheldExternal download link for an unreviewed executable, presented as the primary way to use the PoC.
Recorded-texteditor120-CVE-2026-31802-f7f5553/README.md:3 - File
- Payload withheldLegitimate local PoC script that creates a tar archive with a drive-relative symlink to demonstrate CVE-2026-31802.
Recorded-texteditor120-CVE-2026-31802-f7f5553/poc.cjs:1-23
What the analysis did not establish
- The README.md references an external pre-built executable on a third-party releases page, which is not included in the evidence and cannot be analyzed.
- The evidence does not confirm whether the included payload withheld script was executed or whether it functions as described.
- The external executable referenced in the README is not included in the evidence and cannot be analyzed.
- The review cannot determine if the external repository is controlled by the same author or if the executable is harmful.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-26980
Curated repository PoCStars: 34Created 2026-07-08ExploitCVE-2026-26980CVE-2026-2905312 files
Analysis
Technical assessment
A Python exploit for CVE-2026-26980, an unauthenticated blind SQL injection in Ghost CMS's Content API. The code performs automated setup, boolean-based data extraction (admin email, password hash, API key), and fix validation against a Dockerized Ghost instance.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, Docker Compose file, Python exploit script, and shell validation script for CVE-2026-26980, a SQL injection vulnerability in Ghost CMS. All code performs expected PoC behavior: setting up a vulnerable Ghost instance, exploiting the SQL injection to extract database data, and validating the fix. No concealed executable behavior, persistence, credential exfiltration to external parties, or unrelated payloads were observed.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script (exploit.py) that actively exploits CVE-2026-26980 by sending malicious SQL injection payloads to extract data from a vulnerable Ghost CMS instance. The README describes it as a 'Full PoC: setup, verify, extract' and the code includes functions for data extraction (extract_admin_email, extract_password_hash, extract_admin_api_secret).
dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:1-4dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:296-316dinosn-ghost-cve-2026-26980-194f7c1/README.md:224Requirements
- A running, vulnerable Ghost instance (versions 3.24.0 through 6.19.0) with MySQL 8.
dinosn-ghost-cve-2026-26980-194f7c1/README.md:11dinosn-ghost-cve-2026-26980-194f7c1/docker-compose.yml:14 - Python 3.8+ with the 'requests' library installed.
dinosn-ghost-cve-2026-26980-194f7c1/README.md:116 - Docker and Docker Compose for the provided lab environment.
dinosn-ghost-cve-2026-26980-194f7c1/README.md:115
Observed behavior
- Automatically sets up a Ghost admin user or logs in if already configured.
dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:117-157 - Retrieves the public Content API key via admin API, custom integration creation, or HTML scraping.
dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:159-191 - Sends crafted HTTP requests to the Content API with a malicious filter parameter containing a SQL injection payload that uses an error-based boolean oracle (EXP(710) overflow).
dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:208-236 - Performs binary search extraction of database values, including admin email, bcrypt password hash, and admin API secret.
dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:256-316 - Includes a fix validation mode that confirms the target is not vulnerable.
dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:363-383
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the expected behavior of a PoC for CVE-2026-26980, which describes unauthenticated arbitrary database reads.
dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:296-316 - Network Communication
- Payload withheldNo external or hardcoded exfiltration endpoints are present; all data stays within the local test environment.
dinosn-ghost-cve-2026-26980-194f7c1/exploit.py:72-95 - Setup Script
- Payload withheldStandard lab automation; no hidden commands or external downloads beyond the declared Docker images and pip requirements.
dinosn-ghost-cve-2026-26980-194f7c1/validate.sh:1-40
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository unit are included. The packet metadata notes 7 non-text media files (screenshots) and 1 unclassified file that were not analyzed, but all 4 selected text files are complete.
- The analysis is based solely on the provided source code and documentation; the code was not executed, and its effectiveness is not verified.
- Seven non-text media files (screenshots) and one unclassified 17-byte file were present in the artifact but not analyzed; they are flagged as metadata-only and could theoretically contain steganographic payloads, though this is unlikely for a PoC repository.
- The review does not verify the safety of the Docker images (ghost:6.18.0, ghost:6.19.1, mysql:8.0) or the pip requirements.txt, which are external dependencies.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubCVE-2026-20687
Curated repository PoCStars: 34Created 2026-07-08WriteupCVE-2026-2068721 files
Analysis
Technical assessment
The artifact is a technical writeup describing a use-after-free vulnerability (CVE-2026-20687) in AppleJPEGDriver. It includes a conceptual code snippet illustrating the bug but does not provide a complete, executable exploit or scanner.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a README.md file describing a CVE-2026-20687 proof-of-concept for an AppleJPEGDriver use-after-free vulnerability. The file contains no executable code, no obfuscated payloads, and no instructions for the reviewer to perform harmful actions. It documents a kernel panic trigger and provides build instructions for a separate Xcode project that is not included in the reviewed evidence.
Classification basis and observed behavior
Classification basis
The artifact is a README file that provides a technical analysis of the vulnerability, including a description, target details, and a conceptual code snippet. It does not contain a complete, runnable exploit or scanner; the code snippet is illustrative and lacks the full implementation needed to exercise the vulnerability. The file is primarily a writeup.
enfilade-labs-CVE-2026-20687-AppleJPEGDriver-UAF-8a80640/README.md:1-62Requirements
- An app with access to AppleJPEGDriver (IOServiceOpen) on an affected iOS device.
enfilade-labs-CVE-2026-20687-AppleJPEGDriver-UAF-8a80640/README.md:35
Observed behavior
- The writeup describes a kernel panic caused by a use-after-free when a freed request's queue-node pointer is later dereferenced during a queue walk.
enfilade-labs-CVE-2026-20687-AppleJPEGDriver-UAF-8a80640/README.md:29enfilade-labs-CVE-2026-20687-AppleJPEGDriver-UAF-8a80640/README.md:48-50
Behaviors behind the backdoor verdict
Observables
- Documentation Only
- Payload withheldNo executable code, scripts, or binary payloads are present in the reviewed evidence. The described PoC targets a specific Apple kernel driver and causes a kernel panic, which is consistent with the stated CVE impact.
enfilade-labs-CVE-2026-20687-AppleJPEGDriver-UAF-8a80640/README.md:1-62
What the analysis did not establish
- Only the README.md file was provided; the artifact directory contains 20 other files (including an Xcode project) that were not included in the text evidence. The analysis is based solely on the README content.
- Only the README.md file was provided for review. The referenced Xcode project (ios-app/Test.xcodeproj) and any other files in the repository directory are not included in the evidence and were not analyzed.
- Binary files flagged in metadata were not inspected; their content is unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.