0xAshwesker
Source-scoped identity with 113 associated PoCs and 114 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
GitHub0xBlackash/CVE-2026-72898
Repository PoCStars: 0Created 2026-08-12ScannerCVE-2026-728982 files
Analysis
Technical assessment
The artifact is a safe version checker for CVE-2026-72898. It reads the public payload withheld endpoint of a Metabase instance to determine the version and compares it against known fixed versions to report if the instance is vulnerable. It contains no exploit or SQL injection payloads.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README documenting CVE-2026-72898 and a Python version-checker script. The script only reads the public payload withheld endpoint to determine the Metabase version and compares it against known fixed versions. No exploit code, SQL injection, command execution, or any other harmful behavior is present. The script's behavior matches its documented purpose.
Classification basis and observed behavior
Classification basis
The Python script explicitly states it is a 'SAFE version checker only' with 'NO SQL injection, NO exploit payloads, NO side effects'. It only reads a public endpoint and compares the version, which is scanner behavior.
metabase_cve_2026_72898_safe_check.py:2-5Requirements
- Target must be a Metabase instance with the payload withheld endpoint accessible.
metabase_cve_2026_72898_safe_check.py:77-78
Observed behavior
- Sends a GET request to payload withheld to retrieve the Metabase version tag.
metabase_cve_2026_72898_safe_check.py:77-91 - Parses the version and compares it against a hardcoded list of fixed versions to determine vulnerability status.
metabase_cve_2026_72898_safe_check.py:41-70 - Prints a 'VULNERABLE' or 'SAFE' message based on the version comparison.
metabase_cve_2026_72898_safe_check.py:110-119
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldThe only endpoint contacted by the checker script; it is a public, read-only Metabase endpoint used to retrieve version information.
metabase_cve_2026_72898_safe_check.py:77
What the analysis did not establish
- Only the two text files in the repository were reviewed; no other files exist in the snapshot.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-64638
Repository PoCStars: 1Created 2026-08-07ScannerCVE-2026-646382 files
Analysis
Technical assessment
The artifact is a Python script that checks a target WordPress site for vulnerability to CVE-2026-64638 by detecting the installed version and comparing it against known patched versions. It does not contain any XSS payload, RCE chain, or exploitation logic.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README describing CVE-2026-64638 and a Python script that performs safe version detection. The script only fetches public pages from a user-supplied URL to extract the WordPress version and compares it against a hardcoded list of fixed versions. No XSS payloads, RCE chains, social-engineering components, or any other concealed harmful behavior are present. The code's behavior is fully disclosed and consistent with its stated purpose.
Classification basis and observed behavior
Classification basis
The Python script explicitly states it is a 'SAFE checker only' with 'NO XSS payloads, NO RCE chain, NO social-engineering components' and performs only version detection and comparison. It does not attempt to exploit or trigger the vulnerability.
wordpress_cve_2026_64638_safe_check.py:2-5Requirements
- Target WordPress URL must be provided as a command-line argument.
wordpress_cve_2026_64638_safe_check.py:134-140 - The 'packaging' Python library must be installed.
wordpress_cve_2026_64638_safe_check.py:13
Observed behavior
- Fetches HTML content from common WordPress paths (/, /wp-login.php, /readme.html, /feed/, /?rest_route=/) to extract the version string from meta tags, readme, or RSS feed.
wordpress_cve_2026_64638_safe_check.py:65-106 - Compares the detected version against a hardcoded dictionary of fixed versions to determine if the target is vulnerable.
wordpress_cve_2026_64638_safe_check.py:24-63 - Prints a vulnerability status (VULNERABLE or SAFE) and remediation advice to stdout.
wordpress_cve_2026_64638_safe_check.py:108-132
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldThe script takes a single URL as a command-line argument and fetches public pages from that host to determine the WordPress version. This is the disclosed and expected behavior for a version checker.
wordpress_cve_2026_64638_safe_check.py:134-140
What the analysis did not establish
- The evidence includes only the README.md and the scanner script; no exploit code or detailed technical writeup is present.
- The scanner relies solely on version string extraction and comparison, which may produce false positives or negatives if the version is obscured or if a backport patch is applied without a version bump.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-46243
Repository PoCStars: 0Created 2026-08-03WriteupCVE-2026-462431 file
Analysis
Technical assessment
The artifact is a payload withheld file providing a technical overview of CVE-2026-46243, a local privilege escalation vulnerability in the Linux kernel CIFS/SMB client. It describes the vulnerability, affected configurations, impact, and mitigation, but contains no exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The repository contains only a payload withheld file with documentation about CVE-2026-46243. No executable code, scripts, or instructions for running a PoC are present. The content is purely informational, describing the vulnerability, affected configurations, impact, and mitigation. There is no evidence of backdoor behavior, concealed payloads, or deceptive instructions.
Classification basis and observed behavior
Classification basis
The artifact is a payload withheld file that provides a technical writeup of CVE-2026-46243, including an overview, affected configurations, impact, and mitigation. It contains no executable code, exploit, or scanner logic. The analysis routing classification is 'NO_POC_CODE_IDENTIFIED', and the file content is purely descriptive Markdown.
README.md:1-101Requirements
- Linux kernel with CIFS enabled, cifs-utils, default cifs.upcall, user namespaces enabled, local shell access
README.md:50-56
Observed behavior
- Describes a vulnerability where improper validation of cifs.spnego key descriptions allows an unprivileged local user to impersonate trusted kernel-generated requests, potentially leading to privilege escalation.
README.md:27-29
Behaviors behind the backdoor verdict
Observables
- File Content
- Payload withheldThe sole file in the repository is a Markdown document describing CVE-2026-46243. It contains no code, commands, or links to external payloads.
README.md:1-101
What the analysis did not establish
- The evidence packet contains only a single payload withheld file; no other source code, scripts, or binaries are present. The analysis routing classification confirms 'NO_POC_CODE_IDENTIFIED' and 'NO_EXECUTABLE_SOURCE_IDENTIFIED'.
- Only the payload withheld file was present in the repository; no other files were available for review.
- The analysis is limited to static text review; no dynamic execution or external resource verification was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-64531
Repository PoCStars: 2Created 2026-08-01ScannerCVE-2026-645312 files
Analysis
Technical assessment
The artifact is a safe exposure checker for CVE-2026-64531. It performs non-destructive checks (kernel version, module presence, namespace policy) to assess vulnerability exposure without sending Netlink messages or attempting exploitation.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README.md describing CVE-2026-64531 and a Python script (CVE-2026-64531-SafeCheck.py) that performs only non-destructive local system checks (kernel version, module presence, namespace policy). No backdoor, concealed payload, or deceptive behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The script explicitly states it performs only non-destructive checks and does not send Netlink/OVS messages, create datapaths, attempt oversized actions, or perform privilege escalation. It checks kernel version, module presence, module load state, and namespace policy to report exposure status. This is scanner behavior, not exploit code.
CVE-2026-64531-SafeCheck.py:7-18CVE-2026-64531-SafeCheck.py:184-188Requirements
- Python 3 environment to run the checker script
CVE-2026-64531-SafeCheck.py:1
Observed behavior
- Checks kernel version and maps it against known fixed upstream stable ranges
CVE-2026-64531-SafeCheck.py:155-181 - Checks for presence of openvswitch kernel module files on disk
CVE-2026-64531-SafeCheck.py:65-90 - Checks if openvswitch module is currently loaded via lsmod
CVE-2026-64531-SafeCheck.py:93-98 - Reads sysctl settings related to unprivileged user namespaces
CVE-2026-64531-SafeCheck.py:115-130 - Prints a heuristic summary of exposure (NOT EXPOSED, LIKELY NOT REACHABLE, POTENTIALLY EXPOSED) without exploiting
CVE-2026-64531-SafeCheck.py:256-286
Behaviors behind the backdoor verdict
Observables
- Script Behavior
- Payload withheldAll operations are read-only and local; no network, file modification, or privilege escalation is attempted.
CVE-2026-64531-SafeCheck.py:37-49CVE-2026-64531-SafeCheck.py:65-90CVE-2026-64531-SafeCheck.py:93-98CVE-2026-64531-SafeCheck.py:101-130CVE-2026-64531-SafeCheck.py:184-291 - Script Disclaimer
- Payload withheldReinforces that the script is a safe checker, not an exploit.
CVE-2026-64531-SafeCheck.py:7-18
What the analysis did not establish
- The README.md is a writeup with no executable code; only the Python script is analyzed for classification.
- The script's version comparison is approximate and may not detect backported fixes; it is a heuristic scanner, not a definitive exploit or verification tool.
- Only the two text files (CVE-2026-64531-SafeCheck.py and README.md) were provided; no other files from the repository were reviewed.
- Binary content was flagged but not analyzed; the evidence envelope reports zero binary files, so this does not affect the verdict.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-60004
Repository PoCStars: 0Created 2026-07-30ExploitCVE-2026-600042 files
Analysis
Technical assessment
A Python script that exploits CVE-2026-60004 in Gitea by crafting a malicious diff patch containing a Git hook, submitting it to the /diffpatch API endpoint, and retrieving the executed command output via a smart HTTP fetch.
Backdoor review
No backdoor observed in reviewed code
The PoC is a single Python script that exploits CVE-2026-60004 by sending crafted diff patches to a Gitea instance to install and execute a Git hook. The hook runs the user-supplied shell command and returns the output. No concealed backdoor, unrelated payload, or deceptive behavior was observed. The script's actions are limited to the declared exploit flow: authentication, repository creation, patch submission, and output retrieval.
Classification basis and observed behavior
Classification basis
The Python script actively exploits the vulnerability by crafting and delivering a malicious payload (Git hook) to the target, triggering its execution, and retrieving the results. It does not merely detect or report the vulnerability; it exercises it to achieve remote code execution.
CVE-2026-60004.py:139-163CVE-2026-60004.py:303-312CVE-2026-60004.py:315-323Requirements
- Authenticated Gitea user with repository write access
CVE-2026-60004.py:10-11 - Target Gitea instance must be vulnerable (versions 1.17 to <1.27.1)
CVE-2026-60004.py:18 - Git executable must be available on the attacker's machine
CVE-2026-60004.py:251-253
Observed behavior
- Authenticates to the Gitea instance using provided credentials
CVE-2026-60004.py:276-284 - Creates a new private repository on the target Gitea instance
CVE-2026-60004.py:287-297 - Constructs a malicious Git hook (post-index-change) that executes an attacker-supplied shell command and stores the output in a Git object
CVE-2026-60004.py:139-163 - Generates a diff patch that introduces the malicious hook file
CVE-2026-60004.py:165-175 - Submits the malicious patch twice to the /diffpatch API endpoint to trigger the vulnerability
CVE-2026-60004.py:303-312 - Fetches the command output from the target repository using Git smart HTTP protocol
CVE-2026-60004.py:194-214 - Displays the executed command output and exit status to the attacker
CVE-2026-60004.py:315-323
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThis is the declared exploit behavior for CVE-2026-60004 and matches the vulnerability description.
CVE-2026-60004.py:139-163CVE-2026-60004.py:165-175CVE-2026-60004.py:303-311 - Output Retrieval
- Payload withheldThis is the standard method for retrieving the result of the executed command and is consistent with the exploit's purpose.
CVE-2026-60004.py:194-214CVE-2026-60004.py:314-317 - Network Communication
- Payload withheldNo external or unrelated network endpoints are contacted.
CVE-2026-60004.py:87-132CVE-2026-60004.py:196-200
What the analysis did not establish
- CVE-2026-60004 record was absent from the acquired CVEList V5 dataset, so CVE metadata could not be independently verified.
- Only the two text files (Python script and README) were provided; no binary or configuration files were included.
- The analysis is based solely on static review of the provided source code; the code was not executed, and its behavior was not dynamically verified.
- Review is limited to the supplied text files; no binary or non-text content was present in the evidence.
- The script's behavior depends on the Gitea version and configuration; the review does not verify the exploit's effectiveness or safety.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-66066
Repository PoCStars: 1Created 2026-07-29ScannerCVE-2026-660662 files
Analysis
Technical assessment
The artifact is a safe remote fingerprinting scanner for CVE-2026-66066. It probes a target URL for Rails and Active Storage indicators without exploiting the vulnerability. The README provides a technical writeup but the primary executable code is a scanner.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README.md documentation file and a Ruby script (CVE-2026-66066-SafeCheck.rb) that performs a non-exploitative remote fingerprint of a target for CVE-2026-66066. The script makes only HTTP GET requests to standard Rails paths and analyzes response headers and body content for indicators. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The Ruby script explicitly states it is a 'Safe Remote Fingerprint' and 'Non-exploiting · version / fingerprint only'. It checks for the presence of Rails and Active Storage indicators via HTTP requests and response analysis, which is detection/scanning behavior, not exploitation.
CVE-2026-66066-SafeCheck.rb:3-5CVE-2026-66066-SafeCheck.rb:70-71Requirements
- Target URL must be provided via -u flag
CVE-2026-66066-SafeCheck.rb:36
Observed behavior
- Sends HTTP GET requests to the target base URL and specific Active Storage paths
CVE-2026-66066-SafeCheck.rb:75CVE-2026-66066-SafeCheck.rb:125-128 - Checks response headers (Server, X-Runtime, X-Version) and body content for Rails markers
CVE-2026-66066-SafeCheck.rb:78-106 - Probes /rails/info/properties for version information exposure
CVE-2026-66066-SafeCheck.rb:141-142 - Calculates a risk score based on detected indicators and prints a verdict (HIGH, MEDIUM, LOW)
CVE-2026-66066-SafeCheck.rb:155-175
Behaviors behind the backdoor verdict
Observables
- Script Behavior
- Payload withheldThe script's behavior is consistent with its stated purpose of safe remote fingerprinting and does not exhibit backdoor or trojan characteristics.
CVE-2026-66066-SafeCheck.rb:48-63CVE-2026-66066-SafeCheck.rb:75-84CVE-2026-66066-SafeCheck.rb:95-106CVE-2026-66066-SafeCheck.rb:117-129CVE-2026-66066-SafeCheck.rb:141-142 - Documentation Content
- Payload withheldThe documentation aligns with the stated defensive and research purpose and contains no instructions for malicious use or concealed payloads.
README.md:19-22README.md:123-127
What the analysis did not establish
- The repository structure in README.md references docs/, detection/, screenshots/, and images/ directories that are not present in the supplied evidence packets.
- The README.md describes a technical writeup and detection guidance, but only the scanner script and README are provided; no exploit code is included.
- Only the two text files (CVE-2026-66066-SafeCheck.rb and README.md) were provided and reviewed. No other files from the repository (e.g., docs/, detection/, images/) were included in the evidence packet, so their contents are unknown.
- The script disables SSL certificate verification (line 55), which is a security weakness but is a common practice in scanning tools and does not constitute a backdoor or trojan.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-53921
Repository PoCStars: 2Created 2026-07-28ScannerCVE-2026-539212 files
Analysis
Technical assessment
The artifact is a passive scanner that checks a target host for indicators of OpenWrt (HTTP banners, SSH banners, UDP port 547) to assess potential exposure to CVE-2026-53921. It explicitly states it never sends DHCPv6 packets and does not exploit the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README describing CVE-2026-53921 and a Python script that performs passive reconnaissance (HTTP, SSH, UDP port check) to identify potential OpenWrt targets. The script sends only an empty UDP datagram to port 547 and explicitly avoids sending DHCPv6 packets. No backdoor, concealed executable, or operator-directed harm is observed.
Classification basis and observed behavior
Classification basis
The Python script is explicitly described as a 'Safe Passive Checker' that is '100% non-exploiting' and 'never sends DHCPv6 packets'. It only performs reconnaissance (HTTP, SSH, UDP port checks) to detect OpenWrt indicators, which is characteristic of a vulnerability scanner, not an exploit.
CVE-2026-53921-SafeCheck.py:3-5CVE-2026-53921-SafeCheck.py:178Requirements
- Target host or URL must be reachable over the network for HTTP, SSH, and UDP checks.
CVE-2026-53921-SafeCheck.py:96-98
Observed behavior
- Fetches HTTP/HTTPS banners and inspects page content for OpenWrt/LuCI indicators.
CVE-2026-53921-SafeCheck.py:47-68 - Retrieves SSH banner and checks for OpenWrt or Dropbear strings.
CVE-2026-53921-SafeCheck.py:70-77 - Sends an empty UDP datagram to port 547 to check if the port is open or filtered.
CVE-2026-53921-SafeCheck.py:79-92 - Reports whether the target is potentially vulnerable based on collected indicators, without sending any DHCPv6 packets.
CVE-2026-53921-SafeCheck.py:157-178
Behaviors behind the backdoor verdict
Observables
- Network Activity
- Payload withheldThe script sends an empty UDP payload to check if the DHCPv6 port is open, consistent with its stated passive checking purpose.
CVE-2026-53921-SafeCheck.py:83 - Network Activity
- Payload withheldThe script fetches the target's web interface to identify OpenWrt/LuCI indicators, a standard reconnaissance technique.
CVE-2026-53921-SafeCheck.py:50 - Network Activity
- Payload withheldThe script connects to port 22 to read the SSH banner, looking for Dropbear/OpenWrt strings.
CVE-2026-53921-SafeCheck.py:72-73
What the analysis did not establish
- The CVE record for CVE-2026-53921 was absent from the acquired CVEList, so the vulnerability description relies solely on the artifact's README.
- Only the two text files in the repository were reviewed; no binary or other files were present.
- The script's network requests could be used for reconnaissance in an attack chain, but the artifact itself contains no exploitation or backdoor code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-54121
Repository PoCStars: 2Created 2026-07-25ScannerCVE-2026-541212 files
Analysis
Technical assessment
The artifact is a PowerShell script that performs read-only checks to detect whether a system is potentially vulnerable to CVE-2026-54121. It inspects the OS type, AD CS role installation, and recent security update status, and outputs a summary. It does not contain any exploit code.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README.md and a PowerShell script (CVE-2026-54121-SafeCheck.ps1). The script performs only read-only system checks (OS info, AD CS role detection, hotfix enumeration, event log queries, and read-only certutil commands) and explicitly states it is non-exploitative. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The script explicitly states it is a 'Complete Safe Checker' and 'Fully non-exploitative detection script' that 'Does NOT exploit anything'. Its operations are limited to reading system configuration, installed roles, and update history to determine vulnerability status, which is characteristic of a scanner.
CVE-2026-54121-SafeCheck.ps1:3CVE-2026-54121-SafeCheck.ps1:5CVE-2026-54121-SafeCheck.ps1:10Requirements
- PowerShell 5.1 or later
CVE-2026-54121-SafeCheck.ps1:13 - Execution on a Windows system
CVE-2026-54121-SafeCheck.ps1:44-45
Observed behavior
- Gathers system information (OS, version, domain, product type) via CIM
CVE-2026-54121-SafeCheck.ps1:44-45 - Checks if the AD CS Certificate Authority role is installed via Get-WindowsFeature or Get-Service
CVE-2026-54121-SafeCheck.ps1:81-82CVE-2026-54121-SafeCheck.ps1:95-96 - Lists hotfixes installed on or after July 1, 2026
CVE-2026-54121-SafeCheck.ps1:115-117 - Queries Windows Update event log for recent successful installations
CVE-2026-54121-SafeCheck.ps1:139-145 - If AD CS is installed, retrieves read-only CA information and lists certificate templates using certutil
CVE-2026-54121-SafeCheck.ps1:168CVE-2026-54121-SafeCheck.ps1:181 - Outputs a final summary and recommendation based on the checks
CVE-2026-54121-SafeCheck.ps1:193-206
Behaviors behind the backdoor verdict
Observables
- Script Behavior
- Payload withheldThe script uses Get-CimInstance, Get-WindowsFeature, Get-HotFix, Get-WinEvent, and certutil -CAInfo/-CATemplates, all of which are read-only operations. No file writes, network connections, or process creation are performed.
CVE-2026-54121-SafeCheck.ps1:44-45CVE-2026-54121-SafeCheck.ps1:81CVE-2026-54121-SafeCheck.ps1:115-117CVE-2026-54121-SafeCheck.ps1:139-145CVE-2026-54121-SafeCheck.ps1:168CVE-2026-54121-SafeCheck.ps1:181 - Script Claim
- Payload withheldThe script header and final summary explicitly state it performs only read-only checks and does not attempt exploitation or modification.
CVE-2026-54121-SafeCheck.ps1:5-7CVE-2026-54121-SafeCheck.ps1:209-210
What the analysis did not establish
- The README.md describes the vulnerability and attack flow but does not contain executable code; it is a writeup. The classification is based on the primary artifact, the PowerShell script, which is a scanner.
- Only the two text files (README.md and CVE-2026-54121-SafeCheck.ps1) were reviewed; no other files exist in the repository according to the evidence envelope.
- The script's behavior depends on the PowerShell environment, but the code itself contains no backdoor logic.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-60206
Repository PoCStars: 2Created 2026-07-24ExploitCVE-2026-602063 files
Analysis
Technical assessment
The artifact contains a Python script (CVE-2026-60206.py) that generates a forged SAML response and sends it to a target WebLogic server's SAML ACS endpoint, attempting to gain unauthorized access. This is exploit code.
Backdoor review
No backdoor observed in reviewed code
The repository contains a vulnerability checker and a proof-of-concept exploit for CVE-2026-60206, a SAML authentication vulnerability in Oracle WebLogic Server. The checker performs passive reconnaissance (HTTP GET requests to common paths) and inspects server headers and response text for WebLogic and SAML indicators. The PoC constructs and sends a self-asserted SAML response to the target's SAML ACS endpoint. Neither script exhibits backdoor behavior: they do not establish persistence, exfiltrate data, download secondary payloads, or execute commands beyond the declared exploit flow. The README provides documentation and explicitly states it does not include exploit code, though the repository does contain a PoC script. No obfuscation, concealed executable behavior, or operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The file CVE-2026-60206.py is explicitly named a 'PoC' and contains a function 'exploit' that crafts and sends a malicious SAML response to compromise the target server, which is the definition of exploit code.
CVE-2026-60206.py:3CVE-2026-60206.py:61CVE-2026-60206.py:70-80Requirements
- Target must be running Oracle WebLogic Server with a SAML endpoint accessible.
CVE-2026-60206.py:61-64
Observed behavior
- Generates a SAML response XML with attacker-controlled username and 'Administrators' role, encodes it in base64, and sends it via HTTP POST to the target's SAML ACS endpoint.
CVE-2026-60206.py:30-59CVE-2026-60206.py:70-80 - Saves the server's HTTP response to a local file 'saml_response.html'.
CVE-2026-60206.py:92-94
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldHardcoded Issuer in the SAML template used by the PoC; indicates a placeholder identity provider for the self-asserted SAML response.
CVE-2026-60206.py:41 - Url
- Payload withheldDefault SAML ACS path targeted by both the checker and the PoC.
CVE-2026-60206-check.py:27CVE-2026-60206.py:61 - Username
- Payload withheldDefault username used in the PoC SAML assertion; represents a low-privileged user for privilege escalation testing.
CVE-2026-60206.py:61
What the analysis did not establish
- The README.md states the repository 'does not include exploit code', which contradicts the presence of CVE-2026-60206.py.
- The exploit's effectiveness is not verified; it relies on the target server accepting a self-signed, unvalidated SAML assertion.
- Review is limited to the three text files supplied; no binary files were present or analyzed.
- The PoC script sends a crafted SAML response to a user-supplied target, which could be used maliciously, but the script itself contains no backdoor or deceptive behavior beyond the declared exploit.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-64600
Repository PoCStars: 18Created 2026-07-22ScannerCVE-2026-646002 files
Analysis
Technical assessment
The artifact is a Bash script that checks a Linux system for exposure to CVE-2026-64600 by inspecting the kernel version, mounted XFS filesystems with reflink enabled, and kernel symbols. It does not exploit the vulnerability; it only reports potential vulnerability status.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README and a shell script. The script performs read-only system checks (kernel version, XFS filesystem status, patch detection) to assess vulnerability to CVE-2026-64600. No backdoor, deceptive payload, or harmful behavior is observed.
Classification basis and observed behavior
Classification basis
The script performs read-only system checks (kernel version, filesystem mount options, kernel symbols) to determine if a system is potentially vulnerable to CVE-2026-64600. It does not contain any code to trigger, exploit, or exercise the vulnerability. The README describes the vulnerability but provides no exploit code. This matches the definition of a scanner.
CVE-2026-64600.sh:3-4CVE-2026-64600.sh:16-80README.md:1-113Requirements
- Local shell access on a Linux system
CVE-2026-64600.sh:1
Observed behavior
- Checks kernel version and flags older kernels as potentially vulnerable
CVE-2026-64600.sh:16-27 - Enumerates mounted XFS filesystems and checks if reflink is enabled
CVE-2026-64600.sh:30-51 - Searches /proc/kallsyms and kernel config for XFS reflink symbols to detect patches
CVE-2026-64600.sh:54-68 - Outputs a final verdict of vulnerable or not vulnerable based on checks
CVE-2026-64600.sh:71-80
Behaviors behind the backdoor verdict
Observables
- Script Behavior
- Payload withheldThe script uses uname, findmnt, xfs_info, grep on /proc/kallsyms and /boot/config to check for vulnerability indicators without modifying the system.
CVE-2026-64600.sh:17-18CVE-2026-64600.sh:34CVE-2026-64600.sh:44CVE-2026-64600.sh:55-60 - Discrepancy
- Payload withheldThe README incorrectly names the affected component as 'RefluxFS' while the actual vulnerability is in XFS reflink code. This appears to be a documentation error rather than malicious intent.
README.md:22CVE-2026-64600.sh:3
What the analysis did not establish
- Only the provided text files (CVE-2026-64600.sh and README.md) were analyzed; no other files from the repository were inspected.
- The script's patch detection logic is heuristic and may produce false positives or negatives.
- Only the two text files in the repository were reviewed; no binary files were present or analyzed.
- The review does not verify the accuracy of the vulnerability assessment or the safety of the recommended update commands.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-63030
Repository PoCStars: 1Created 2026-07-18ExploitCVE-2026-630302 files
Analysis
Technical assessment
The artifact contains a Python script (wp2shell-poc.py) that exploits CVE-2026-63030 by sending a crafted batch REST API request with a SQL injection payload to write a webshell and execute arbitrary commands on a vulnerable WordPress instance.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README describing CVE-2026-63030 and a Python PoC script (wp2shell-poc.py). The PoC exploits the described vulnerability by sending a crafted batch REST API request to write a webshell and then executing commands via that webshell. This behavior is consistent with the stated exploit objective (Remote Code Execution via SQL Injection and route confusion). No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or deceptive behavior was observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The wp2shell-poc.py script actively exploits the vulnerability by sending a crafted request to write a webshell and execute commands, which is the definition of exploit code. The README.md provides documentation but the primary artifact is the exploit script.
wp2shell-poc.py:3wp2shell-poc.py:30-40wp2shell-poc.py:45-46Requirements
- Target must be a vulnerable WordPress instance (6.9.x before 6.9.5 or 7.0.x before 7.0.2) with the REST API batch endpoint exposed.
README.md:33-35 - The MySQL user must have FILE privilege to write the webshell via INTO OUTFILE.
wp2shell-poc.py:35
Observed behavior
- Sends a POST request to /wp-json/batch/v1 with a JSON payload containing a SQL injection in the author__not_in[] parameter.
wp2shell-poc.py:30-40 - The SQL injection payload uses UNION SELECT ... INTO OUTFILE to write a PHP webshell to /wp-content/uploads/poc.php.
wp2shell-poc.py:35 - Executes system commands (id, uname -a, cat /etc/passwd, whoami) by sending GET requests to the deployed webshell with the cmd parameter.
wp2shell-poc.py:24wp2shell-poc.py:45-46
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal exploit behavior for CVE-2026-63030 as described in the CVE context and README.
wp2shell-poc.py:30-46 - Author Contact
- Payload withheldAuthor attribution in the PoC script header.
wp2shell-poc.py:4
What the analysis did not establish
- material evidence limitation
- Only the two text files (README.md and wp2shell-poc.py) were reviewed. No binary files or other repository contents were inspected.
- The PoC script uses verify=False for HTTPS requests, which disables TLS certificate verification, but this is a common practice in PoC scripts and not a backdoor indicator.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-15409
Repository PoCStars: 3Created 2026-07-15ScannerCVE-2026-154092 files
Analysis
Technical assessment
The artifact contains a Python script that checks for the presence of CVE-2026-15409 by sending HTTP requests to a target and analyzing responses for indicators of SSRF. It does not exploit the vulnerability to gain unauthorized access or execute commands.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README documenting CVE-2026-15409 and a Python script that performs safe SSRF detection by sending requests to a public test URL (httpbin.org) and checking for reflected content. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The Python script's primary operation is to send crafted requests to a target and analyze the response to detect a vulnerability. It does not contain code to exploit the vulnerability for unauthorized actions, such as accessing internal resources or executing commands. The script's own banner and comments describe it as a 'Safe Checker' that 'Only performs safe detection - NO internal probing'.
cve-2026-15409-checker.py:8-9cve-2026-15409-checker.py:63-66Requirements
- Network access to the target SonicWall SMA1000 appliance.
cve-2026-15409-checker.py:12-14
Observed behavior
- Sends HTTP GET requests to a target URL with various query parameters (url, target, redirect, proxy) containing an encoded external URL (payload withheld).
cve-2026-15409-checker.py:26-28cve-2026-15409-checker.py:40-45 - Checks the HTTP response for indicators of SSRF, such as the presence of 'origin', 'httpbin.org', or '"ip"' in the response body.
cve-2026-15409-checker.py:63-66 - Reports whether the target appears vulnerable based on the response analysis.
cve-2026-15409-checker.py:99-105
Behaviors behind the backdoor verdict
Observables
- Network Request
- Payload withheldThe script sends requests to this public test service to detect SSRF by checking if the appliance's IP appears in the response.
cve-2026-15409-checker.py:27-28 - Ssl Verification Disabled
- Payload withheldThe script disables SSL certificate verification, which is a common practice for testing appliances with self-signed certificates but could expose the tester to MITM risks.
cve-2026-15409-checker.py:57
What the analysis did not establish
- The evidence consists of a README.md and a Python script. No exploit code is present. The script's detection logic is based on generic SSRF indicators and may not be specific to CVE-2026-15409.
- Only the two text files (README.md and cve-2026-15409-checker.py) were reviewed; no other files were present in the artifact.
- Binary content was not analyzed, but none was reported in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-43499
Repository PoCStars: 6Created 2026-07-08ScannerCVE-2026-434992 files
Analysis
Technical assessment
The artifact contains a Python script that checks the kernel version against a hardcoded list to determine if the system is likely vulnerable to CVE-2026-43499. It also includes a crash proof-of-concept that attempts to trigger a kernel panic via futex syscalls, but the primary stated operation is detection and validation, not reliable exploitation.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README documenting CVE-2026-43499 and a Python script (ghostlock_poc.py) that checks kernel version and optionally triggers a crash PoC using futex syscalls. The script performs only the described vulnerability check and crash demonstration; no concealed backdoor, credential theft, persistence, or unrelated payload is present.
Classification basis and observed behavior
Classification basis
The Python script is named 'Safe Checker + Crash PoC' and its primary function is to check the kernel version and report vulnerability status. The crash PoC is described as a dangerous test that may cause a kernel panic, but it does not contain code to gain privileges or achieve reliable exploitation; it only attempts to trigger a crash, which aligns with a scanner/detector role.
ghostlock_poc.py:3ghostlock_poc.py:39-49ghostlock_poc.py:66-68Requirements
- Local code execution on a Linux system with a vulnerable kernel version.
ghostlock_poc.py:24-37 - Access to futex system calls.
ghostlock_poc.py:57-58
Observed behavior
- Checks the running kernel version against a hardcoded list of patched versions to report vulnerability status.
ghostlock_poc.py:24-37 - Spawns multiple threads that call futex with FUTEX_LOCK_PI, then calls FUTEX_CMP_REQUEUE_PI in a loop to attempt to trigger a kernel crash.
ghostlock_poc.py:60-82
Behaviors behind the backdoor verdict
Observables
- Futex Syscall
- Payload withheldThe PoC uses raw futex syscalls (FUTEX_LOCK_PI, FUTEX_CMP_REQUEUE_PI) to trigger the described rtmutex vulnerability, consistent with the documented attack flow.
ghostlock_poc.py:58ghostlock_poc.py:62ghostlock_poc.py:79 - Kernel Version Check
- Payload withheldThe script checks the running kernel version against known patched versions before running the PoC, which is normal safety behavior for a vulnerability checker.
ghostlock_poc.py:24-37 - User Prompt
- Payload withheldThe script requires explicit user confirmation before executing the crash PoC, indicating no automatic or concealed harmful action.
ghostlock_poc.py:91
What the analysis did not establish
- The kernel version check uses a hardcoded list of patched versions and may produce false positives or negatives for kernels not explicitly listed.
- The crash PoC is described as potentially causing a kernel panic, but its reliability and effectiveness are not verified.
- The artifact does not include a working exploit for privilege escalation; it only attempts to trigger a crash.
- Only the two text files (README.md, ghostlock_poc.py) were reviewed; no binary or other files were present in the evidence packet.
- The review does not assess whether the PoC actually triggers the vulnerability or causes kernel panic; it only evaluates the presence of backdoor or deceptive behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-53359
Repository PoCStars: 4Created 2026-07-07ExploitCVE-2026-533592 files
Analysis
Technical assessment
A Linux kernel module (CVE-2026-53359.c) that exploits CVE-2026-53359, a use-after-free vulnerability in KVM's shadow MMU, to cause a host denial-of-service. It sets up nested paging, runs a writer thread that races a PDE mapping between a 2MB huge page and a 4KB table, and launches multiple vCPU threads to trigger the bug, leading to a kernel panic.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Linux kernel module (CVE-2026-53359.c) and a README.md file. The kernel module is a proof-of-concept (PoC) for CVE-2026-53359, a KVM shadow paging use-after-free vulnerability. It sets up nested page tables and races a page table entry modification to trigger the described vulnerability, leading to a host kernel denial-of-service (DoS). The code performs only the actions necessary to demonstrate the vulnerability: allocating memory, configuring VMX/SVM virtualization, and running a guest that triggers the race condition. No backdoor, concealed payload, credential theft, persistence mechanism, or unrelated remote access behavior is observed. The README.md describes the vulnerability and its impact, consistent with the PoC's purpose.
Classification basis and observed behavior
Classification basis
The primary artifact is a complete, compilable Linux kernel module (CVE-2026-53359.c) that actively triggers the described vulnerability to cause a host crash. It includes code to set up VMX/SVM virtualization, configure nested page tables, and race a PDE mapping to induce a use-after-free, which is the definition of exploit code.
CVE-2026-53359.c:1-978Requirements
- Requires root or CAP_SYS_MODULE to load the kernel module.
CVE-2026-53359.c:977 - Requires a vulnerable Linux kernel with KVM shadow paging support and the kvm_intel or kvm_amd module unloaded.
CVE-2026-53359.c:7CVE-2026-53359.c:900-901
Observed behavior
- Allocates and configures nested page tables (EPT/NPT) to create a scenario where a PDE mapping is raced between a 2MB huge page and a 4KB table, causing a role mismatch in the shadow MMU.
CVE-2026-53359.c:741-831 - Launches a writer kernel thread that continuously flips a PDE entry between a huge page and a table pointer, and multiple vCPU threads that execute guest code to trigger MMU operations, leading to a use-after-free and host kernel panic.
CVE-2026-53359.c:838-877 - The README documents the expected outcome as a kernel panic with a call trace in pte_list_remove and kvm_mmu_page_get_gfn, confirming the DoS impact.
README.md:75-89
Behaviors behind the backdoor verdict
Observables
- Vulnerability Trigger
- Payload withheldThe PoC demonstrates the CVE-2026-53359 vulnerability by toggling a PDE between a huge page and a table entry while guest code executes, causing a role mismatch and subsequent use-after-free in the host kernel.
CVE-2026-53359.c:849-856 - Kernel Module Metadata
- Payload withheldStandard kernel module metadata identifying the author and purpose, consistent with a legitimate PoC.
CVE-2026-53359.c:38-40
What the analysis did not establish
- The evidence includes only the source code and README; no binary, build artifacts, or runtime logs are provided to confirm successful execution.
- The README claims a guest-to-host escape exploit exists but the public release is primarily a DoS demonstration; the provided code is a DoS exploit, not a full escape.
- Only the two text files (CVE-2026-53359.c and README.md) were reviewed; no binary files were present or analyzed.
- The review does not assess whether the PoC successfully triggers the vulnerability or is safe to execute; it only evaluates the presence of backdoor or deceptive behavior within the supplied code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-46242
Repository PoCStars: 12Created 2026-07-04ExploitCVE-2026-462422 files
Analysis
Technical assessment
A self-contained C exploit for CVE-2026-46242 that attempts to trigger a use-after-free race condition in the Linux kernel's eventpoll subsystem and escalate privileges to root.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README describing CVE-2026-46242 and a C source file implementing a local privilege escalation exploit for the vulnerability. The exploit code performs standard race-condition triggering, heap spraying, and a privilege check, consistent with a proof-of-concept for the stated CVE. No concealed backdoor, credential theft, persistence mechanism, or unrelated payload is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The C file is a complete, self-contained program that actively attempts to trigger a vulnerability and escalate privileges, which is the definition of an exploit. The code includes a racer thread, a trigger loop, and a post-exploit check for root access followed by a shell execution.
CVE-2026-46242.c:2-8CVE-2026-46242.c:34-45CVE-2026-46242.c:80-88CVE-2026-46242.c:101-108Requirements
- Local access to a vulnerable Linux kernel version (5.15.209 to <5.16, 6.1.175 to <6.2, 6.4 to <6.18.33, 6.19 to <7.0.10).
README.md:81-87 - Low-privileged user account on the target system.
README.md:44
Observed behavior
- Creates multiple interconnected epoll file descriptors to set up mutual watching.
CVE-2026-46242.c:60-70 - Spawns a racer thread that repeatedly closes and recreates epoll file descriptors to trigger a race condition.
CVE-2026-46242.c:34-45 - The main thread closes and recreates specific epoll file descriptors in a loop to trigger the use-after-free.
CVE-2026-46242.c:80-88 - After the race, attempts to check for root privileges and spawn a root shell if successful.
CVE-2026-46242.c:101-108
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe C code creates epoll instances, sets up mutual watching, and uses a racer thread to close and recreate epoll file descriptors while the main thread also closes and recreates them, aiming to trigger the UAF described in CVE-2026-46242.
CVE-2026-46242.c:34-45CVE-2026-46242.c:80-88 - Privilege Escalation Attempt
- Payload withheldAfter the race, the code checks if getuid() == 0 and executes /bin/sh, which is the standard goal of a local privilege escalation exploit.
CVE-2026-46242.c:102-105 - Disclaimer
- Payload withheldThe README claims the repository is for educational and defensive purposes and does not contain exploit code, which contradicts the presence of CVE-2026-46242.c. This is a factual inaccuracy but does not constitute backdoor behavior.
README.md:198-200
What the analysis did not establish
- The README.md states 'It does not contain exploit code or offensive tooling' (line 200), which contradicts the presence of CVE-2026-46242.c, a full exploit.
- The exploit's effectiveness is not verified; the code includes a failure message indicating the race may be missed or the kernel patched (line 106).
- The exploit relies on a race condition and may not succeed reliably.
- Only the two text files (CVE-2026-46242.c and README.md) were reviewed; no binary files were present or analyzed.
- The review is based solely on static source code analysis; runtime behavior or potential compiler-introduced effects are not evaluated.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-8451
Repository PoCStars: 1Created 2026-07-03ExploitCVE-2026-84512 files
Analysis
Technical assessment
Ruby script that sends crafted SAML requests to a NetScaler endpoint to trigger a memory overread and extract leaked process memory from the response cookie.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward Ruby script that sends crafted SAML requests to a target NetScaler endpoint and attempts to parse leaked memory from the response. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is present. The script only interacts with the user-supplied target and prints results locally.
Classification basis and observed behavior
Classification basis
The Ruby script actively sends malicious payloads to a live target to trigger a memory overread and exfiltrate leaked memory, which constitutes exploitation rather than mere detection or scanning.
CVE-2026-8451.rb:39-93CVE-2026-8451.rb:1-3Requirements
- Target must be a NetScaler ADC or Gateway configured as a SAML Identity Provider (IdP).
README.md:93 - Target must have the vulnerable /saml/login endpoint accessible over HTTPS.
CVE-2026-8451.rb:49
Observed behavior
- Sends multiple POST requests to /saml/login with a Base64-encoded SAML AuthnRequest containing increasing amounts of padding.
CVE-2026-8451.rb:26-28CVE-2026-8451.rb:44-51 - Extracts the NSC_TASS cookie from the HTTP response, Base64-decodes it, and searches for known SAML markers to locate leaked memory.
CVE-2026-8451.rb:56-64 - Prints a hexdump and ASCII preview of the leaked memory bytes when a leak exceeding 30 bytes is found.
CVE-2026-8451.rb:74-79
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe script sends a SAMLRequest parameter to the target to trigger the memory overread vulnerability. This is the expected behavior for a PoC exploiting CVE-2026-8451.
CVE-2026-8451.rb:49-53 - Data Extraction
- Payload withheldThe script extracts a specific cookie set by the target, decodes it, and searches for known markers to identify leaked memory. This is consistent with exploiting a memory disclosure vulnerability.
CVE-2026-8451.rb:56-72 - Local Output
- Payload withheldThe script displays the leaked memory content locally for the operator. No exfiltration to an external server occurs.
CVE-2026-8451.rb:74-79
What the analysis did not establish
- Evidence is limited to the supplied source code and README; no runtime output or network capture is provided to confirm successful exploitation.
- The script disables SSL certificate verification (VERIFY_NONE), which may mask connection issues but does not affect classification.
- No binary or non-text files were present in the artifact.
- The review is limited to the static source code; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-46817
Repository PoCStars: 1Created 2026-06-29ScannerCVE-2026-468172 files
Analysis
Technical assessment
The artifact is a Python script that probes a target URL for known Oracle Payments endpoints and reports whether the target is likely vulnerable to CVE-2026-46817. It does not contain any exploit payload or code to exercise the vulnerability; it only performs HTTP GET requests and checks response status codes and body content for indicators of the affected software.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python script and a README for a CVE-2026-46817 vulnerability checker. The script performs only non-invasive HTTP GET requests to probe for Oracle Payments endpoints and reports findings. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The Python script only performs HTTP GET requests to check for the presence of Oracle Payments endpoints and inspects response metadata to infer vulnerability. It does not send any payload, attempt to trigger the vulnerability, or execute any action beyond detection. The script's own docstring and output messages confirm it is a 'Safe Checker' that performs no exploitation.
CVE-2026-46817.py:3CVE-2026-46817.py:5CVE-2026-46817.py:74Requirements
- Network access to the target Oracle E-Business Suite instance via HTTP.
CVE-2026-46817.py:40
Observed behavior
- Sends HTTP GET requests to a list of hardcoded Oracle Payments endpoints on the target.
CVE-2026-46817.py:23-40 - Checks if the HTTP response status code is 200, 302, or 403 and prints a warning if so.
CVE-2026-46817.py:44-46 - Checks the response body for strings indicating Oracle E-Business Suite 12.2.x.
CVE-2026-46817.py:49-50 - Prints a risk assessment message if any endpoint is found, stating the target is likely vulnerable.
CVE-2026-46817.py:67-70 - Explicitly states that no exploitation is performed.
CVE-2026-46817.py:74
Behaviors behind the backdoor verdict
Observables
- Network Behavior
- Payload withheldThe script probes for Oracle Payments endpoints to assess exposure to CVE-2026-46817. This is expected behavior for a vulnerability checker.
CVE-2026-46817.py:23-30CVE-2026-46817.py:40 - Author Identity
- Payload withheldAuthor attribution in script and README. No evidence this identity is used for deception.
CVE-2026-46817.py:4README.md:1
What the analysis did not establish
- The evidence does not include any exploit code or demonstration of the vulnerability being triggered; only a scanner is present.
- The README.md file contains only documentation and screenshots, not executable code.
- Only the two text files (CVE-2026-46817.py and README.md) were reviewed. No binary files were present in the evidence.
- The review does not verify the correctness or safety of the vulnerability check against a live target.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-12485
Repository PoCStars: 1Created 2026-06-28ScannerCVE-2026-124852 files
Analysis
Technical assessment
The artifact is a Python script and README that check for the presence of the vulnerable DVRSearch service on UDP port 10001 by sending benign probes and observing responses, without triggering the buffer overflow.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python script (CVE-2026-12485.py) and a README.md. The script sends benign UDP probes to port 10001 to detect the DVRSearch service and performs a safe length test with small payloads. It does not contain any backdoor, deceptive payload, or concealed harmful behavior. The README provides documentation and expected output. No obfuscation, persistence, credential theft, or unrelated remote access is present.
Classification basis and observed behavior
Classification basis
The Python script explicitly states it is a 'Safe Vulnerability Checker' that 'does NOT exploit the vulnerability' and only sends benign probes to detect the service. It does not contain code to trigger the stack overflow or execute arbitrary code, making it a scanner.
CVE-2026-12485.py:3-8CVE-2026-12485.py:91README.md:198Requirements
- Network access to target device on UDP port 10001
CVE-2026-12485.py:21-25
Observed behavior
- Sends a safe UDP probe with a short IP address and padding to port 10001
CVE-2026-12485.py:27-34 - Receives and displays a response if the service is active
CVE-2026-12485.py:36-40 - Optionally performs a safe length test by sending incrementally larger but non-crashing payloads
CVE-2026-12485.py:51-78 - Prints recommendations to update firmware and restrict access if service responds
CVE-2026-12485.py:98-103
Behaviors behind the backdoor verdict
Observables
- Network Behavior
- Payload withheldThe script sends safe, non-exploitative UDP packets to detect the vulnerable service. This is consistent with the stated purpose of a vulnerability checker.
CVE-2026-12485.py:29-34CVE-2026-12485.py:61-66
What the analysis did not establish
- Evidence is limited to the supplied text files; no binary or network captures are included.
- The script's actual behavior on a live target is not observed; classification is based solely on static code analysis.
- Only the two text files (CVE-2026-12485.py and README.md) were reviewed; no other files exist in the repository snapshot.
- The analysis does not execute the code, so runtime behavior is not verified, but static analysis shows no malicious intent.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-8932
Repository PoCStars: 1Created 2026-06-26ScannerCVE-2026-89322 files
Analysis
Technical assessment
The artifact is a C program that checks whether the installed libcurl is vulnerable to CVE-2026-8932 by performing a version string match and a dynamic connection-reuse test. It does not exploit the vulnerability to gain unauthorized access or perform malicious actions; it only reports whether the library is vulnerable or safe.
Backdoor review
No backdoor observed in reviewed code
The repository contains a CVE-2026-8932 proof-of-concept checker and a README. The C code performs a version check and a dynamic test using libcurl to demonstrate connection reuse with mismatched mTLS key passwords. No backdoor, concealed executable behavior, or operator-directed harm is present. The code is straightforward CVE validation logic with no hidden payloads or deceptive actions.
Classification basis and observed behavior
Classification basis
The C code performs a version check and a dynamic test that only determines whether the library is vulnerable. It does not contain any payload to exploit the vulnerability, exfiltrate data, or gain unauthorized access. The README describes the vulnerability but the primary artifact is the C program, which is a detection tool (scanner).
CVE-2026-8932.c:2CVE-2026-8932.c:74-78Requirements
- libcurl development headers and library must be installed to compile and run the checker.
CVE-2026-8932.c:10 - A local TLS server must be running at https://server.test:8443/ with client certificate authentication enabled, and the files clientA.crt and clientA.key must be present.
CVE-2026-8932.c:17-20
Observed behavior
- Prints the detected libcurl version and checks if it matches known vulnerable versions (8.20.0, 8.19.x, 8.18.x). If a match is found, it prints 'VULNERABLE (Version match)' and exits.
CVE-2026-8932.c:27-38 - If no version match, it creates two libcurl easy handles (A and B) sharing a connection pool. Handle A is configured with a correct key password ('aaa'), and handle B with a wrong password ('wrong-password'). It performs a request with A first, then with B. If both requests succeed (CURLE_OK), it prints 'VULNERABLE'; otherwise, it prints 'SAFE'.
CVE-2026-8932.c:40-78
Behaviors behind the backdoor verdict
Observables
- Cve Validation Logic
- Payload withheldThe C code checks for specific libcurl versions and performs a dynamic test to demonstrate the vulnerability. This is consistent with a legitimate PoC.
CVE-2026-8932.c:33-38CVE-2026-8932.c:40-78 - Author Attribution
- Payload withheldAuthor name and handle present in source code and README. This is standard attribution and not indicative of backdoor behavior.
CVE-2026-8932.c:3CVE-2026-8932.c:29
What the analysis did not establish
- The dynamic test requires a specific local server setup and client certificate files, which are not provided in the artifact.
- The version check only covers a subset of vulnerable versions (8.20.0, 8.19.x, 8.18.x) and may miss other affected versions listed in the CVE record.
- The README contains images and references to external resources that could not be inspected.
- Only the two text files (CVE-2026-8932.c and README.md) were reviewed. No binary files were present in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-46331
Repository PoCStars: 29Created 2026-06-26ExploitCVE-2026-463312 files
Analysis
Technical assessment
The artifact is a local privilege escalation exploit for CVE-2026-46331. It uses a calibration step to determine the offset delta for a pedit-based write primitive, then corrupts the page cache of a setuid-root 'su' binary by overwriting its entry point with shellcode. Executing the corrupted 'su' binary yields a root shell.
Backdoor review
No backdoor observed in reviewed code
The PoC source code (CVE-2026-46331.c) implements a local privilege escalation exploit for the described CVE using netlink-based traffic control (tc) pedit actions to corrupt the page cache and overwrite a setuid-root su binary entry point with shellcode. The README.md is a documentation file describing the vulnerability. No backdoor, trojan, or deceptive payload targeting the person running the PoC was observed. The code performs only the advertised exploit behavior: it sets up a netlink socket, configures a clsact qdisc with a pedit action, sends data to trigger the partial COW bug, calibrates the write offset, and then uses the corruption primitive to overwrite /bin/su (or similar) with shellcode to gain a root shell. All operations are local and consistent with the stated CVE exploitation goal.
Classification basis and observed behavior
Classification basis
The C code implements a full local privilege escalation chain: it calibrates a write primitive, corrupts a setuid binary's executable code in the page cache, and then executes the corrupted binary to gain root. This is active exploitation, not mere detection or scanning.
CVE-2026-46331.c:1-9CVE-2026-46331.c:501-511CVE-2026-46331.c:636-639Requirements
- Local unprivileged code execution
CVE-2026-46331.c:645-648 - Ability to create user and network namespaces (unshare)
CVE-2026-46331.c:559 - CAP_NET_ADMIN in the new namespace to configure tc pedit rules
CVE-2026-46331.c:559 - A setuid-root 'su' binary present on the system
CVE-2026-46331.c:513-524
Observed behavior
- Creates a new user and network namespace via unshare
CVE-2026-46331.c:559 - Configures uid/gid mappings for the new namespace
CVE-2026-46331.c:563-567 - Calibrates the pedit write offset by sending a marked packet through a loopback tc pedit rule and reading back the file to find the mark
CVE-2026-46331.c:395-441 - Opens a setuid-root 'su' binary and locates its executable entry point offset
CVE-2026-46331.c:526-543 - Uses the pedit primitive to overwrite the 'su' entry point with shellcode that executes /bin/sh
CVE-2026-46331.c:474-499CVE-2026-46331.c:553-580 - Executes the corrupted 'su' binary to spawn a root shell
CVE-2026-46331.c:636-639
Behaviors behind the backdoor verdict
Observables
- Shellcode
- Payload withheldx86-64 shellcode that calls setuid(0) and then execve('/bin/sh', NULL, NULL). This is the payload written over the su entry point to gain a root shell, consistent with the stated LPE goal.
CVE-2026-46331.c:505-511 - Target Binary
- Payload withheldThe exploit searches for a setuid-root su binary and overwrites its entry point with shellcode. This is the standard LPE technique for this class of kernel memory corruption.
CVE-2026-46331.c:513-524 - Exploit Primitive
- Payload withheldThe core exploit mechanism uses netlink to install a tc filter with a pedit action that writes controlled data at a calibrated offset, corrupting the page cache backing the su binary.
CVE-2026-46331.c:311-338CVE-2026-46331.c:395-441CVE-2026-46331.c:474-499
What the analysis did not establish
- Evidence is limited to the two text files in the repository snapshot; no binary artifacts, build scripts, or runtime logs are included.
- The exploit's reliability depends on kernel version, system configuration, and the presence of a setuid-root su binary, which cannot be verified from the provided evidence alone.
- Only the two text files (CVE-2026-46331.c and README.md) were reviewed; no binary files were present or analyzed.
- The review is static and based solely on the provided source code; no runtime behavior was observed.
- The code includes a shellcode payload that is executed in the context of the exploited su binary; this is part of the advertised exploit and not a hidden backdoor.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-8461
Repository PoCStars: 5Created 2026-06-26ExploitCVE-2026-84612 files
Analysis
Technical assessment
A Python script that generates a malicious AVI file containing a crafted MagicYUV frame designed to trigger an out-of-bounds write (CVE-2026-8461) in FFmpeg's libavcodec, overwriting an AVBuffer's free function pointer with payload withheld to achieve remote code execution.
Backdoor review
No backdoor observed in reviewed code
The PoC is a Python script that generates a malicious AVI file to exploit CVE-2026-8461, an out-of-bounds write in FFmpeg's MagicYUV decoder. The script builds a crafted video frame with a payload designed to overwrite heap metadata and redirect execution to payload withheld with a user-supplied command. All behavior is consistent with the disclosed exploit: the operator provides the command and target addresses, and the script produces an AVI file. No concealed, unrelated, or deceptive actions were found.
Classification basis and observed behavior
Classification basis
The Python script is explicitly designed to generate a malicious media file that exploits CVE-2026-8461 to achieve remote code execution by corrupting heap metadata and hijacking a function pointer. It does not merely detect or report the vulnerability; it constructs and outputs an exploit payload.
CVE-2026-8461.py:3CVE-2026-8461.py:60-78CVE-2026-8461.py:150-153Requirements
- Target must be running a vulnerable version of FFmpeg (before 8.1.2) with the MagicYUV decoder.
README.md:26-28 - Attacker must know or calibrate target-specific memory addresses (payload withheld and command heap address).
CVE-2026-8461.py:40-44 - Victim must process the generated AVI file with FFmpeg (e.g., ffmpeg -i exploit.avi -f null -).
CVE-2026-8461.py:152-153
Observed behavior
- Constructs a MagicYUV frame with an odd slice_height (31) to trigger an out-of-bounds write.
CVE-2026-8461.py:18 - Builds an out-of-bounds payload that overwrites an AVBuffer structure: sets refcount to 1, replaces the free function pointer with payload withheld, and sets the opaque pointer to a heap address containing the attacker's command.
CVE-2026-8461.py:60-78 - Wraps the exploit frame in a minimal AVI container and writes it to a file.
CVE-2026-8461.py:111-129 - Accepts a shell command and calibration data (system address, command heap address) as command-line arguments.
CVE-2026-8461.py:135-138
Behaviors behind the backdoor verdict
Observables
- Command Execution
- Payload withheldThe payload overwrites an AVBuffer free function pointer with the address of payload withheld and sets the opaque pointer to a heap address containing the user-supplied command. This is the disclosed RCE mechanism.
CVE-2026-8461.py:75-76 - User Supplied Input
- Payload withheldThe operator must supply the command to execute via the payload withheld argument. The script does not embed or hardcode any command.
CVE-2026-8461.py:135 - Target Addresses
- Payload withheldThe operator must supply target-specific addresses (payload withheld and command heap location) either via a calibration JSON file or command-line arguments. Default example addresses are provided but are clearly marked as examples.
CVE-2026-8461.py:40-41CVE-2026-8461.py:137-138
What the analysis did not establish
- The AVI container construction is incomplete (line 122 notes 'more AVI headers omitted for brevity'), so the generated file may not be a fully valid AVI.
- The exploit requires target-specific memory addresses (payload withheld and command heap) that are not provided; default values are placeholders and unlikely to work without calibration.
- The evidence does not include any demonstration or verification that the generated file successfully triggers the vulnerability or achieves code execution.
- The AVI container creation function (create_avi) contains a comment indicating that some AVI headers are omitted for brevity (line 122). The generated AVI file may be incomplete or non-functional, but this does not introduce backdoor behavior.
- The review is limited to the supplied text files; no binary files were present.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-43503
Repository PoCStars: 31Created 2026-06-25ExploitCVE-2026-435032 files
Analysis
Technical assessment
A C exploit for CVE-2026-43503 (DirtyClone) that achieves local privilege escalation by corrupting the page cache of payload withheld. It uses user and network namespaces, XFRM SAs, and UDP-encapsulated ESP to trigger the vulnerability and write a shellcode ELF payload into the target file, then executes the modified su to spawn a root shell.
Backdoor review
No backdoor observed in reviewed code
The PoC exploits CVE-2026-43503 to patch payload withheld page-cache with a shell-spawning ELF payload for local privilege escalation. No backdoor, concealed operator-directed harm, or unrelated payload was observed. The code performs only the advertised exploit behavior.
Classification basis and observed behavior
Classification basis
The C source code implements a full privilege escalation chain: it sets up namespaces, installs crafted XFRM SAs, triggers the vulnerability via network operations to corrupt the page cache of payload withheld with a shellcode payload, verifies the corruption, and executes the patched binary to gain root. This is active exploitation, not mere detection or scanning.
CVE-2026-43503.c:319-336CVE-2026-43503.c:258-287Requirements
- Local unprivileged user access
CVE-2026-43503.c:324-327 - User namespaces enabled (unshare CLONE_NEWUSER)
CVE-2026-43503.c:74 - Network namespaces enabled (unshare CLONE_NEWNET)
CVE-2026-43503.c:74 - Vulnerable Linux kernel version (3.9 through unpatched)
README.md:151-162 - Target file payload withheld must exist and be readable
CVE-2026-43503.c:37
Observed behavior
- Creates user and network namespaces and configures loopback interface
CVE-2026-43503.c:70-96 - Installs 48 XFRM SAs with crafted seq_hi values encoding a shellcode ELF payload
CVE-2026-43503.c:263-274 - Sends UDP-encapsulated ESP packets using vmsplice/splice to trigger the vulnerability and corrupt the page cache of payload withheld
CVE-2026-43503.c:196-246 - Verifies the first two bytes of the patched file at offset 0x78 match the shellcode
CVE-2026-43503.c:310-314 - Executes the modified payload withheld to spawn a root shell
CVE-2026-43503.c:330-333
Behaviors behind the backdoor verdict
Observables
- Exploit Target
- Payload withheldThe exploit writes a shell-spawning ELF payload into the page cache of payload withheld to achieve local privilege escalation.
CVE-2026-43503.c:37CVE-2026-43503.c:280 - Payload
- Payload withheldA 192-byte ELF payload that executes /bin/sh via execve is embedded in the exploit and written to the target binary's page cache.
CVE-2026-43503.c:42-55 - Exploit Technique
- Payload withheldThe exploit encodes each 4-byte chunk of the shell_elf payload into the seq_hi field of XFRM replay state ESN SAs, then triggers writes via ESP input.
CVE-2026-43503.c:263-269CVE-2026-43503.c:170-180
What the analysis did not establish
- Evidence is limited to the supplied source code and README; no runtime logs, build artifacts, or target environment details are provided.
- The exploit's reliability and exact kernel version dependencies cannot be verified from static analysis alone.
- Only the two text files (CVE-2026-43503.c and README.md) were reviewed; no binary files were present or analyzed.
- The review does not assess whether the exploit works as claimed or is safe to execute.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-7574
Repository PoCStars: 1Created 2026-06-25ExploitCVE-2026-75742 files
Analysis
Technical assessment
A bash script that modifies the rootfs.img of Anthropic Claude Desktop Cowork VM by extracting, mounting, injecting a canary file, and reinserting the partition, demonstrating persistent code execution inside the VM.
Backdoor review
No backdoor observed in reviewed code
The PoC script (CVE-2026-7574.sh) and README.md demonstrate a local VM image tampering vulnerability. The script performs a harmless canary injection (writing a text file and a cron comment) to prove the integrity bypass. No concealed executable behavior, credential theft, remote access, persistence mechanism beyond the described PoC, or unrelated payload is present. The script's actions are transparent and align with the stated educational purpose.
Classification basis and observed behavior
Classification basis
The script actively modifies the target VM image to inject persistent content, which constitutes exploitation rather than mere detection or scanning. It performs extraction, mounting, file injection, and reinsertion of the modified partition, directly exercising the vulnerability.
CVE-2026-7574.sh:36-64Requirements
- Local unprivileged code execution as the victim macOS user
CVE-2026-7574.sh:1 - Cowork VM must have been run at least once to download the rootfs.img
CVE-2026-7574.sh:18-21 - Linux environment with ext4 support or macOS with macFUSE and ext4 tools for mounting
CVE-2026-7574.sh:58
Observed behavior
- Locates the rootfs.img at ~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
CVE-2026-7574.sh:13 - Extracts the ext4 partition using dd with hardcoded offsets
CVE-2026-7574.sh:36 - Mounts the extracted partition and writes a canary file payload withheld and a cron marker
CVE-2026-7574.sh:45-49 - Reinserts the modified partition back into the original rootfs.img using dd
CVE-2026-7574.sh:64 - Instructs the user to verify persistence by launching the VM and checking the canary file
CVE-2026-7574.sh:68-73
Behaviors behind the backdoor verdict
Observables
- File Write
- Payload withheldHarmless canary file written to the mounted VM image to demonstrate successful tampering.
CVE-2026-7574.sh:45 - File Write
- Payload withheldHarmless comment appended to a cron file as a persistent marker.
CVE-2026-7574.sh:49 - Commented Code
- Payload withheldCommented-out example of a more advanced payload; not executed.
CVE-2026-7574.sh:52
What the analysis did not establish
- Hardcoded dd offsets may not match all versions; script warns to verify with gdisk/parted.
- Requires sudo for mount, which may not be available in all environments.
- Only a harmless canary is injected; more advanced payloads are commented out.
- Review is limited to the supplied text files; no binary files were present or analyzed.
- The script requires sudo and modifies system files, which could be harmful if misused, but the script itself contains no backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-48908
Repository PoCStars: 2Created 2026-06-24ExploitCVE-2026-489082 files
Analysis
Technical assessment
A Python script that exploits CVE-2026-48908, an unauthenticated arbitrary file upload vulnerability in SP Page Builder for Joomla, to upload a PHP webshell and achieve remote code execution.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward exploit for CVE-2026-48908. It uploads a PHP webshell via the vulnerable endpoint and executes commands. No concealed backdoor, unrelated payload, or deceptive behavior targeting the PoC operator was observed.
Classification basis and observed behavior
Classification basis
The script actively uploads a PHP webshell and executes commands on the target, which constitutes exploitation, not just detection or scanning.
CVE-2026-48908.py:61-98CVE-2026-48908.py:119-125CVE-2026-48908.py:187-198Requirements
- Target running a vulnerable version of SP Page Builder (<= 6.6.1) with the com_sppagebuilder component accessible.
CVE-2026-48908.py:5CVE-2026-48908.py:12
Observed behavior
- Constructs a malicious ZIP archive containing a PHP webshell and supporting IcoMoon files.
CVE-2026-48908.py:61-98 - Sends an unauthenticated POST request to the vulnerable upload endpoint to upload the malicious ZIP.
CVE-2026-48908.py:101-116 - Executes arbitrary system commands on the target server by sending GET requests to the uploaded webshell.
CVE-2026-48908.py:119-125 - Provides an interactive shell mode for continuous command execution.
CVE-2026-48908.py:187-198
Behaviors behind the backdoor verdict
Observables
- Webshell Upload
- Payload withheldThe PoC uploads a PHP file that executes system commands when provided with a correct token. This is the intended exploit behavior for the stated CVE.
CVE-2026-48908.py:61-98 - Command Execution
- Payload withheldThe uploaded webshell executes arbitrary system commands passed via HTTP GET parameters. This is the core RCE functionality of the exploit.
CVE-2026-48908.py:68-72 - Token Verification
- Payload withheldThe webshell requires a secret token to execute commands, preventing unauthorized use of the uploaded shell by third parties.
CVE-2026-48908.py:64-67
What the analysis did not establish
- Only the two text files (CVE-2026-48908.py and README.md) were reviewed; no binary files were present or analyzed.
- The review does not assess the safety of executing the PoC against unauthorized targets, only whether the PoC itself contains backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xBlackash/CVE-2026-55200
Repository PoCStars: 10Created 2026-06-23ExploitCVE-2026-552002 files
Analysis
Technical assessment
A C server that performs a partial SSH handshake and sends a crafted packet with an oversized packet_length field (0xFFFFFFFF) to trigger an out-of-bounds write in vulnerable libssh2 clients.
Backdoor review
No backdoor observed in reviewed code
The PoC code in CVE-2026-55200.c implements a malicious SSH server that sends a crafted packet with an oversized packet_length field to trigger the described CVE-2026-55200 vulnerability in a vulnerable libssh2 client. The code performs a standard SSH handshake (banner exchange, KEXINIT) and then sends the malicious packet. No backdoor, deceptive payload, or concealed operator-directed harm (such as credential theft, persistence, or unrelated remote access) is present. The README.md is a documentation file describing the vulnerability and does not contain executable instructions or hidden payloads.
Classification basis and observed behavior
Classification basis
The C code actively constructs and sends a malicious network packet designed to exploit a specific vulnerability (CVE-2026-55200) in a target client. It performs a handshake and then delivers the payload, which is the definition of an exploit.
CVE-2026-55200.c:2-3CVE-2026-55200.c:50-59CVE-2026-55200.c:62Requirements
- A client using a vulnerable version of libssh2 (<= 1.11.1) must connect to the attacker's server.
CVE-2026-55200.c:62
Observed behavior
- Listens on a TCP port and accepts client connections.
CVE-2026-55200.c:77-97 - Sends an SSH banner and a fake SSH_MSG_KEXINIT to initiate a handshake.
CVE-2026-55200.c:29-41 - Constructs and sends a malicious SSH packet with a packet_length of 0xFFFFFFFF and a payload of 700 'A' bytes.
CVE-2026-55200.c:50-59 - The malicious packet is intended to trigger an out-of-bounds write in the client's libssh2 ssh2_transport_read() function.
CVE-2026-55200.c:2-3CVE-2026-55200.c:62
Behaviors behind the backdoor verdict
Observables
- Malicious Ssh Server
- Payload withheldThis is the expected behavior of a PoC for CVE-2026-55200, which exploits an integer overflow to buffer overflow in libssh2's ssh2_transport_read(). The server does not establish a backdoor or perform any action beyond triggering the vulnerability.
CVE-2026-55200.c:18CVE-2026-55200.c:49-59
What the analysis did not establish
- The evidence does not include the vulnerable libssh2 library source code or a vulnerable client binary, so the exploit's effectiveness cannot be verified from the provided files alone.
- The README.md file contains images and references to external resources that are not included in the evidence.
- Review is limited to the two text files provided (CVE-2026-55200.c and README.md). No other files exist in the repository snapshot. No binary analysis was performed, but none was required as the artifact contains only readable source code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.