keraattin
Source-scoped identity with 9 associated PoCs and 9 linked vulnerabilities.
Exploit catalog results
Showing 9 PoCs on this page
GitHubkeraattin/CVE-2026-33032
Repository PoCStars: 0Created 2026-04-18ScannerCVE-2026-330323 files
Analysis
Technical assessment
A non-destructive detection tool for CVE-2026-33032 (MCPwn) that identifies vulnerable nginx-ui instances by fingerprinting the target, obtaining an unauthenticated session ID from the /mcp SSE endpoint, and sending a read-only 'tools/list' JSON-RPC request to /mcp_message to confirm the missing authentication middleware.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python detection script for CVE-2026-33032. The script performs only read-only fingerprinting and a benign tools/list JSON-RPC call to detect the vulnerability. No destructive actions, persistence mechanisms, credential exfiltration, or unrelated payloads are present. The code explicitly refuses to invoke any destructive MCP tools.
Classification basis and observed behavior
Classification basis
The artifact's primary purpose is detection, not exploitation. The README explicitly states it is a 'Non-destructive detection tooling' (line 10) and the Python script's docstring describes it as a 'Non-destructive detector' (line 6). The code only sends a read-only 'tools/list' JSON-RPC method (line 258-262) and the README confirms it 'refuses to POST any other method and never constructs payloads for destructive tools' (lines 130-133). This is consistent with a scanner that checks for vulnerability without exercising it.
README.md:10-12detect_nginx_ui_mcpwn.py:2-7detect_nginx_ui_mcpwn.py:258-262README.md:130-133Requirements
- Network access to the target nginx-ui instance
detect_nginx_ui_mcpwn.py:302-321
Observed behavior
- Fingerprints the target as nginx-ui by checking /api/settings, index HTML, and /api/system/info for identifying strings
detect_nginx_ui_mcpwn.py:126-160 - Opens an unauthenticated SSE connection to /mcp and extracts a sessionID from the stream
detect_nginx_ui_mcpwn.py:179-241 - Sends a benign, read-only 'tools/list' JSON-RPC request to /mcp_message without any Authorization header to confirm the vulnerability
detect_nginx_ui_mcpwn.py:265-299 - Reports the target as VULNERABLE if the /mcp_message endpoint returns 200 and a tool manifest, PATCHED if it returns 401/403, or INCONCLUSIVE otherwise
detect_nginx_ui_mcpwn.py:99-108detect_nginx_ui_mcpwn.py:360-375
Behaviors behind the backdoor verdict
Observables
- Detection Logic
- Payload withheldConfirms the artifact is a non-destructive vulnerability detector.
detect_nginx_ui_mcpwn.py:20-21detect_nginx_ui_mcpwn.py:258-262 - Benign Payload
- Payload withheldThe only JSON-RPC method sent is tools/list, which is read-only and has no side effects.
detect_nginx_ui_mcpwn.py:258-262
What the analysis did not establish
- One file (nginx-ui-mcpwn.nse) is omitted from the evidence; its content is not provided, so the Nmap NSE component cannot be analyzed.
- The evidence does not include the complete artifact coverage; the packet reports 'complete_artifact_coverage: false' and one unclassified file of 6338 bytes is present but not analyzed.
- One file (nginx-ui-mcpwn.nse) was classified as unclassified/binary and not provided as text; its content was not reviewed. The README describes it as an Nmap NSE script for the same detection purpose.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkeraattin/CVE-2026-39842
Repository PoCStars: 0Created 2026-04-17ExploitCVE-2026-398424 files
Analysis
Technical assessment
The artifact contains a Python script (exploit_openremote.py) that exploits CVE-2026-39842, an expression injection vulnerability in OpenRemote's Rules Engine. The script authenticates to a target, crafts a JavaScript payload that uses Java.type() to access java.lang.Runtime for arbitrary command execution, and delivers it via the vulnerable API endpoint to achieve remote code execution.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README.md documentation file and an exploit_openremote.py proof-of-concept script for CVE-2026-39842. The Python script implements a standard exploit chain: authenticate to a target OpenRemote instance, craft a JavaScript payload that leverages the unsandboxed Nashorn engine to execute arbitrary OS commands, deliver the payload via the vulnerable rules API, and optionally clean up. All behavior is consistent with a legitimate security research PoC targeting the described vulnerability. No concealed executable behavior, unrelated payload delivery, credential exfiltration to an attacker-controlled destination, persistence installation, or other backdoor functionality was observed.
Classification basis and observed behavior
Classification basis
The Python script 'exploit_openremote.py' is explicitly designed to exploit CVE-2026-39842. It performs the full attack chain: authentication, payload generation using Java.type() to access java.lang.Runtime for command execution, delivery to the vulnerable endpoint, and post-exploitation cleanup. The script's own description states it is a 'Proof of Concept for expression injection' and 'Exploits unsandboxed Nashorn ScriptEngine.eval() to achieve RCE as root'.
exploit_openremote.py:3-7exploit_openremote.py:154-221exploit_openremote.py:245-291Requirements
- Requires valid credentials for a user with the 'write:rules' role on the target OpenRemote instance.
exploit_openremote.py:19exploit_openremote.py:99-136 - Target must be running a vulnerable version of OpenRemote (<= 1.21.0).
exploit_openremote.py:15exploit_openremote.py:139-151
Observed behavior
- Authenticates to the target OpenRemote instance using Keycloak with a supplied username and password.
exploit_openremote.py:99-136 - Checks the OpenRemote version via the /api/master/info endpoint.
exploit_openremote.py:139-151 - Constructs a JavaScript payload that uses Java.type('java.lang.Runtime') to execute arbitrary OS commands via Nashorn's ScriptEngine.eval().
exploit_openremote.py:154-242 - Sends the malicious JavaScript ruleset to the vulnerable POST /api/{realm}/rules/realm endpoint.
exploit_openremote.py:245-291 - Optionally cleans up by deleting the created ruleset after exploitation.
exploit_openremote.py:294-305
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the expected behavior of a PoC for CVE-2026-39842. The script only interacts with the target specified by the operator and does not perform any unrelated actions.
exploit_openremote.py:322-380 - Payload Construction
- Payload withheldThis directly matches the vulnerability description (unsandboxed Nashorn ScriptEngine.eval()). The payload is delivered to the operator-specified target and does not contain any hidden secondary actions.
exploit_openremote.py:154-242 - Cleanup Functionality
- Payload withheldThis is a common feature in responsible PoCs to avoid leaving artifacts on the target system. It does not indicate malicious intent.
exploit_openremote.py:294-305
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository were included. Two text files (README.md and exploit_openremote.py) are provided, but two additional files are omitted.
- The analysis is based solely on static review of the provided source code; the code was not executed, and its operational behavior is inferred from its logic and comments.
- Two additional files in the repository (detect_openremote.py and openremote-detect.nse) were listed in metadata but their content was not included in the evidence packet. Their behavior was not reviewed.
- The review is limited to static analysis of the provided source code; no dynamic execution or network traffic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkeraattin/CVE-2026-22679
Repository PoCStars: 0Created 2026-04-16ScannerCVE-2026-226794 files
Analysis
Technical assessment
The artifact is a detection scanner for CVE-2026-22679. It checks if a target is a Weaver E-cology instance and whether the vulnerable dubboApi debug endpoint is accessible via safe GET/POST requests without sending exploit parameters. It does not execute commands or exploit the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a vulnerability detection script and documentation for CVE-2026-22679. The Python script performs safe, non-destructive checks by sending GET and empty POST requests to a specific endpoint to determine if it is accessible. No commands are executed on the target, and no backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed evidence.
Classification basis and observed behavior
Classification basis
The Python script explicitly states it is a 'Detection Script' and performs 'SAFE check' by sending GET requests and empty POST requests to the endpoint without sending interfaceName or methodName parameters. It does not execute any commands on the target. The README also describes it as a 'Safe, non-destructive detection script'. This is scanner behavior, not exploit behavior.
CVE-2026-22679_Weaver_Ecology_RCE_detector.py:3-7CVE-2026-22679_Weaver_Ecology_RCE_detector.py:130-133README.md:298Requirements
- Target must be a Weaver E-cology instance or have the specific dubboApi debug endpoint exposed.
CVE-2026-22679_Weaver_Ecology_RCE_detector.py:228-236
Observed behavior
- Sends HTTP GET and POST requests to the /papi/esearch/data/devops/dubboApi/debug/method endpoint to check if it is accessible. The POST request sends an empty JSON body, not exploit parameters.
CVE-2026-22679_Weaver_Ecology_RCE_detector.py:125-225 - Checks for Weaver E-cology identity by requesting common login pages and looking for indicators in response bodies, headers, and cookies.
CVE-2026-22679_Weaver_Ecology_RCE_detector.py:42-122 - Reports vulnerability status based solely on endpoint accessibility, not on successful command execution.
CVE-2026-22679_Weaver_Ecology_RCE_detector.py:292-304
Behaviors behind the backdoor verdict
Observables
- Vulnerability Scanner
- Payload withheldThe script sends HTTP GET and empty POST requests to /papi/esearch/data/devops/dubboApi/debug/method to check endpoint accessibility. It explicitly states it does not send interfaceName or methodName parameters and does not execute commands.
CVE-2026-22679_Weaver_Ecology_RCE_detector.py:130-133CVE-2026-22679_Weaver_Ecology_RCE_detector.py:149-154CVE-2026-22679_Weaver_Ecology_RCE_detector.py:191-198 - Documentation
- Payload withheldThe README provides vulnerability details, detection methods, and remediation guidance. It includes a second scanner implementation that also performs only safe endpoint checks.
README.md:294-298README.md:343-373
What the analysis did not establish
- One file (Nmap NSE script) is referenced in the README but not included in the selected text files; its content is only available as an embedded code block in the README.
- The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository are included.
- One file (metadata only) was omitted from text review; its content is unknown.
- Binary files were not present in the evidence.
- The review is limited to the supplied text content and does not verify the behavior of the script at runtime.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkeraattin/CVE-2026-35031
Repository PoCStars: 0Created 2026-04-15ScannerCVE-2026-350314 files
Analysis
Technical assessment
The artifact is a Python-based detection script and accompanying documentation for CVE-2026-35031. The script identifies Jellyfin instances and checks their version against the vulnerable range (< 10.11.7) by querying the unauthenticated payload withheld endpoint. It also probes the subtitle upload endpoint to confirm its existence but does not upload any files or attempt to exploit the path traversal vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python detection scanner, a README documentation file, and a requirements file for CVE-2026-35031. The Python script performs only passive version checks and endpoint probing against a user-supplied target; it does not execute any exploit payload, establish persistence, exfiltrate data, or contain concealed harmful behavior. The README describes the vulnerability and remediation steps. No backdoor, trojan, or deceptive payload was observed.
Classification basis and observed behavior
Classification basis
The Python script (CVE-2026-35031_Jellyfin_RCE_detector.py) is explicitly described as a 'Detection Script' (line 3) and its behavior is limited to version checking and endpoint probing. It does not contain any code to upload a file, inject a path traversal payload, or execute commands. The README.md provides a technical writeup but the primary executable artifact is a scanner.
CVE-2026-35031_Jellyfin_RCE_detector.py:3CVE-2026-35031_Jellyfin_RCE_detector.py:71-76Requirements
- Target must be running a Jellyfin Media Server instance with the payload withheld endpoint accessible.
CVE-2026-35031_Jellyfin_RCE_detector.py:175-181
Observed behavior
- Queries the payload withheld endpoint to retrieve the Jellyfin version string.
CVE-2026-35031_Jellyfin_RCE_detector.py:175-181 - Parses the version string and compares it against the fixed version 10.11.7 to determine vulnerability.
CVE-2026-35031_Jellyfin_RCE_detector.py:270-275 - Sends OPTIONS and POST requests to the subtitle upload endpoint (payload withheld) to check if it exists, but does not upload any file or include a malicious Format parameter.
CVE-2026-35031_Jellyfin_RCE_detector.py:89-133 - Reports a risk level (CRITICAL, HIGH, etc.) based on the version and endpoint accessibility without performing any exploitation.
CVE-2026-35031_Jellyfin_RCE_detector.py:288-298
Behaviors behind the backdoor verdict
Observables
- Network Endpoint
- Payload withheldThe scanner queries this unauthenticated Jellyfin endpoint to retrieve the server version for vulnerability assessment.
CVE-2026-35031_Jellyfin_RCE_detector.py:175 - Network Endpoint
- Payload withheldThe scanner sends OPTIONS and empty POST requests to this endpoint to check its existence without uploading any payload.
CVE-2026-35031_Jellyfin_RCE_detector.py:89 - Version Check
- Payload withheldThe scanner compares the retrieved Jellyfin version against this fixed version to determine vulnerability.
CVE-2026-35031_Jellyfin_RCE_detector.py:39
What the analysis did not establish
- The evidence includes a README.md with a detailed technical writeup, but the primary executable code is a scanner. The Nmap NSE script mentioned in the README is not included in the provided files.
- The analysis is based solely on static review of the provided source code; no dynamic execution or network interaction was performed.
- One file (CVE-2026-35031_Jellyfin_RCE.nse) was omitted from the text evidence and was not reviewed; its content is unknown.
- The review is limited to the supplied text content and does not include dynamic analysis or execution of the script.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkeraattin/CVE-2026-39987
Repository PoCStars: 1Created 2026-04-15ScannerCVE-2026-399873 files
Analysis
Technical assessment
The artifact is a detection scanner for CVE-2026-39987, a pre-authentication remote code execution vulnerability in Marimo. It identifies Marimo instances, extracts versions, and performs a safe WebSocket handshake to check if the /terminal/ws endpoint is accessible without authentication. It does not contain code to exploit the vulnerability or execute commands on a target.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python detection script and a README documentation file for CVE-2026-39987. The Python script performs safe, passive checks (HTTP requests, WebSocket handshake tests) to identify vulnerable Marimo instances. It does not execute commands on target systems, establish persistence, exfiltrate data, or contain any concealed harmful behavior. The README provides documentation and usage examples. No backdoor, trojan, or deceptive payload was observed.
Classification basis and observed behavior
Classification basis
The Python script's stated purpose is detection, not exploitation. It explicitly notes 'No commands are executed on target systems' and only performs a WebSocket handshake to check endpoint accessibility. It does not contain any code to send terminal commands, obtain a shell, or exfiltrate data.
CVE-2026-39987_Marimo_RCE_detector.py:3-7CVE-2026-39987_Marimo_RCE_detector.py:86-88CVE-2026-39987_Marimo_RCE_detector.py:381-382Requirements
- Python 'requests' library must be installed.
CVE-2026-39987_Marimo_RCE_detector.py:35-39 - Target URL must be provided via command line or file.
CVE-2026-39987_Marimo_RCE_detector.py:353-363
Observed behavior
- Sends HTTP GET requests to /api/status, /api/health, and / to detect Marimo indicators and extract version information.
CVE-2026-39987_Marimo_RCE_detector.py:191-253 - Performs a WebSocket upgrade handshake to /terminal/ws and /ws to check if the terminal endpoint is accessible without authentication.
CVE-2026-39987_Marimo_RCE_detector.py:83-150CVE-2026-39987_Marimo_RCE_detector.py:258-273 - Compares the detected version against known vulnerable ranges and reports a risk level (CRITICAL, HIGH, MEDIUM, LOW, INFO).
CVE-2026-39987_Marimo_RCE_detector.py:58-80CVE-2026-39987_Marimo_RCE_detector.py:275-297 - Outputs scan results to the console and optionally saves them to a JSON file.
CVE-2026-39987_Marimo_RCE_detector.py:302-339CVE-2026-39987_Marimo_RCE_detector.py:406-409
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe script sends a WebSocket upgrade request to check endpoint accessibility without sending data through the connection, as described in the code comments and documentation.
CVE-2026-39987_Marimo_RCE_detector.py:83-150README.md:289-295 - Http Request
- Payload withheldThe script probes standard endpoints to identify Marimo instances and extract version information.
CVE-2026-39987_Marimo_RCE_detector.py:191-253
What the analysis did not establish
- One file (likely requirements.txt) is omitted from the evidence, but its absence does not affect classification of the provided scanner code.
- The evidence includes a README.md that describes the vulnerability and attack timeline but does not contain executable exploit code.
- One file (CVE-2026-39987_Marimo_RCE.nse) is omitted from the text evidence; only its metadata is present. This file is referenced in the README as an Nmap NSE script for detection. Its content was not reviewed, but the omission is noted as a material evidence limitation.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkeraattin/CVE-2026-34197
Repository PoCStars: 1Created 2026-04-14ScannerCVE-2026-341973 files
Analysis
Technical assessment
The artifact is a detection script and documentation for CVE-2026-34197. The Python script checks for the presence of a vulnerable Apache ActiveMQ instance by probing the Jolokia API endpoint, attempting authentication, detecting the version, and verifying MBean accessibility. It does not send any exploit payload or execute commands. The README provides a technical writeup of the vulnerability and usage instructions for the scanner.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python detection script and a README documentation file for CVE-2026-34197. The Python script performs only read-only HTTP requests to check Jolokia endpoint accessibility, version detection, and MBean search queries. It does not send any exploit payloads, execute commands, or establish any backdoor access. The README describes the vulnerability and provides usage instructions for the detection script and manual verification commands. No concealed executable behavior, deceptive payloads, or operator-directed harm is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The Python script's primary operation is to detect and report on the vulnerability status of a target, not to exploit it. The script explicitly states 'No exploit payloads are sent. No commands are executed. The scanner only observes endpoint accessibility and version information.' in the README. The code performs HTTP GET requests for information gathering and a read-only Jolokia search, which are characteristic of a vulnerability scanner.
README.md:251CVE-2026-34197_ActiveMQ_Jolokia_detector.py:228-254Requirements
- Network access to the target ActiveMQ web console port (default 8161).
CVE-2026-34197_ActiveMQ_Jolokia_detector.py:112 - Python 3 with the 'requests' library installed.
CVE-2026-34197_ActiveMQ_Jolokia_detector.py:28-32
Observed behavior
- Sends HTTP GET requests to /api/jolokia/ to check if the Jolokia endpoint is accessible without authentication.
CVE-2026-34197_ActiveMQ_Jolokia_detector.py:112-120 - If the endpoint requires authentication (HTTP 401), attempts to authenticate using provided credentials or a list of default credentials (admin:admin, user:user, admin:activemq).
CVE-2026-34197_ActiveMQ_Jolokia_detector.py:134-175 - Attempts to detect the ActiveMQ version by scraping several web endpoints and matching version patterns using regular expressions.
CVE-2026-34197_ActiveMQ_Jolokia_detector.py:194-225 - Performs a safe, read-only Jolokia search query to check if the Broker MBean is accessible, confirming the exploit path exists without sending any exploit payload.
CVE-2026-34197_ActiveMQ_Jolokia_detector.py:228-254 - Calculates a risk level (CRITICAL, HIGH, MEDIUM, LOW) based on the detected version, authentication status, and Jolokia accessibility.
CVE-2026-34197_ActiveMQ_Jolokia_detector.py:266-278 - Outputs scan results in a human-readable format and optionally saves them to a JSON file.
CVE-2026-34197_ActiveMQ_Jolokia_detector.py:283-315CVE-2026-34197_ActiveMQ_Jolokia_detector.py:386-389
Behaviors behind the backdoor verdict
Observables
- Detection Script Behavior
- Payload withheldDemonstrates that the script is a passive vulnerability scanner, not an exploit or backdoor.
CVE-2026-34197_ActiveMQ_Jolokia_detector.py:78-280 - Documentation Claim
- Payload withheldExplicitly confirms the non-exploitative nature of the provided script.
README.md:251
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included. One file is reported as omitted (unclassified_bytes: 6984, unclassified_file_count: 1). The analysis is based on the two provided text files.
- The artifact's behavior is determined through static analysis of the provided source code; the code was not executed.
- One file (likely the Nmap NSE script referenced in README.md) was omitted from the text evidence due to being unclassified or binary; its content was not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkeraattin/CVE-2026-35517
Repository PoCStars: 0Created 2026-04-14ScannerCVE-2026-355174 files
Analysis
Technical assessment
The artifact is a Python-based vulnerability scanner for CVE-2026-35517. It detects vulnerable Pi-hole FTLDNS instances by querying the web interface and API to retrieve the FTL version, then comparing it against the known vulnerable range (6.0 to <6.6). It does not contain any exploit code or attempt to trigger the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python vulnerability scanner and documentation for CVE-2026-35517. The Python script performs read-only version detection against Pi-hole instances; it does not send injection payloads, execute commands, or establish persistence. The README describes the vulnerability and provides detection and remediation guidance. No concealed executable behavior, deceptive payloads, or operator-directed harm were observed.
Classification basis and observed behavior
Classification basis
The Python script's primary function is to detect vulnerable Pi-hole instances by querying version information and comparing it to a known vulnerable range. It explicitly states 'No injection payloads are sent. The test is entirely read-only and safe.' in the README and does not contain any code to construct or send a malicious payload to exploit the newline injection vulnerability. This is consistent with a scanner, not an exploit.
README.md:238CVE-2026-35517_PiHole_FTLDNS_detector.py:1-503Requirements
- Network access to the target Pi-hole instance's web interface (HTTP/HTTPS).
CVE-2026-35517_PiHole_FTLDNS_detector.py:77-83 - Python 3 with the 'packaging' library installed.
requirements.txt:1-2
Observed behavior
- Sends HTTP/HTTPS GET requests to common Pi-hole admin paths (e.g., /admin/, /admin/index.php) to fingerprint the target.
CVE-2026-35517_PiHole_FTLDNS_detector.py:97-123 - Queries Pi-hole API endpoints (e.g., /api/info/version, /admin/api.php?versions) to retrieve the FTLDNS version string.
CVE-2026-35517_PiHole_FTLDNS_detector.py:126-187 - Parses the retrieved FTL version and compares it against the vulnerable range (6.0 <= version < 6.6) to determine if the target is vulnerable.
CVE-2026-35517_PiHole_FTLDNS_detector.py:223-277 - Outputs a vulnerability assessment (VULNERABLE, PATCHED, NOT AFFECTED, or UNKNOWN) and lists related CVEs without sending any injection payloads.
CVE-2026-35517_PiHole_FTLDNS_detector.py:331-391
Behaviors behind the backdoor verdict
Observables
- Vulnerability Scanner
- Payload withheldThe script performs passive version detection via HTTP GET requests to Pi-hole admin and API endpoints. It parses version strings and compares them against the vulnerable range (6.0 to <6.6). No injection payloads are sent.
CVE-2026-35517_PiHole_FTLDNS_detector.py:77-189CVE-2026-35517_PiHole_FTLDNS_detector.py:223-277 - Documentation
- Payload withheldThe README describes the vulnerability, affected versions, detection methods, and remediation steps. It explicitly states that the Python scanner sends no injection payloads and is read-only.
README.md:225-238
What the analysis did not establish
- The evidence includes a reference to an Nmap NSE script (CVE-2026-35517_PiHole_FTLDNS.nse) in the README, but the script file itself was not included in the selected text files and is listed as an omitted file in the packet metadata.
- The analysis is based solely on the provided source code and documentation; the code was not executed, and its behavior against a live target is not verified.
- One file (CVE-2026-35517_PiHole_FTLDNS.nse) was omitted from the text evidence and was not reviewed. Its metadata indicates it is a text file, but its content was not supplied.
- Binary files were not analyzed per the evidence envelope policy; any backdoor would need to reside in the unreviewed NSE script or binary content.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkeraattin/CVE-2026-35616
Repository PoCStars: 1Created 2026-04-13ScannerCVE-2026-356163 files
Analysis
Technical assessment
A Python-based vulnerability scanner for CVE-2026-35616 that detects an authentication bypass in FortiClient EMS by comparing HTTP response codes from baseline and header-spoofed requests. It does not exploit the vulnerability to execute code or commands.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python vulnerability scanner and a README documentation file for CVE-2026-35616. The Python script performs only safe, non-exploitative HTTP requests to detect an authentication bypass vulnerability. It sends baseline and spoofed-header requests and compares HTTP status codes. No backdoor, trojan, or deceptive payload is present. The script does not execute commands, establish persistence, exfiltrate data, or contact attacker-controlled infrastructure. The README provides documentation and manual verification instructions using curl, which are standard for PoC disclosure.
Classification basis and observed behavior
Classification basis
The artifact's primary operation is to detect the presence of CVE-2026-35616 by sending crafted HTTP requests and analyzing differential responses. It does not contain code to exploit the vulnerability for unauthorized code execution, privilege escalation, or command injection. The README explicitly states 'No exploitation payload is ever sent. The test is safe for production.'
CVE-2026-35616_FortiClientEMS_detector.py:142-150README.md:200-207Requirements
- Network access to a target FortiClient EMS instance on a specified port (default 443).
CVE-2026-35616_FortiClientEMS_detector.py:77-82
Observed behavior
- Sends a baseline POST request to API endpoints without spoofed headers and records the HTTP status code.
CVE-2026-35616_FortiClientEMS_detector.py:180-201 - Sends a second POST request with spoofed X-SSL-CLIENT-VERIFY, X-SSL-CLIENT-S-DN, and X-SSL-CLIENT-SERIAL headers and records the HTTP status code.
CVE-2026-35616_FortiClientEMS_detector.py:203-227 - Compares the two status codes; if the baseline returns 401 and the spoofed request returns a different code (e.g., 500, 200), the target is flagged as vulnerable.
CVE-2026-35616_FortiClientEMS_detector.py:229-244 - Outputs a human-readable or JSON report indicating whether the target is likely vulnerable, without performing any exploitation or code execution.
CVE-2026-35616_FortiClientEMS_detector.py:251-312
Behaviors behind the backdoor verdict
Observables
- Network Behavior
- Payload withheldThis is the core detection logic for CVE-2026-35616. It is explicitly described in the script's docstring and README, and is consistent with safe vulnerability scanning.
CVE-2026-35616_FortiClientEMS_detector.py:142-248README.md:196-206 - Author Identity
- Payload withheldThe author is identified in both files. This is standard attribution for a public PoC and does not indicate malicious intent.
CVE-2026-35616_FortiClientEMS_detector.py:24-26README.md:391-396
What the analysis did not establish
- One file (likely the Nmap NSE script mentioned in the README) is omitted from the evidence, but the provided Python scanner is complete and sufficient for classification.
- The evidence does not include the actual execution output of the scanner; classification is based solely on static analysis of the source code.
- One file (CVE-2026-35616_FortiClientEMS.nse) was present in the repository but was not included as readable text; only its metadata was provided. Its content was not reviewed.
- The evidence does not include runtime behavior or network traffic captures; analysis is based solely on static source code review.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkeraattin/Mongobleed-Detector-CVE-2025-14847
Repository PoCStars: 1Created 2026-01-04ScannerCVE-2025-148473 files
Analysis
Technical assessment
The artifact is a vulnerability scanner for CVE-2025-14847 (MongoBleed). It connects to MongoDB servers, detects their version and zlib compression status, and reports whether they are vulnerable based on a hardcoded version database. It does not exploit the vulnerability or read memory.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README and a Python scanner script for CVE-2025-14847. The script performs network connections to detect MongoDB versions and zlib compression status, and exports results. No backdoor, trojan, or deceptive behavior was observed. The code's functionality is consistent with its documented purpose as a vulnerability scanner.
Classification basis and observed behavior
Classification basis
The code's primary operation is to detect and report the presence of CVE-2025-14847 by checking server version and zlib status. It does not contain any code to trigger the memory leak, read uninitialized memory, or exfiltrate data. The README explicitly describes it as a 'vulnerability scanner' and the code only performs detection and reporting.
README.md:3mongobleed_detector.py:4-6mongobleed_detector.py:532-587Requirements
- Network access to target MongoDB port (default 27017)
README.md:67 - Python 3.7 or higher
README.md:66
Observed behavior
- Connects to a MongoDB server and sends 'hello' and 'buildInfo' commands to determine the server version.
mongobleed_detector.py:462-472 - Sends a zlib-compressed OP_COMPRESSED ping message to check if zlib compression is enabled on the server.
mongobleed_detector.py:500-526 - Compares the detected version and zlib status against a hardcoded vulnerability database to determine if the target is vulnerable, safe, or mitigated.
mongobleed_detector.py:61-71mongobleed_detector.py:371-412 - Outputs a scan report to the console and optionally exports results to TXT, JSON, or CSV files.
mongobleed_detector.py:610-638mongobleed_detector.py:697-775
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe scanner connects to user-supplied MongoDB targets on the default port 27017 or a custom port to send 'hello' and 'buildInfo' commands and check zlib compression. This is expected behavior for a vulnerability scanner.
mongobleed_detector.py:460mongobleed_detector.py:507 - Data Exfiltration
- Payload withheldThe script can write scan results to a local file specified by the user via the -o flag. This is a documented feature for reporting and does not involve sending data to an external server.
mongobleed_detector.py:697-775
What the analysis did not establish
- One file (likely a license or configuration file) was omitted from the text evidence, but the two provided files (README.md and mongobleed_detector.py) constitute the complete functional code and documentation.
- The evidence does not include the execution of the code; classification is based solely on static analysis of the provided source text.
- One file (unclassified, 4688 bytes) was present in the artifact but not provided as readable text; its content is unknown.
- Binary files were flagged for metadata only and not analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.