gagaltotal
Source-scoped identity with 18 associated PoCs and 22 linked vulnerabilities.
Exploit catalog results
Showing 18 PoCs on this page
GitHubgagaltotal/CVE-2026-60004-poc-gitea
Repository PoCStars: 2Created 2026-08-08ExploitCVE-2026-600045 files
Analysis
Technical assessment
A Go program that exploits CVE-2026-60004, an authenticated or pre-auth RCE in Gitea, by injecting a malicious hook via the diffpatch API endpoint and optionally retrieving command output.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a single Go source file implementing a proof-of-concept exploit for CVE-2026-60004, a Gitea RCE vulnerability. The code performs the documented exploitation steps (detection, registration, repository creation, diffpatch delivery, and output retrieval) and contains no concealed, deceptive, or unrelated harmful behavior. All functionality is consistent with the stated purpose of demonstrating the vulnerability.
Classification basis and observed behavior
Classification basis
The primary artifact is a Go program that actively delivers a malicious payload to a remote Gitea instance to achieve remote code execution. The code constructs a diff patch containing a shell script, sends it to the diffpatch API endpoint, and retrieves the output of the executed command. This constitutes an exploit, not merely a scanner or writeup, as it performs the full exploitation chain including payload delivery and output retrieval.
cve-2026-60004-poc.go:707-759cve-2026-60004-poc.go:761-801README.md:5Requirements
- Target Gitea instance with open registration (for full-auto mode) or valid credentials (for semi-auto/manual modes).
cve-2026-60004-poc.go:1040-1052cve-2026-60004-poc.go:1061-1072 - Target must have the diffpatch API endpoint accessible and be running a vulnerable Gitea version (1.17–1.27.0).
cve-2026-60004-poc.go:35-36cve-2026-60004-poc.go:1007-1008
Observed behavior
- Registers a new user on the target Gitea instance when open registration is enabled.
cve-2026-60004-poc.go:464-547 - Creates a new repository under the authenticated user.
cve-2026-60004-poc.go:549-618 - Constructs a malicious diff patch containing a shell script hook that executes an arbitrary command and stores the output in a Git object.
cve-2026-60004-poc.go:65-102 - Sends the malicious diff patch to the /api/v1/repos/:owner/:repo/diffpatch endpoint to inject the hook.
cve-2026-60004-poc.go:669-705 - Retrieves the command output by fetching the raw 'proof' file from the rce-proof ref.
cve-2026-60004-poc.go:761-801 - Includes a non-intrusive check mode that detects Gitea, checks version, and probes the diffpatch endpoint without exploitation.
cve-2026-60004-poc.go:986-1034
Behaviors behind the backdoor verdict
Observables
- Insecure Tls Configuration
- Payload withheldThe HTTP client disables TLS certificate verification, which is a security weakness but is explicitly documented in the README as intentional for testing compatibility. It does not constitute a backdoor.
cve-2026-60004-poc.go:128-130README.md:102 - Default Command
- Payload withheldThe default command executed on the target reads /etc/passwd, a common proof-of-concept action for RCE exploits. It is user-configurable and not hidden.
cve-2026-60004-poc.go:878
What the analysis did not establish
- Evidence includes only two text files (README.md and cve-2026-60004-poc.go); three additional files (backup.txt, two images) are omitted or flagged as non-text media, but the main exploit logic is fully present.
- CVE-2026-60004 record was absent from the acquired CVEList V5 dataset, so no external CVE description is available for cross-reference.
- Three files from the repository (backup.txt, and two image files) were not included in the text evidence. The inventory describes them as notes and supporting images, but their content was not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-42533-nginx
Repository PoCStars: 0Created 2026-07-23ScannerCVE-2026-425335 files
Analysis
Technical assessment
A Go-based scanner that parses nginx configuration files to detect patterns associated with CVE-2026-42533. It identifies configurations where regex captures and regex map variables share the same request buffer, which can lead to a length/value mismatch. The tool reports vulnerable directives and provides remediation guidance, but does not send any HTTP requests or attempt to trigger the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Go-based scanner for CVE-2026-42533 nginx configuration patterns. The reviewed source code (exploit.go, README.md, go.mod) performs static analysis of nginx config files to detect vulnerable regex capture/map variable interactions. No backdoor, concealed executable behavior, or operator-directed harm is observed. The code reads local config files, parses them, and reports findings to stdout/stderr. It does not establish network connections, download or execute external payloads, modify system state, or exfiltrate data.
Classification basis and observed behavior
Classification basis
The artifact is a scanner. It reads local nginx configuration files, parses them, and statically analyzes the configuration for patterns that match the vulnerability description. It does not send any network requests, craft HTTP payloads, or attempt to trigger the vulnerability on a running server. The README explicitly states it is a 'scanner' and the code only performs static analysis.
README.md:3exploit.go:822-883Requirements
- Read access to nginx configuration files
exploit.go:200
Observed behavior
- Parses nginx configuration files and builds an AST
exploit.go:270-319 - Collects map directives that use regex matching
exploit.go:350-406 - Analyzes directives for shared buffer usage between captures and map variables
exploit.go:537-600 - Reports vulnerable configurations and remediation advice
exploit.go:975-1084
Behaviors behind the backdoor verdict
Observables
- File Io
- Payload withheldThe scanner reads nginx configuration files from user-supplied paths. This is expected behavior for a configuration scanner and does not indicate backdoor activity.
exploit.go:200exploit.go:889 - Output
- Payload withheldThe tool outputs scan results and diagnostic messages to stdout and stderr. No network transmission or data exfiltration is performed.
exploit.go:1003exploit.go:68 - Build Instruction
- Payload withheldThe README instructs building the scanner with a standard Go command. The output binary name 'exploit' is a common PoC naming convention and does not indicate malicious intent.
README.md:26
What the analysis did not establish
- One non-text media file (screenshot) was not analyzed; it is unlikely to change the classification.
- The artifact's binary is named 'exploit' but the code only performs static configuration scanning.
- Two files in the repository (one non-text media file of 695,645 bytes, one unclassified file of 359 bytes) were not provided as text and were not analyzed. Their content could theoretically contain unrelated malicious payloads, but the reviewed source code does not reference or execute them.
- The analysis is limited to static review of the supplied text; the code was not executed, and dynamic behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2021-41773-apache
Repository PoCStars: 1Created 2026-07-23ExploitCVE-2021-417735 files
Analysis
Technical assessment
A Python-based exploit for CVE-2021-41773 that sends crafted POST requests to a vulnerable Apache HTTP Server 2.4.49 to achieve remote code execution via path traversal and CGI. It includes verification, single-command execution, and an interactive shell.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, a Python exploit script, and a requirements file for CVE-2021-41773. The exploit script performs only the advertised path traversal and remote code execution against a user-supplied target. No concealed, deceptive, or operator-directed harmful behavior such as credential theft, unrelated remote access, persistence, or an unrelated payload was observed. The script's functionality is limited to sending crafted HTTP requests to the specified target and displaying the response.
Classification basis and observed behavior
Classification basis
The artifact contains code that sends crafted HTTP requests to execute arbitrary commands on a remote target, which is the definition of an exploit. The README and script both describe it as an exploit and a PoC for remote code execution.
exploit.py:2exploit.py:98-120README.md:1-3Requirements
- Target must be running Apache HTTP Server 2.4.49 with CGI enabled and a vulnerable configuration.
exploit.py:2-6README.md:7
Observed behavior
- Sends a POST request to /cgi-bin/.%2e/%2e%2e.../bin/sh with a command payload to execute arbitrary commands on the target server.
exploit.py:28exploit.py:94-96exploit.py:98-120 - Verifies vulnerability by checking if the response contains the string 'VULNERABLE' after executing 'echo VULNERABLE'.
exploit.py:134-160 - Provides an interactive shell that repeatedly prompts for commands and prints the response.
exploit.py:162-193
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the expected behavior for a CVE-2021-41773 proof-of-concept exploit.
exploit.py:28exploit.py:90-96exploit.py:98-132 - Network Communication
- Payload withheldNo connections to unrelated external hosts are made.
exploit.py:35-37exploit.py:90-92 - User Interaction
- Payload withheldNo autonomous or hidden behavior is present.
exploit.py:196-233exploit.py:236-275
What the analysis did not establish
- One non-text media file (screenshot) was not analyzed; its content is not needed for classification.
- One text file (likely a license or similar) was omitted from the packet; its absence does not affect classification.
- The evidence does not include execution results or verification that the exploit works.
- One non-text media file (images/Screenshot from 2026-07-23 16-52-21.png, 692300 bytes) was flagged as binary and not analyzed. Its content could not be reviewed.
- One text file (images/README.md) was omitted from the selected text evidence and not reviewed.
- The analysis is limited to the supplied evidence and does not include dynamic analysis or execution of the code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-63030-CVE-2026-60137-wp2shell-poc
Repository PoCStars: 0Created 2026-07-22ExploitCVE-2026-60137CVE-2026-630304 files
Analysis
Technical assessment
A Python script (poc_wp_tot.py) that exploits CVE-2026-63030 and CVE-2026-60137 to achieve remote code execution on vulnerable WordPress instances via time-based blind SQL injection in the REST API batch endpoint.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC (poc_wp_tot.py) is a Python script that exploits CVE-2026-63030 and CVE-2026-60137 to achieve time-based blind SQL injection and remote code execution on vulnerable WordPress instances. The script's behavior is consistent with its stated purpose: it probes for the vulnerability, extracts data via blind SQLi, and chains the exploit to create an administrator account, upload a plugin, and execute an attacker-supplied OS command. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the reviewed text. The plugin it deploys is a temporary command-execution endpoint that self-deactivates and deletes itself after use, which is part of the advertised exploit chain, not a hidden backdoor.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, functional exploit chain that actively performs SQL injection and achieves remote code execution. The script includes functions to send malicious payloads (send_batch, probetime), extract data (get_scalar, get_int), and escalate to RCE (exploit_rce) by creating an admin user and uploading a plugin. The README explicitly describes it as a 'proof‑of‑concept (PoC) untuk mengeksploitasi kerentanan' (PoC to exploit vulnerabilities) and provides usage examples for probe, extract, and RCE modes.
README.md:5-7poc_wp_tot.py:351-718Requirements
- Target WordPress site must be vulnerable to CVE-2026-63030 and CVE-2026-60137 (versions 6.8.x < 6.8.6, 6.9.x < 6.9.5, 7.0.x < 7.0.2).
poc_wp_tot.py:1 - Target must have at least one published post for oEmbed seeding.
poc_wp_tot.py:354-361 - Network connectivity to the target WordPress REST API endpoint.
README.md:25
Observed behavior
- Sends crafted batch requests to the WordPress REST API to perform time-based blind SQL injection.
poc_wp_tot.py:146-197 - Extracts database information (table names, user IDs) using binary search over response timing.
poc_wp_tot.py:245-308 - Seeds oEmbed cache posts via SQL injection to manipulate the WordPress post cache.
poc_wp_tot.py:379-409 - Creates a new administrator user account through a poisoned changeset and batch request.
poc_wp_tot.py:470-573 - Logs in as the new administrator, uploads a malicious plugin, and executes arbitrary OS commands.
poc_wp_tot.py:575-718
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThis is the advertised RCE chain for CVE-2026-63030/CVE-2026-60137. All steps are documented in the README and implemented in the script.
poc_wp_tot.py:351-718 - Plugin Payload
- Payload withheldThis is a temporary RCE payload, not a persistent backdoor. It is part of the documented exploit chain and cleans up after execution.
poc_wp_tot.py:610-630 - Admin Creation
- Payload withheldThis is a necessary step in the exploit chain to gain authenticated access for plugin upload. The credentials are printed to the operator.
poc_wp_tot.py:472-474poc_wp_tot.py:545-550
What the analysis did not establish
- Evidence includes only the README.md and poc_wp_tot.py files; one non-text media file (screenshot) and one additional text file are omitted from the packet.
- The artifact's behavior is inferred from static code analysis; the code was not executed, and its effectiveness against live targets is not verified.
- Two files (one non-text media file and one unclassified file) were present in the repository but not included in the text evidence. Their content was not reviewed.
- The analysis is based solely on static review of the provided source code and documentation; no dynamic execution or behavioral analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-43499-PoC-Scanner
Repository PoCStars: 17Created 2026-07-22ExploitCVE-2026-434994 files
Analysis
Technical assessment
The artifact is a Go program that implements both a kernel version scanner and a proof-of-concept exploit for CVE-2026-43499. The exploit code uses futex syscalls to trigger a use-after-free in the Linux kernel's rtmutex subsystem, which is expected to cause a kernel panic.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Go source file and a README. The Go code implements a kernel version scanner and a proof-of-concept trigger for CVE-2026-43499 using futex syscalls. No concealed executable behavior, unrelated remote access, persistence, credential theft, or operator-directed harm is present. The code's behavior is consistent with its stated purpose of demonstrating the vulnerability.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, compilable Go program with a dedicated 'runExploit' function that actively triggers the vulnerability using futex syscalls, which is the definition of an exploit. The scanner functionality is secondary.
CVE-2026-43499_poc_scan.go:288-347CVE-2026-43499_poc_scan.go:371-388Requirements
- Root or sudo privileges are required to run the exploit mode.
README.md:20 - The system must be running a vulnerable Linux kernel version.
CVE-2026-43499_poc_scan.go:245-256
Observed behavior
- The scanner mode checks the kernel release and configuration to determine if the system is vulnerable.
CVE-2026-43499_poc_scan.go:258-281 - The exploit mode uses multiple threads and futex operations (FUTEX_LOCK_PI, FUTEX_WAIT_REQUEUE_PI, FUTEX_CMP_REQUEUE_PI) to create a deadlock chain and trigger a use-after-free condition.
CVE-2026-43499_poc_scan.go:138-193CVE-2026-43499_poc_scan.go:288-347 - The exploit is expected to cause a kernel panic and system crash.
CVE-2026-43499_poc_scan.go:289-290
Behaviors behind the backdoor verdict
Observables
- Vulnerability Scanner
- Payload withheldThe scanner reads /proc/version and /boot/config-* to determine vulnerability, which is expected for a PoC scanner.
CVE-2026-43499_poc_scan.go:200-281 - Exploit Trigger
- Payload withheldThe exploit code constructs a specific futex interaction to trigger the described kernel bug. It warns the user and requires explicit confirmation before running.
CVE-2026-43499_poc_scan.go:288-347 - User Confirmation
- Payload withheldThe exploit path includes a prompt that requires the user to type 'YES' to proceed, indicating no hidden or automatic execution.
CVE-2026-43499_poc_scan.go:291-300
What the analysis did not establish
- The evidence includes a non-text media file (screenshot) that was not analyzed.
- The artifact's completeness cannot be fully verified as one text file was omitted from the packet.
- Two files (one non-text media file and one text file without content) were omitted from the evidence packet and were not reviewed.
- Binary files were flagged as metadata-only and not analyzed; no binary content was inspected.
- The review is limited to the supplied text evidence and does not verify the correctness or safety of the PoC when executed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-57517-CWP
Repository PoCStars: 0Created 2026-07-09ExploitCVE-2026-575174 files
Analysis
Technical assessment
A Go-based tool that exploits CVE-2026-57517, a blind SQL injection in Control Web Panel, to achieve remote code execution. It detects CWP instances, enumerates valid usernames, injects a SQL payload via the userRes parameter to write a PHP webshell using INTO DUMPFILE, and then executes arbitrary commands through the deployed shell.
Backdoor review
No backdoor observed in reviewed code
The supplied Go source code and README implement a proof-of-concept exploit for CVE-2026-57517, a blind SQL injection vulnerability in Control Web Panel. The code performs CWP detection, username enumeration, SQL injection to write a PHP webshell via INTO DUMPFILE, and optional command execution through that webshell. All behavior is consistent with the stated purpose of demonstrating and testing the vulnerability. No concealed, deceptive, or operator-directed harmful behavior unrelated to the exploit was observed.
Classification basis and observed behavior
Classification basis
The code actively exploits a vulnerability by sending a malicious SQL payload (UNION SELECT ... INTO DUMPFILE) to write a webshell, then uses that shell to execute arbitrary commands. This goes beyond detection or scanning; it performs the full exploitation chain to achieve remote code execution.
exploit_cwp.go:498exploit_cwp.go:557-582Requirements
- A target host running a vulnerable version of Control Web Panel (before 0.9.8.1225) accessible on port 2083.
exploit_cwp.go:26exploit_cwp.go:479-481 - The target must have a writable path for the INTO DUMPFILE operation, such as the roundcube logs directory.
exploit_cwp.go:489-495
Observed behavior
- Detects Control Web Panel by checking HTTP responses for CWP-specific strings on port 2083.
exploit_cwp.go:338-359 - Enumerates valid CWP usernames by probing known usernames and analyzing login responses.
exploit_cwp.go:374-461 - Exploits a blind SQL injection by sending a crafted userRes POST parameter containing a UNION SELECT ... INTO DUMPFILE payload to write a PHP webshell to the server.
exploit_cwp.go:479-536 - Verifies the deployed webshell by sending a command via a custom HTTP header and checking for the expected output.
exploit_cwp.go:538-555 - Executes arbitrary operating system commands on the target through the webshell and returns the output.
exploit_cwp.go:557-582 - Provides an interactive shell mode for continuous command execution.
exploit_cwp.go:936-982
Behaviors behind the backdoor verdict
Observables
- Webshell Deployment
- Payload withheldThe exploit writes a minimal PHP webshell to the target server's roundcube logs directory using SQL injection. This is the core of the demonstrated RCE chain and is expected behavior for a CVE-2026-57517 PoC.
exploit_cwp.go:486 - Command Execution
- Payload withheldThe tool includes functionality to execute arbitrary commands on the compromised host through the webshell. This is part of the advertised RCE capability and is not hidden or unrelated to the exploit.
exploit_cwp.go:557-582 - Cleanup Function
- Payload withheldThe tool provides an optional cleanup mechanism to delete the deployed webshell, which is a standard feature for authorized testing tools and does not indicate backdoor behavior.
exploit_cwp.go:584-599
What the analysis did not establish
- The evidence includes only the Go source code and README; the binary is not provided, and the code was not executed.
- The repository contains a non-text media file (screenshot) that was not analyzed.
- The evidence does not include the go.mod file content, which may contain dependency information.
- The go.mod file and any binary or non-text files in the repository were not included in the text evidence. Their contents could not be reviewed.
- The analysis is limited to the static source code; runtime behavior or compiled binary behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-44825-Apache-Solr-Scanner
Repository PoCStars: 12Created 2026-07-08ScannerCVE-2026-448254 files
Analysis
Technical assessment
A Go-based scanner that detects Apache Solr instances, checks for authentication, attempts default credential brute-force, and optionally executes a Velocity template RCE payload. The primary operation is detection and credential validation, with exploitation as an optional secondary mode.
Backdoor review
No backdoor observed in reviewed code
The supplied Go source code implements a scanner and optional exploit for CVE-2026-44825 (hardcoded credentials in Apache Solr). The code performs network scanning, credential brute-forcing against known default users, and, when requested, sends a Velocity template payload for remote command execution against the target Solr instance. All behavior is consistent with the stated purpose of a security testing tool. No concealed backdoor, unrelated remote access, persistence mechanism, or operator-directed harm beyond the declared exploit functionality was observed.
Classification basis and observed behavior
Classification basis
The tool's primary stated purpose is scanning and detection: 'This repository contains a Go-based scanner for detecting and testing Apache Solr instances' (README.md:3). The code implements detection, version extraction, authentication checks, and credential brute-forcing. Exploitation is an optional flag-driven mode (--exploit, --rce) and is not the default behavior. The tool is classified as a scanner because its core operation is to identify and report vulnerable targets, not to directly exploit them without explicit user invocation.
README.md:3solr_main.go:803-804Requirements
- Network access to a target Apache Solr instance
README.md:25 - Target must be running Apache Solr with BasicAuth enabled and default credentials present
solr_main.go:50-51
Observed behavior
- Normalizes target URLs and appends /solr if missing
solr_main.go:108-125 - Detects Solr by requesting /admin/info/system and checking response body and server header for 'solr'
solr_main.go:218-249 - Checks for authentication by looking for 401 responses on admin endpoints
solr_main.go:260-277 - Brute-forces default credentials using hardcoded template users (superadmin, admin, search, index) and a password list
solr_main.go:50-51solr_main.go:576-597 - Optionally executes a Velocity template RCE payload using discovered credentials or user-supplied credentials
solr_main.go:412-430solr_main.go:432-464 - Exports scan results to a JSON file
solr_main.go:690-699
Behaviors behind the backdoor verdict
Observables
- Credential List
- Payload withheldHardcoded credential lists used for brute-force authentication against detected Solr instances, directly related to the CVE-2026-44825 vulnerability.
solr_main.go:50-51 - Exploit Payload
- Payload withheldThe tool constructs and sends a Velocity template injection payload to execute arbitrary shell commands on the target Solr server when the --exploit or --rce flags are used.
solr_main.go:412-430solr_main.go:432-464 - Network Behavior
- Payload withheldThe scanner probes standard Solr API endpoints for detection, authentication checks, and RCE delivery, all within the scope of the declared CVE testing.
solr_main.go:219solr_main.go:262solr_main.go:271solr_main.go:449
What the analysis did not establish
- Evidence includes only two text files (README.md and solr_main.go); two additional files (go.mod and a non-text media file) are present in the repository but not included in the packet.
- The non-text media file (698855 bytes) is flagged as metadata only and not analyzed, which may contain additional context.
- The analysis is based solely on static source code review; no dynamic execution or verification of the tool's behavior was performed.
- One non-text media file (images/Screenshot from 2026-07-08 23-44-47.png, 698855 bytes) was flagged as metadata-only and not analyzed for steganographic or embedded payloads.
- One unclassified file (366 bytes) was present in the repository but not included in the text evidence; its content and purpose are unknown.
- The compiled binary (solr_scanner) was not provided or analyzed; the review is based solely on the supplied source code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-22557-Path-Traversal-Ubiquti-UniFi
Repository PoCStars: 0Created 2026-06-30ScannerCVE-2026-225576 files
Analysis
Technical assessment
A Go-based scanner that sends path traversal payloads to UniFi Network Application endpoints and reports responses containing system file content indicators without exploiting the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a single Go source file implementing a path traversal scanner for CVE-2026-22557. The code performs only the advertised scanning behavior: it constructs HTTP requests with traversal payloads, sends them to a user-supplied target, and reports responses. No hidden, deceptive, or operator-directed harmful behavior is present. The code does not establish persistence, exfiltrate data, download or execute unrelated payloads, or conceal any malicious functionality.
Classification basis and observed behavior
Classification basis
The code only sends HTTP requests and inspects responses for indicators of path traversal; it does not write files, execute commands, or establish a foothold. The README explicitly describes it as a 'proof-of-concept scanner' that 'perform[s] a controlled and non-destructive scan' and 'run[s] in a safe, informational mode without modifying target systems'.
README.md:3README.md:13poc_cve_unifi.go:240-339Requirements
- Network access to the target UniFi Network Application
README.md:19 - Explicit authorization to test the target
README.md:19
Observed behavior
- Sends HTTP GET requests to predefined UniFi endpoints with path traversal payloads in the 'path' query parameter
poc_cve_unifi.go:252-255 - Checks response body for strings like 'root:', 'daemon:', 'nobody:' or length > 500 to flag possible vulnerability
poc_cve_unifi.go:287-290 - Reports suspicious responses without modifying the target system
README.md:13
Behaviors behind the backdoor verdict
Observables
- Network Behavior
- Payload withheldThe scanner sends requests only to the target specified by the operator, consistent with a proof-of-concept vulnerability scanner.
poc_cve_unifi.go:252-255poc_cve_unifi.go:341-363 - Tls Configuration
- Payload withheldTLS certificate verification is disabled, which is a common practice in security testing tools but reduces transport security. This is disclosed in the README and does not constitute a backdoor.
poc_cve_unifi.go:117README.md:101
What the analysis did not establish
- Evidence includes only two text files (README.md and poc_cve_unifi.go); three non-text media files (images) and one unclassified file are present but not analyzed.
- The artifact's complete_artifact_coverage is false; the unclassified file and non-text media are not inspected, so the full repository content is not represented.
- Three non-text media files (images) and one unclassified file are present in the repository but were not analyzed; their content could not be reviewed.
- The review is limited to static analysis of the provided source text; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-23918-Double-free-Apache-httpd-mod_http2
Repository PoCStars: 0Created 2026-06-28ExploitCVE-2026-239185 files
Analysis
Technical assessment
A Go-based proof-of-concept exploit for CVE-2026-23918, a double-free vulnerability in Apache httpd mod_http2. The code implements a spray-and-trigger approach: it crafts HTTP/1.1 requests to spray memory with a payload containing a command and the address of the system() function, then sends HTTP/2 RST_STREAM frames to trigger the double-free and redirect execution to the injected command.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Go source file implementing a proof-of-concept exploit for CVE-2026-23918. The code performs memory spray and HTTP/2 trigger operations against a target Apache httpd server to achieve remote code execution, which is the stated purpose of the PoC. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the declared exploit behavior was observed.
Classification basis and observed behavior
Classification basis
The code is designed to exercise a vulnerability by sending crafted network payloads to a target to achieve remote code execution. It includes memory spray, address manipulation, and a trigger sequence, which are characteristic of an exploit. The README explicitly describes it as a 'proof-of-concept exploit' and the code attempts to execute a user-supplied command on the target.
README.md:3README.md:7-12exploit_poc.go:332-365exploit_poc.go:711-731Requirements
- Target must be running a vulnerable version of Apache httpd with mod_http2 (CVE-2026-23918).
README.md:1-3 - Network access to the target Apache httpd instance.
README.md:29 - Root privileges on the attacker machine if using automatic memory address extraction via /proc/<pid>/mem.
README.md:28 - Knowledge of the target Apache worker process PID (for auto mode) or the addresses of system() and the scoreboard request slot (for manual mode).
README.md:57-78
Observed behavior
- Extracts memory addresses of system() and the Apache scoreboard from a target process using /proc/<pid>/mem and nm.
exploit_poc.go:72-284 - Builds a crafted HTTP/1.1 request payload containing a shell command and memory addresses to overwrite the scoreboard and redirect execution.
exploit_poc.go:332-397 - Performs a memory spray by repeatedly sending the crafted HTTP/1.1 requests over TLS to the target.
exploit_poc.go:428-462 - Sends HTTP/2 RST_STREAM frames to trigger the double-free vulnerability and achieve code execution.
exploit_poc.go:711-731
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe code constructs crafted HTTP requests, performs memory spray via TLS connections, and sends HTTP/2 frames to trigger a double-free vulnerability, consistent with the described CVE-2026-23918 exploit.
exploit_poc.go:332-397exploit_poc.go:428-462exploit_poc.go:711-731 - Command Execution
- Payload withheldThe exploit accepts a --cmd flag and embeds the command into the spray payload, aiming to redirect execution to the system() function. This is the intended RCE mechanism of the PoC.
exploit_poc.go:300-301exploit_poc.go:336-337exploit_poc.go:357-359 - Memory Extraction
- Payload withheldThe auto-extract mode uses OS-level process memory access to find required addresses, which is a standard technique for local privilege escalation or exploit development and is documented in the README.
exploit_poc.go:72-95exploit_poc.go:124-167exploit_poc.go:245-284
What the analysis did not establish
- The evidence includes only the README.md and exploit_poc.go files; three other files (go.mod, exploit, images) are not provided as text, so the complete build environment and any supporting assets are not fully visible.
- The code is not executed or verified; classification is based solely on static analysis of the provided source code and documentation.
- Two non-text media files (images) and one unclassified file (280 bytes) were present but not analyzed; their content could not be reviewed.
- The precompiled 'exploit' binary was not inspected; only the source code was reviewed.
- The review is limited to the supplied text evidence and does not verify runtime behavior or network traffic.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-26980-Ghost-CMS-Api
Repository PoCStars: 11Created 2026-06-26ExploitCVE-2026-269806 files
Analysis
Technical assessment
Go-based exploit for CVE-2026-26980, a SQL injection in Ghost CMS Content API. It performs boolean-based blind SQL injection to extract admin email, password hash, and API secret from the database.
Backdoor review
No backdoor observed in reviewed code
The supplied Go source code and README implement a proof-of-concept for CVE-2026-26980, a SQL injection in Ghost CMS. The code performs reconnaissance, setup, authentication, and boolean-blind data extraction against a target URL. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload was observed. The artifact's behavior is consistent with its stated purpose of demonstrating and validating the vulnerability.
Classification basis and observed behavior
Classification basis
The code actively exploits the SQL injection vulnerability to extract sensitive data (email, password hash, API secret) from the database, not merely detecting or reporting its presence.
ghost_sqli_cms.go:636-658ghost_sqli_cms.go:522-551Requirements
- Target Ghost CMS instance running an affected version (3.24.0 through 6.19.0) with network access.
README.md:20-21 - A Content API key, either obtained automatically via setup/login or supplied manually.
ghost_sqli_cms.go:373-388
Observed behavior
- Performs boolean-based blind SQL injection by sending crafted filter parameters to the Content API and observing HTTP status codes (200 for true, 500 for false).
ghost_sqli_cms.go:522-551 - Extracts data character by character using binary search on ORD/SUBSTR SQL functions.
ghost_sqli_cms.go:596-611 - Extracts admin email, password hash, and admin API secret from the database.
ghost_sqli_cms.go:636-658
Behaviors behind the backdoor verdict
Observables
- Credential Harvesting
- Payload withheldThis is the core exploit behavior described by the CVE and the README. The tool is designed to extract these secrets as proof of vulnerability, not to exfiltrate them to an attacker-controlled third party.
ghost_sqli_cms.go:636-658 - Target Interaction
- Payload withheldThe tool attempts to set up a fresh Ghost instance or log in if already set up. This is part of the PoC flow to obtain a Content API key needed for the injection. The credentials are hardcoded for the PoC and are not exfiltrated.
ghost_sqli_cms.go:293-371 - Network Communication
- Payload withheldAll network calls are directed at the base URL provided by the operator. No external callbacks, C2 channels, or data exfiltration to third-party hosts are present.
ghost_sqli_cms.go:188-259
What the analysis did not establish
- Evidence includes only two text files (README.md and ghost_sqli_cms.go); three non-text media files and one unclassified file are present but not analyzed.
- The artifact's complete_artifact_coverage is false; the analysis scope is limited to the selected text files.
- Three non-text files (images, go.mod, go.sum) and one text file (ghost_sqli/ directory content) were present in the repository but not included in the review packet. Their content was not analyzed.
- The review is based solely on static source code analysis; no dynamic execution or behavioral monitoring was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-48908-SP-Page-Builder-Joomla
Repository PoCStars: 0Created 2026-06-24ExploitCVE-2026-489085 files
Analysis
Technical assessment
A Go-based exploit for CVE-2026-48908 that uploads a malicious ZIP file containing a PHP webshell to a vulnerable Joomla SP Page Builder endpoint, then executes arbitrary commands on the target server.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Go source file (poc_tot.go) that implement a proof-of-concept exploit for CVE-2026-48908. The code uploads a PHP webshell via a ZIP extraction vulnerability in SP Page Builder for Joomla, then executes attacker-supplied commands. All behavior is consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm beyond the exploit itself was observed.
Classification basis and observed behavior
Classification basis
The code actively exploits the vulnerability by uploading a malicious ZIP file containing a PHP webshell and then executing arbitrary commands on the target. It is not limited to detection or validation; it achieves remote code execution.
poc_tot.go:147-150poc_tot.go:304-309poc_tot.go:628Requirements
- Target running Joomla with SP Page Builder component version <= 6.6.1
README.md:13 - Network access to the target Joomla installation
README.md:27
Observed behavior
- Crafts a ZIP archive containing a PHP webshell and supporting icon font files
poc_tot.go:146-204 - Uploads the crafted ZIP to the unauthenticated endpoint index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon
poc_tot.go:216-293 - Executes arbitrary system commands via HTTP GET requests to the extracted PHP webshell
poc_tot.go:304-336 - Provides an interactive pseudo-shell for continuous command execution
poc_tot.go:467-503
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the core exploit functionality described in the README and CVE context. It is not a backdoor against the PoC user.
poc_tot.go:146-150poc_tot.go:304-336 - Network Connection
- Payload withheldThe exploit upload endpoint. Connections are made only to the user-supplied target.
poc_tot.go:234-235 - File Write
- Payload withheldThis is the intended exploit payload delivery mechanism.
poc_tot.go:146-204
What the analysis did not establish
- Evidence does not include the compiled binary; analysis is based solely on the provided Go source code and README.
- The artifact contains non-text media files (screenshots) that were not analyzed.
- The evidence packet reports complete_artifact_coverage as false, indicating additional files exist in the repository that were not included in the analysis.
- The artifact includes 3 additional files (2 non-text, 1 text) that were not provided as readable text. Their content is unknown, but the analysis routing indicates they were flagged as metadata-only and not analyzed. The provided text files (README.md, poc_tot.go) constitute the complete selected text evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-10523-Ivanti-sentry
Repository PoCStars: 3Created 2026-06-19ExploitCVE-2026-10520CVE-2026-105236 files
Analysis
Technical assessment
A Go-based tool that sends a crafted POST request to the Ivanti Sentry `/mics/api/v2/sentry/mics-config/handleMessage` endpoint to execute arbitrary OS commands. It constructs a payload containing a user-supplied command, sends it without authentication, and extracts the command output from the XML response, achieving remote code execution.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Go source file (tot_poc.go) that implement a proof-of-concept exploit for CVE-2026-10520 and CVE-2026-10523. The code sends a crafted POST request to a target Ivanti Sentry endpoint to execute a user-supplied command and displays the output. No concealed backdoor, persistence mechanism, credential theft, or unrelated payload was observed. The tool's behavior is consistent with its stated purpose as a detection/exploitation PoC.
Classification basis and observed behavior
Classification basis
The code actively executes arbitrary OS commands on the target system by sending a crafted payload to a vulnerable endpoint and extracting the output. This goes beyond detection or scanning; it performs the exploitation action of command injection.
tot_poc.go:79-98tot_poc.go:101-125README.md:7Requirements
- Target must be a vulnerable Ivanti Sentry instance with the /mics/api/v2/sentry/mics-config/handleMessage endpoint accessible.
README.md:166 - Network connectivity to the target system is required.
README.md:167
Observed behavior
- Sends an unauthenticated POST request to the vulnerable endpoint with a payload containing a user-supplied OS command.
tot_poc.go:79-98 - Extracts the command output from the XML response body and displays it to the user.
tot_poc.go:101-125tot_poc.go:233-235 - Disables TLS certificate verification, allowing connections to targets with self-signed certificates.
tot_poc.go:54-57
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented exploit vector for the stated CVEs; the tool executes the command provided by the operator via the -cmd flag.
tot_poc.go:83-86tot_poc.go:215 - Tls Verification Disabled
- Payload withheldTLS certificate verification is disabled, which is a security risk but is documented as a feature for testing self-signed certificates and does not constitute a backdoor.
tot_poc.go:55-57 - Proxy Support
- Payload withheldAllows routing traffic through a proxy; this is a legitimate testing feature and does not indicate hidden exfiltration.
tot_poc.go:148-149tot_poc.go:60-66
What the analysis did not establish
- The evidence includes only two text files (README.md and tot_poc.go) out of six total files; three non-text media files and one additional text file are not provided, so the analysis is based on the available source code and documentation.
- The artifact's behavior is inferred from static code analysis; the code was not executed, and its effectiveness against a live target is not verified.
- Three non-text media files (images) and one unclassified file were present in the repository but were not analyzed; their content could not be reviewed.
- The review is limited to the supplied text evidence; the compiled binary or runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-42945-NGINX-Rift-Toolkit
Repository PoCStars: 4Created 2026-05-20ExploitCVE-2026-429459 files
Analysis
Technical assessment
The artifact is a toolkit for CVE-2026-42945 that includes a fully functional remote code execution exploit (exploit.py) which uses heap spray techniques to execute arbitrary commands on a vulnerable nginx server with ASLR disabled.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README, a Python exploit script, and a requirements file for a toolkit targeting CVE-2026-42945. The exploit.py script implements a heap spray buffer overflow attack against a vulnerable nginx server, with options for arbitrary command execution and a reverse shell. All behavior is consistent with the stated purpose of a proof-of-concept exploit for the described CVE. No concealed, deceptive, or operator-directed harm beyond the normal exploit behavior was observed.
Classification basis and observed behavior
Classification basis
The file exploit.py contains code that actively exploits a vulnerability to achieve remote code execution. It constructs a malicious payload, performs a heap spray, triggers a buffer overflow, and executes an attacker-supplied command on the target system. This is the definition of an exploit.
exploit.py:1-5exploit.py:223-235exploit.py:298-370exploit.py:462-613Requirements
- Target nginx server must have ASLR disabled.
README.md:36 - Target must be running a vulnerable version of nginx (prior to 1.26.3 mainline or 1.24.1 stable).
README.md:33
Observed behavior
- Sends crafted HTTP requests to perform a heap spray and trigger a buffer overflow in the nginx worker process.
exploit.py:268-370 - Executes an arbitrary shell command on the target server via a call to system().
exploit.py:223-235exploit.py:484 - Can generate and deploy a Python reverse shell back to the attacker.
exploit.py:237-247exploit.py:387-441
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal, documented behavior of the PoC exploit for CVE-2026-42945.
exploit.py:223-235exploit.py:298-370exploit.py:462-613 - Reverse Shell
- Payload withheldThis is a standard feature of RCE exploits and is explicitly documented in the README and script help.
exploit.py:237-247exploit.py:387-441README.md:73-82 - Network Connection
- Payload withheldThis is required for the exploit to function and is not a backdoor.
exploit.py:194exploit.py:275
What the analysis did not establish
- The evidence packet does not include the content of the scanner (nginx_scanner.py) and patcher (nginx_patcher.py) components, which are mentioned in the README but not provided as text.
- The analysis is based solely on the provided source code and documentation; the code was not executed, and its effectiveness or safety is not verified.
- Three non-text media files (screenshots) totaling 2,145,235 bytes were flagged as metadata-only and not analyzed. They are referenced in the README as screen captures of the tool in use and are unlikely to contain executable backdoor logic.
- Three additional text files (nginx_patcher.py, nginx_scanner.py, LICENSE) were present in the repository but not included in the selected text evidence. Their absence limits complete coverage, but the provided exploit.py and README are the primary components relevant to backdoor assessment.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/CVE-2026-43284-CVE-2026-43500-scan
Repository PoCStars: 0Created 2026-05-11ScannerCVE-2026-43284CVE-2026-435005 files
Analysis
Technical assessment
The artifact is a Python-based network scanner and mitigation tool named 'DirtyFrag Scanner & Patcher'. It audits Linux hosts over SSH for exposure to CVE-2026-43284 and CVE-2026-43500 by checking kernel versions and loaded kernel modules (esp4, esp6, rxrpc). It does not contain exploit code; its primary operation is detection and reporting, with an optional automated mitigation feature that blacklists vulnerable modules.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python script (dirtyfrag_scanner.py) that audits and mitigates two Linux kernel CVEs via SSH. The script performs standard vulnerability scanning and applies documented mitigations (module blacklisting, rmmod, page cache flush). No backdoor, concealed executable behavior, or unrelated payload was observed. The code is straightforward and its actions align with the stated purpose.
Classification basis and observed behavior
Classification basis
The artifact's primary function is to scan remote Linux hosts for the presence of vulnerable kernel modules and report their status. It does not contain any code that exploits the vulnerabilities (e.g., triggering the page-cache write). The optional '--patch' feature applies a mitigation (module blacklisting), not an exploit. The README explicitly describes it as an 'Automated Linux LPE Audit & Mitigation' tool.
README.md:1-3dirtyfrag_scanner.py:1-8Requirements
- SSH credentials (password or private key) for target hosts
dirtyfrag_scanner.py:228-231 - Root or sudo privileges on target hosts for mitigation
dirtyfrag_scanner.py:517-532
Observed behavior
- Connects to target hosts via SSH and collects system information (kernel version, loaded modules, OS release)
dirtyfrag_scanner.py:410-420 - Assesses vulnerability status for CVE-2026-43284 by checking if esp4/esp6 modules are loaded and kernel version is below 6.15
dirtyfrag_scanner.py:262-285 - Assesses vulnerability status for CVE-2026-43500 by checking if the rxrpc module is loaded
dirtyfrag_scanner.py:288-303 - Optionally applies mitigation by writing a modprobe blacklist configuration and unloading vulnerable modules
dirtyfrag_scanner.py:469-509 - Generates a summary report of scan results, including vulnerability status and mitigation success
dirtyfrag_scanner.py:798-827
Behaviors behind the backdoor verdict
Observables
- Ssh Credential Handling
- Payload withheldThis is necessary for the tool's stated purpose of remote auditing and mitigation. The credentials are used only for the declared SSH operations.
dirtyfrag_scanner.py:96-108dirtyfrag_scanner.py:308-343 - Privilege Escalation
- Payload withheldThis is a documented feature for applying mitigations on systems where the user has sudo ALL=(ALL) ALL but not NOPASSWD. It is used only for the declared mitigation steps.
dirtyfrag_scanner.py:384-407dirtyfrag_scanner.py:424-454 - Remote Command Execution
- Payload withheldThese commands are the documented mitigation steps for the CVEs. No commands outside the declared audit/mitigation scope were observed.
dirtyfrag_scanner.py:469-509dirtyfrag_scanner.py:512-625
What the analysis did not establish
- One non-text media file (screenshot) was not analyzed; it is unlikely to contain executable code.
- The evidence includes CVE context metadata but no independent verification of the vulnerabilities was performed.
- Two files (a screenshot and an unclassified file) were present in the repository but not included as text evidence; their content is unknown.
- The review is based solely on static analysis of the provided source code; no dynamic execution or network traffic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/cve-2026-31431-copy-fail
Repository PoCStars: 1Created 2026-05-07ScannerCVE-2026-314315 files
Analysis
Technical assessment
The artifact is a Python-based network scanner and patch helper for CVE-2026-31431. It connects to Linux hosts via SSH, checks kernel versions and module status to determine vulnerability, and can optionally apply mitigations or kernel upgrades. It does not contain code to exploit the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README.md, a Python scanner script (copyfail_scanner.py), and a requirements.txt. The scanner is a legitimate defensive tool that uses SSH to check Linux kernel versions and optionally apply patches or mitigations for CVE-2026-31431. No backdoor, trojan, or deceptive payload was observed. The script performs only the documented vulnerability scanning and remediation actions; it does not exfiltrate data, establish persistence, or execute unrelated commands.
Classification basis and observed behavior
Classification basis
The code's primary operation is to detect vulnerable hosts by checking kernel versions and module status, and to optionally apply patches or mitigations. It does not contain any exploit payload, privilege escalation logic, or code that exercises the vulnerability. The README explicitly describes it as a 'scanner keamanan otomatis dan patch helper' (automatic security scanner and patch helper).
README.md:5copyfail_scanner.py:1-7Requirements
- Requires SSH access (key or password) to target Linux hosts.
copyfail_scanner.py:922-925 - Requires Python 3.7+ and paramiko, rich libraries.
requirements.txt:1-2
Observed behavior
- Scans a subnet or list of IPs by connecting via SSH, gathering kernel version, distro, and algif_aead module status.
copyfail_scanner.py:568-603 - Compares kernel version against a hardcoded map of patched versions per distro to determine if a host is vulnerable.
copyfail_scanner.py:534-565 - Optionally applies a temporary mitigation by disabling the algif_aead module via modprobe.d.
copyfail_scanner.py:629-644 - Optionally performs an automatic kernel upgrade using the detected package manager (apt, dnf, yum, zypper, pacman).
copyfail_scanner.py:647-684 - Generates a colorized table and summary of scan results, and can export results to JSON.
copyfail_scanner.py:761-886
Behaviors behind the backdoor verdict
Observables
- Ssh Credential Handling
- Payload withheldThis is expected behavior for a legitimate SSH-based scanner. The credentials are used only for the declared purpose of scanning and patching; no evidence of credential exfiltration or misuse was found.
copyfail_scanner.py:922-924 - Remote Command Execution
- Payload withheldAll executed commands are directly related to the stated purpose of vulnerability detection and remediation. No unrelated or suspicious commands were identified.
copyfail_scanner.py:571-578copyfail_scanner.py:130-151
What the analysis did not establish
- One non-text media file (screenshot) and one text file (likely LICENSE) were not included in the packet; their absence does not affect classification.
- The evidence packet reports complete_artifact_coverage as false, but all three selected text files are provided in full.
- Two files in the repository (one non-text media file and one unclassified file) were not included in the selected text evidence and were not analyzed. Their content is unknown.
- The review is limited to static analysis of the provided source code; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/cve-2026-24858
Repository PoCStars: 0Created 2026-02-10ScannerCVE-2026-248585 files
Analysis
Technical assessment
A Python tool that scans a target for Fortinet web management indicators and optionally sends a user-supplied payload to an arbitrary endpoint. The exploit mode is disabled by default and requires an explicit flag.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python helper for CVE-2026-24858 that performs a benign Fortinet web management scan and an optional, explicitly gated exploit sender. The exploit mode is disabled by default and requires a user-supplied payload file and the --enable-exploit flag. The code only sends the provided bytes to a user-specified endpoint; it does not contain any concealed executable behavior, credential theft, persistence, or unrelated payloads. No backdoor or deceptive behavior was observed in the reviewed text files.
Classification basis and observed behavior
Classification basis
The primary function of the tool is to scan for Fortinet web management indicators (detect_fortinet). The exploit mode is explicitly disabled by default and requires a user-supplied payload and an explicit flag, making it a generic payload sender rather than a vulnerability-specific exploit. The README describes the tool as a 'helper Python konservatif untuk *memindai*' (conservative Python helper for scanning).
README.md:5cve_2026_24858_tool.py:3cve_2026_24858_tool.py:173-175Requirements
- Target must be running a Fortinet web management interface accessible over HTTP/HTTPS.
cve_2026_24858_tool.py:32-36 - For exploit mode, a payload file must be provided and the --enable-exploit flag must be set.
cve_2026_24858_tool.py:125-126
Observed behavior
- Sends an HTTP GET request to the target root path and inspects the response body and Server header for Fortinet-specific strings.
cve_2026_24858_tool.py:39cve_2026_24858_tool.py:60-65 - Checks for HTTP response headers starting with 'x-forti'.
cve_2026_24858_tool.py:67-68 - In exploit mode, reads a binary payload from a file and sends it as an HTTP POST request to a user-specified endpoint.
cve_2026_24858_tool.py:181-183cve_2026_24858_tool.py:83
Behaviors behind the backdoor verdict
Observables
- Exploit Gating
- Payload withheldThe exploit sender is explicitly disabled by default and will exit with an error if the flag is not provided, preventing accidental or hidden execution.
cve_2026_24858_tool.py:173-175cve_2026_24858_tool.py:125-126 - Payload Handling
- Payload withheldThe tool does not generate, modify, or interpret the payload; it acts as a simple HTTP client for user-provided data.
cve_2026_24858_tool.py:181-183cve_2026_24858_tool.py:73-83 - Network Activity
- Payload withheldAll network activity is directed at the user-provided target and endpoint; no external callbacks or unrelated connections are present.
cve_2026_24858_tool.py:36-39cve_2026_24858_tool.py:77-83
What the analysis did not establish
- One non-text media file (666689 bytes) was not analyzed; it is a screenshot referenced in the README.
- One text file (LICENSE) was omitted from the packet content.
- The exploit mode does not contain any CVE-2026-24858-specific logic; it is a generic HTTP POST sender.
- One non-text media file (Screenshot from 2026-02-11 01-17-03.png, 666,689 bytes) was flagged as metadata-only and not analyzed; it could contain hidden data, but no code references or loads it.
- One unclassified file (315 bytes) was not analyzed; its content and purpose are unknown.
- One text file (likely a license or similar) was omitted from the packet; its content was not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/n8n-cve-2025-68613
Repository PoCStars: 0Created 2025-12-28ExploitCVE-2025-686136 files
Analysis
Technical assessment
The repository contains a Python script (payload withheld) that authenticates to an n8n instance, creates a workflow with a malicious expression, and executes it to achieve remote code execution (RCE). It supports multiple payloads including command execution, file read/write, and reverse shell. The README also describes a scanner, but the scanner file is not included in the evidence.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, a requirements file, and a single Python exploit script (payload withheld) for CVE-2025-68613. The script performs authenticated RCE against a target n8n instance by injecting expressions into a workflow, which is the documented exploit behavior. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm beyond the stated exploit was observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The file payload withheld is explicitly designed to exploit CVE-2025-68613 by injecting expressions into an n8n workflow to execute arbitrary code on the target system. It performs the full exploit chain: authentication, malicious workflow creation, execution, and optional cleanup.
tot-exploit-2025-68613.py:1-386README.md:8-12Requirements
- Valid n8n credentials (email and password) are required for authentication.
tot-exploit-2025-68613.py:82-122 - The target n8n instance must be running and accessible over the network.
tot-exploit-2025-68613.py:61-62
Observed behavior
- Authenticates to the n8n REST API using provided credentials and extracts a bearer token.
tot-exploit-2025-68613.py:82-122 - Creates a new workflow containing a 'Set' node with a user-controlled expression that invokes arbitrary JavaScript via 'this.constructor.constructor'.
tot-exploit-2025-68613.py:125-177 - Executes the malicious workflow, triggering the injected expression to run on the server.
tot-exploit-2025-68613.py:180-199 - Supports payloads for system info gathering, OS command execution, environment variable dumping, file read/write, and reverse shell.
tot-exploit-2025-68613.py:218-341
Behaviors behind the backdoor verdict
Observables
- Exploit Script
- Payload withheldThe script implements authenticated RCE via expression injection in n8n workflows, consistent with the described CVE-2025-68613 vulnerability.
tot-exploit-2025-68613.py:1-386 - Payload
- Payload withheldThe command execution payload uses Node.js child_process to run arbitrary OS commands, which is the core of the RCE exploit.
tot-exploit-2025-68613.py:243 - Payload
- Payload withheldThe reverse shell payload establishes a connection back to an attacker-controlled host, which is a standard post-exploitation technique.
tot-exploit-2025-68613.py:307
What the analysis did not establish
- The scanner script (tot-scanner-2025-68613.py) is mentioned in the README but is not included in the provided evidence files.
- The evidence does not include the non-text media file (Screenshot from 2025-12-28 23-50-48.png) referenced in the README.
- The evidence does not include the two text files without content that are part of the repository.
- Three files (including one non-text media file and two unclassified files) were not provided as text and were not analyzed. Their content could contain additional behavior not reflected in this review.
- The scanner script (tot-scanner-2025-68613.py) was listed in the README but its content was not included in the evidence; its behavior is unknown.
- Binary or non-text content flagged as metadata-only was not inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubgagaltotal/tot-react-rce-CVE-2025-55182
Repository PoCStars: 1Created 2025-12-12ScannerCVE-2025-55182CVE-2025-6647832 files
Analysis
Technical assessment
A Python-based tool that checks for CVE-2025-55182 (React Server Components RCE) by sending HTTP requests to target URLs and optionally providing an interactive shell. The main.py script orchestrates scanning of single or multiple targets, while the README describes it as a 'Next.js tool' for the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files (README.md, main.py, requirements.txt) constitute a command-line tool for testing CVE-2025-55182. main.py imports standard modules and project modules, parses arguments, and dispatches to either a vulnerability check or an interactive shell. No obfuscation, concealed payloads, persistence mechanisms, credential theft, or unrelated remote access behavior is present in the supplied evidence.
Classification basis and observed behavior
Classification basis
The artifact's primary operation is checking for the presence of CVE-2025-55182 by sending HTTP requests to targets. The main.py script calls run_checks to perform vulnerability detection and offers an interactive shell only as an optional mode. The README describes it as a 'tool' for the CVE. No exploit payload or deserialization gadget is present in the supplied text files; the core exploitation logic resides in uninspected modules (http_client, etc.). The artifact is therefore classified as a scanner.
main.py:51-63README.md:1-3Requirements
- Target URL(s) must be provided via -u or -l arguments.
main.py:23-28 - Python dependencies aiohttp, requests, termcolor, tabulate must be installed.
requirements.txt:1-4
Observed behavior
- Parses command-line arguments including target URL, list of URLs, proxy, custom headers, and shell mode.
main.py:11-16 - Runs vulnerability checks against provided URLs using run_checks function.
main.py:51-63 - Optionally enters an interactive shell on a target when --shell flag is used.
main.py:33-43
Behaviors behind the backdoor verdict
Observables
- Import
- Payload withheldThe interactive shell entry point is imported but its implementation is not included in the reviewed files; its behavior cannot be confirmed from the supplied evidence.
main.py:5
What the analysis did not establish
- Only 3 of 32 repository files were provided as text; the remaining 29 files (including http_client.py, cli.py, and other modules that likely contain the actual vulnerability check and shell logic) were omitted.
- The evidence does not include the actual HTTP requests, payloads, or deserialization techniques used to detect or exploit CVE-2025-55182.
- The interactive shell entry point is referenced but its implementation is not included in the supplied text.
- Only 3 of 30 text files were included; the interactive shell implementation (http_client.py) and other modules are absent.
- Two non-text media files (699,759 bytes) and 27 unclassified files were not analyzed.
- Binary files were flagged as metadata-only and not inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.