Milad karimi
Source-scoped identity with 37 associated PoCs and 27 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
ExploitDBProtonVPN v4.4.1 - Unquoted Service Path
ExploitDB exploitPublished 2026-07-07ScannerUnlinked1 file
Analysis
Technical assessment
The artifact describes an unquoted service path vulnerability in ProtonVPN v4.4.1 and provides a PowerShell command to query the service configuration, which only detects the vulnerability without exploiting it.
Backdoor review
No backdoor observed in reviewed code
The supplied text is a straightforward public disclosure of an unquoted service path vulnerability in ProtonVPN 4.4.1. It contains a description of the vulnerability, a proof-of-concept showing the service configuration, and no hidden commands, obfuscated payloads, or deceptive instructions. No backdoor or trojan behavior is present.
ClassificationScanner
Model confidence95%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact provides a PowerShell command (sc.exe qc) that only queries and displays the service configuration, which is a detection technique, not an exploitation. It does not include code to insert or execute a malicious payload.
exploits/windows/local/52624.txt:20Requirements
- Local access to a Windows system with ProtonVPN v4.4.1 installed
exploits/windows/local/52624.txt:1
Observed behavior
- Queries the configuration of the 'ProtonVPN WireGuard' service using sc.exe to display its binary path, revealing an unquoted service path vulnerability.
exploits/windows/local/52624.txt:20-29
Behaviors behind the backdoor verdict
Observables
- Vulnerability Disclosure
- Payload withheldThe PoC demonstrates that the service binary path contains spaces and is not quoted, which is a known local privilege escalation technique if an attacker can place a malicious executable in the path.
exploits/windows/local/52624.txt:27-29
What the analysis did not establish
- The artifact is a single text file with no executable code; it only contains a description and a service query command.
- Review is limited to the supplied text file; no external tools, libraries, or referenced resources were analyzed.
- The artifact is a text file describing a vulnerability; no executable code is present to analyze for hidden behavior.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.