Xerox EFI Fiery Webtools LFI File Read

Reads arbitrary files via forceSave.php on Xerox DC260 EFI Fiery Controller Webtools 2.0. !/usr/bin/env python3 -- coding: utf-8 -- """Xerox EFI Fiery Controller Webtools forceSave.php pre-auth LFI file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

HP JetDirect PJL Filesystem Read (port 9100)

Reads files and lists directories on network printers exposing raw JetDirect/AppSocket on TCP 9100 via PJL FSUPLOAD/FSDIRLIST. !/usr/bin/env python3 -- coding: utf-8 -- """HP JetDirect / raw printing port 9100 PJL filesystem read and listing.""" import socket from typing import Optional from...

PaperCut Path Traversal File Read (CVE-2023-39143)

Reads files from unpatched PaperCut NG/MF on Windows 22.1.3 via CustomReportExample path traversal. Optional WebDAV COPY stages unreadable paths into data/scan/webdav before download. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-39143 — PaperCut NG/MF Windows path traversal file read."""...

CVE-2026-72572 o1lab xmysql - Unauthenticated Path Traversal via name Query Parameter

A path traversal vulnerability in o1lab/xmysql all versions allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.joincwd, name without sanitization before...

CVE-2026-72571 mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter

A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...

ManageEngine SDP - FILENAME Traversal Detection (CVE-2011-2757)

Detects CVE-2011-2757 via FileDownload.jsp?module=agent&FILENAME=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-2757 via FileDownload.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

HP Systems Insight Manager - logfile File Read Detection (CVE-2010-3286)

Detects CVE-2010-3286 via HEAD switchFWInstallStatus.jsp?logfile=/etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-3286 via HEAD switchFWInstallStatus.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclien...

Buffalo LinkStation - Arbitrary File Read (CVE-2025-26167)

Buffalo LinkStation exposes /rpc/cat/?inter=1 without authentication, allowing unauthenticated arbitrary file reads password hashes, configs, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo LinkStation unauthenticated arbitrary file read via /rpc/cat/ CVE-2025-26167.""" import re from...

Play Framework - public Path Traversal File Read

Reads arbitrary files via Play Framework /public/..%2f traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via Play Framework /public/.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

Tautulli < 2.16.0 - Unauthenticated Path Traversal (CVE-2025-58760)

Tautulli prior to 2.16.0 allows unauthenticated arbitrary file read via /image/images/ and /pmsimageproxy?img=... CVE-2025-58760 / CVE-2025-58761. !/usr/bin/env python3 -- coding: utf-8 -- """Tautulli unauthenticated path traversal file read CVE-2025-58760 / CVE-2025-58761.""" import re from...

EMC CTA - XXE File Read Detection (CVE-2014-0644)

Detects CVE-2014-0644 by POSTing XXE to /api/login with Password= pointing at file:///etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """EMC Cloud Tiering Appliance XXE file read CVE-2014-0644.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

BlueDragon - cfchart Path Traversal Detection (CVE-2014-5370)

Detects CVE-2014-5370 by requesting /cfchart.cfchart?../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """BlueDragon CFChart servlet path traversal CVE-2014-5370.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

HiSilicon Encoder - Path Traversal Detection (CVE-2020-24219)

Detects CVE-2020-24219 by reading /etc/passwd via /../../sys/devices/media/13070000.jpgd/../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """HiSilicon encoder /sys/devices/media path traversal CVE-2020-24219.""" import re from kittysploit import from lib.protocols.http.httpclient...

ARRIS Router - Arbitrary File Read Detection (CVE-2022-31793)

Multiple ARRIS routers expose arbitrary files via GET /a/ without authentication CVE-2022-31793. !/usr/bin/env python3 -- coding: utf-8 -- """ARRIS router arbitrary file read via /a/ CVE-2022-31793.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ARRIS Router - Arbitrary File Read (CVE-2022-31793)

Reads arbitrary files from ARRIS routers via GET /a/ CVE-2022-31793. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ARRIS router arbitrary file read via /a/ CVE-2022-31793.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

CasaOS - Arbitrary File Read via users/image (CVE-2024-24765)

Reads arbitrary files through CasaOS-UserService /v1/users/image?path= CVE-2024-24765, fixed in 0.4.7. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS arbitrary file read via /v1/users/image CVE-2024-24765.""" import re from kittysploit import from...

nostromo nhttpd - Directory Traversal File Read (CVE-2011-0751)

Reads arbitrary files via CVE-2011-0751 /..%2f traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2011-0751 /.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class ModuleAuxiliary, Httpclien...

Apache Axis2 - xsd Path Traversal Detection

Detects Axis2 service ?xsd=../conf/axis2.xml traversal by matching axisconfig AxisJava2.0 in the response. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Axis2 ?xsd= path traversal to axis2.xml.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

VMware - SDK Directory Traversal Detection (CVE-2009-3733)

Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port.""" import re from kittysploit import from...

nostromo nhttpd - Directory Traversal Detection (CVE-2011-0751)

Detects CVE-2011-0751 by requesting /..%2f..%2f..%2f..%2f..%2fetc/passwd and matching root:x:0:0. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-0751 by requesting /.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...