PDF UNC NTLM Callback Generator

Generate PDFs that reference UNC paths to coerce NTLM authentication from Windows PDF viewers. Covers GoToE, XObject streams, GoToR, Thread, URI actions, and Acrobat JavaScript APIs submitForm, getURL, launchURL, SOAP, openDoc. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import fro...

PDF CVE-2025-66516 Tika XFA OOB XXE

Generate PDF PoC for CVE-2025-66516: blind OOB XXE via parameter entity in XFA targeting Apache Tika Confluence, Jira, etc.. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writetikaxfaxxeoob class...

PDF Phone-Home Full Suite

Generate the full KittySploit PDF phone-home suite 70 files with phone-home callbacks for upload-scanner and red-team validation. Covers URI actions, JavaScript, XFA, XXE, UNC/NTLM, and viewer-specific CVE PoCs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf import...

PDF CVE-2024-12426 LibreOffice Expand URI

Generate PDF PoC for CVE-2024-12426: vnd.sun.star.expand URI leaks environment variables $HOME via LibreOffice on open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writelibreofficeexpanduri class...

PDF CVE-2025-59803 Foxit OCG Signing Trigger

Generate PDF PoC for CVE-2025-59803: JavaScript in /AA /WP and /DP fires during Foxit digital signing workflow OCG. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writefoxitocgsigningjs class...

PDF Silent DNS Callback Generator

Generate PDFs with silent DNS/HTTP callbacks via Acrobat catalog additional actions /AA /WC, /WS, /DS that fire on document close or save without user interaction CVE-2020-29075. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfPhonehomeMixin,...

ImageMagick PDF/SVG Polyglot Server-Side RCE

Generate an SVG/MSL polyglot that executes a framework payload when processed by vulnerable ImageMagick/GraphicsMagick delegate chains. By default only the file is generated disablePayloadHandler=true; set disablePayloadHandler false to listen immediately after generation. Upload the generated fi...

PDF Action Callback Generator

Generate PDFs that trigger outbound requests via native PDF actions: /URI, /Launch, /GoToR, /GoToE, /SubmitForm, /ImportData, /Thread, XObject streams, and catalog /Names JavaScript triggers. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

PDF CVE-2020-29075 Silent DNS Callback

Generate PDF PoC for CVE-2020-29075: silent DNS/HTTP via catalog /AA /WC, /WS, /DS without user prompt in Acrobat Reader. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.silent import writesilentdnscatalogaa class...

PDF CVE-2022-28244 RichMedia CSP Bypass

Generate PDF PoC for CVE-2022-28244: RichMedia annotation with embedded HTML/JS bypassing Acrobat CSP for outbound callback. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writerichmediacspbypass...

PDF Polyglot Payload Generator

Generate non-standard PDF polyglots for upload-filter bypass testing: EICAR antivirus test string embedded in PDF, and ImageMagick SVG/MSL polyglot for server-side image processing pipelines. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

PDF XXE Payload Generator

Generate PDFs with XML external entity callbacks in XMP metadata, XFA forms, Acrobat JavaScript XMLData.parse, and OOB parameter entities targeting server-side parsers PDFBox, iText, Apache Tika. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

PDF CVE-2018-20065 PDFium URI No-Gesture

Generate PDF PoC for CVE-2018-20065: /OpenAction /URI navigation without user gesture in PDFium/Chrome. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.actions import writepdfiumopenactionuri class ModuleAuxiliary,...

PDF CVE-2026-25755 jsPDF Object Injection

Generate PDF PoC for CVE-2026-25755: jsPDF addJS object injection with /AA /O auto-action URI callback. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writejspdfobjectinjection class ModuleAuxiliary...

SUSE CVE-2026-59935

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issu...

PT-2026-57179

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.5 Description An authenticated path traversal issue exists in the concatenatePaths function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image...

CVE-2026-57961: Improper Limitation of a Pathname to a Restricted Directory

phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path...

EulerOS 2.0 SP12 : python-pillow (EulerOS-SA-2026-2619)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...

CVE-2026-41482: Improper Limitation of a Pathname to a Restricted Directory

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3...

PT-2026-57362

Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The load data method strips only NUL bytes from a PDF-controlled CMap name, then...