K000161970: Golang vulnerability CVE-2025-22869

Security Advisory Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. CVE-2025-22869 Impact An attack...

Restricted Shell Audit

Identify restricted or atypical shell constraints, escape-capable binaries, sudo posture, and writable PATH risks from kittysploit import import re class ModulePost: info = "name": "Restricted Shell Audit", "description": "Identify restricted or atypical shell constraints, escape-capable binaries...

Shell Capability Profiler

Fingerprint an unusual shell and list available interpreters, transfer tools, TTY support, and execution constraints from kittysploit import class ModulePost: info = "name": "Shell Capability Profiler", "description": "Fingerprint an unusual shell and list available interpreters, transfer tools,...

Slack Socket Mode Polling Shell

Uses Slack Socket Mode as a command/result transport for lab agents. !/usr/bin/env python3 -- coding: utf-8 -- import time from kittysploit import try: from slackbolt import App from slackbolt.adapter.socketmode import SocketModeHandler SLACKAVAILABLE = True except Exception: App =...

PostgreSQL NOTIFY Shell Listener

C2 over PostgreSQL LISTEN/NOTIFY channels. !/usr/bin/env python3 -- coding: utf-8 -- import json import select import threading import time from kittysploit import class ModuleListener: info = "name": "PostgreSQL NOTIFY Shell Listener", "description": "C2 over PostgreSQL LISTEN/NOTIFY channels.",...

PHP Command Shell, Reverse TCP

Connect back and create a command shell via PHP from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Command Shell, Reverse TCP', 'description': 'Connect back and create a command shell via PHP', 'category': PayloadCategory.SINGLE, 'arch': Arch.PHP, 'platform':...

Reverse MQTT Shell Listener

Command/result C2 over MQTT topics, separate from the generic MQTT pub/sub listener. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import time from kittysploit import class ModuleListener: info = "name": "Reverse MQTT Shell Listener", "description": "Command/result C2 over...

PHP Command Shell, Bind TCP

Listen on the target and expose a command shell via PHP from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Command Shell, Bind TCP', 'description': 'Listen on the target and expose a command shell via PHP', 'category': PayloadCategory.SINGLE, 'arch': Arch.PHP,...

CVE-2026-11979

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

CVE-2026-11979

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

UBUNTU-CVE-2026-11979

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

CVE-2026-11979 Stack-Based Buffer Overflow in libxml2

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

CVE-2026-11979 Stack-Based Buffer Overflow in libxml2

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

EUVD-2026-40092

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

CVE-2026-11979

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

CVE-2026-11979

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow intern...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow in the xmlcatalog process when operating in shell mode. An attacker can cause memory corruption, application crash, or execute arbitrary code by supplying an excessively long input line. Remediation A fix was pushed into...

Unix Command Shell, Bind TCP (via Perl)

Listen on the target and expose an interactive command shell via Perl IO::Socket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Bind TCP via Perl', 'description': 'Listen on the target and expose an interactive command shell via Perl IO::Socket', 'author':...

Unix Command Shell, Reverse TCP (via Ruby)

Connect back and create a command shell via Ruby TCPSocket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Reverse TCP via Ruby', 'description': 'Connect back and create a command shell via Ruby TCPSocket', 'author': 'KittySploit Team', 'category':...

PYSEC-2026-544 MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

Summary The logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands including...