TCExam - Unauthenticated File Upload RCE (CVE-2010-2153)

Exploits CVE-2010-2153 by uploading a PHP shell via tcefunctionstcecodeeditor.php into /cache/. !/usr/bin/env python3 -- coding: utf-8 -- """TCExam unauthenticated upload RCE CVE-2010-2153.""" import re from random import randint from kittysploit import from lib.protocols.http.httpclient import...

NUUO NVRmini 2 - Unauth handle_import_user Detection (CVE-2022-23227)

NUUO NVRmini 2 devices expose /handleimportuser.php without authentication CVE-2022-23227 / related CVE-2011-5325 upload surface. Detection matches the Greenbone active check response fingerprint. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 unauthenticated handleimportuser.php...

libupnp - Unauth POST Write Detection (CVE-2016-6255)

Detects CVE-2016-6255 by POSTing a test file to the web root and retrieving it. !/usr/bin/env python3 -- coding: utf-8 -- """libupnp unauthenticated POST write CVE-2016-6255.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

jQuery File Upload - Unauth Upload RCE Detection (CVE-2018-9206)

Detects CVE-2018-9206 by uploading a PHP one-liner via blueimp jQuery-File-Upload endpoints and executing id. !/usr/bin/env python3 -- coding: utf-8 -- """Blueimp jQuery File Upload unauthenticated RCE CVE-2018-9206.""" import re from urllib.parse import urlparse from kittysploit import from...

Apache Tomcat - PUT JSP Upload Detection (CVE-2017-12615/12617)

Detects CVE-2017-12615/12617 by PUT-uploading a JSP via trailing-slash path and verifying execution on GET. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat HTTP PUT JSP upload RCE CVE-2017-12615 / CVE-2017-12617.""" from kittysploit import from lib.protocols.http.httpclient import...

Apache Tomcat - PUT JSP Upload RCE (CVE-2017-12617)

Uploads a JSP webshell via Tomcat PUT trailing-slash bypass CVE-2017-12615/12617 and opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat PUT JSP upload RCE CVE-2017-12617 — opens execute session.""" import re from kittysploit import from...

FreePBX - Music Upload Filename RCE

Exploits FreePBX music module by injecting shell into multipart filename $CMD.wav on /admin/ajax.php?module=music&command=upload. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX music module filename RCE — opens execute session.""" import re from kittysploit import from...

SolarWinds Storage Manager - ProcessFileUpload Detection

Detects unauthenticated JSP upload via /images/../jsp/ProcessFileUpload.jsp path traversal auth filter bypass. !/usr/bin/env python3 -- coding: utf-8 -- """SolarWinds Storage Manager ProcessFileUpload.jsp auth bypass upload.""" from kittysploit import from lib.protocols.http.httpclient import...

OpenCart - FCKeditor Connector Arbitrary Upload Detection

Detects OpenCart = 1.3.2 FCKeditor connector upload by uploading a marker file. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenCart = 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenCart -...

TikiWiki - jhot.php Upload Detection (CVE-2006-4602)

Detects CVE-2006-4602 by uploading a PHP file via /jhot.php and verifying phpinfo under /img/wiki/. !/usr/bin/env python3 -- coding: utf-8 -- """TikiWiki jhot.php arbitrary PHP upload CVE-2006-4602.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-19089

The Product Input Fields for WooCommerce WordPress plugin (versions prior to 2.0.2 ) is vulnerable to an unauthenticated arbitrary file upload due to a lack of file type validation. If the accepted-types setting is left empty—a configuration documented to accept all files—attackers can upload arb...

CVE-2026-16985 Squeeze < 1.7.12 - Author+ Arbitrary File Upload

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-16985

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-16985 Squeeze < 1.7.12 - Author+ Arbitrary File Upload

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

EUVD-2026-55014

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-16985

The Squeeze WordPress plugin versions prior to 1.7.12 is vulnerable to an arbitrary file upload flaw. The issue stems from a failure to validate the file type or extension of per-size image data during certain attachment-update actions. This allows users with the upload_files capability (Author l...

CVE-2026-17019

The JetEngine WordPress plugin (versions prior to 3.8.13.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize uploaded SVG files before they are stored and served, combined with inadequate restrictions on who can perform uploads. This allows unauthent...

CVE-2026-17019 JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...