JFrog Artifactory Join-Key Admin RCE (CVE-2026-82329)

Exploits CVE-2026-82329 in JFrog Artifactory: default blank cluster join key allows forging an HS256 JWT and obtaining admin access via POST /access/api/v1/registry/join, then executes commands through the system API. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog Artifactory blank join-key...

Zammad Session Fixation RCE (CVE-2026-102489)

Exploits CVE-2026-102489 in Zammad 6.3.0–6.5.4: session fixation allows hijacking an authenticated session and achieving remote code execution as the zammad service user via admin scheduler/trigger APIs. Chain with CVE-2026-102490 for root privilege escalation. !/usr/bin/env python3 -- coding:...

TeamCity Path Traversal Auth Bypass (CVE-2024-27199)

Exploits CVE-2024-27199 in JetBrains TeamCity: path traversal to /admin/diagnostic.jsp exposes debug logging and limited admin actions without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """JetBrains TeamCity path traversal auth bypass CVE-2024-27199.""" from kittysploit import from...

ASUS DSL-AC88U Auth Bypass (CVE-2024-3080)

Exploits CVE-2024-3080 in ASUS DSL-AC88U: /js/..%2f%2f or /images/..%2f%2e traversal bypasses authentication and exposes admin wizard pages. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS DSL-AC88U path traversal auth bypass CVE-2024-3080.""" from kittysploit import from...

TOTOLINK A3002RU Credential Leak (CVE-2018-13317)

Exploits CVE-2018-13317 in TOTOLINK A3002RU 1.0.8: unauthenticated GET to /password.htm exposes plaintext admin username and password in JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """TOTOLINK A3002RU password.htm leak CVE-2018-13317.""" import re from kittysploit import from...

D-Link DIR-868L Credential Leak (CVE-2019-17506)

Exploits CVE-2019-17506 in D-Link DIR-868L/817LW: unauthenticated POST to getcfg.php with AUTHORIZEDGROUP newline injection returns admin credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-868L getcfg credential leak CVE-2019-17506.""" from kittysploit import from...

TeamCity Auth Bypass Admin Creation (CVE-2024-27198)

Exploits CVE-2024-27198 in JetBrains TeamCity: alternate servlet path /hax?jsp=/app/rest/... bypasses authentication to create an administrator account via the REST users API. !/usr/bin/env python3 -- coding: utf-8 -- """JetBrains TeamCity authentication bypass admin creation CVE-2024-27198."""...

ASUS GT-AC2900 Auth Bypass (CVE-2021-32030)

Exploits CVE-2021-32030 in ASUS GT-AC2900: asustoken null-byte cookie with asusrouter User-Agent grants unauthenticated admin API access. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS GT-AC2900 null-byte auth bypass CVE-2021-32030.""" import json from kittysploit import from...

TBK DVR Auth Bypass (CVE-2018-9995)

Exploits CVE-2018-9995 in TBK/rebranded DVRs: Cookie uid=admin bypasses auth and /device.rsp?opt=user&cmd=list returns all user credentials in JSON. !/usr/bin/env python3 -- coding: utf-8 -- """TBK DVR cookie auth bypass credential leak CVE-2018-9995.""" import json from kittysploit import from...

Cisco SD-WAN Manager Auth Bypass (CVE-2026-76504)

Exploits CVE-2026-76504 in Cisco Catalyst SD-WAN Manager: POST to a percent-encoded /jsecuritycheck path bypasses WildFly authentication constraints and yields an admin-level JSESSIONID, enabling full vManage API access and device template deployment. !/usr/bin/env python3 -- coding: utf-8 --...

Ivanti Connect Secure Command Injection (CVE-2024-21887)

Chains CVE-2023-46805 path traversal auth bypass with CVE-2024-21887 command injection via /api/v1/totp/user-backup-code/../../admin/config/set on Ivanti Connect Secure / Policy Secure gateways. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure auth bypass + command injection...

RomPager Misfortune Cookie Auth Bypass (CVE-2014-9222)

Exploits CVE-2014-9222 in Allegro RomPager: malformed C107373883 cookie bypasses authentication on embedded device admin interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Allegro RomPager Misfortune Cookie auth bypass CVE-2014-9222.""" from kittysploit import from...

MajorDoMo Admin Console RCE (CVE-2026-27174)

Exploits CVE-2026-27174 in MajorDoMo: unauthenticated access to the admin PHP console via /admin.php?ajaxpanel=1&op=console&command= allows arbitrary PHP/code execution. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo unauthenticated admin console PHP execution CVE-2026-27174.""" import re...

Linksys E2000 Auth Bypass (CVE-2024-27497)

Exploits CVE-2024-27497 in Linksys E2000 1.0.06: unauthenticated access to /position.js leaks sessionkey and admin interface paths. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E2000 position.js auth bypass CVE-2024-27497.""" from kittysploit import from lib.protocols.http.httpclient impo...

Ivanti CSA Auth Bypass (CVE-2024-8963)

Exploits CVE-2024-8963 in Ivanti Cloud Services Appliance 4.6 Patch 519: path traversal via index.php%3F.php/gsb/users.php exposes admin user management. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti CSA path traversal auth bypass CVE-2024-8963.""" from kittysploit import from...

Exploit for CVE-2026-41875

CVE-2026-41875 – Quick.Cart CSRF Admin Credential Change + Sto...

Exploit for CVE-2026-41875

CVE-2026-41875 – Quick.Cart CSRF Admin Credential Change + Sto...

CVE-2026-59788

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2026-59788 Stored XSS vulnerability in OAuth configuration form

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

EUVD-2026-92400

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...