23 matches found
CVE-2021-43798
CVE-2021-43798 CVE-2021-43798 is a vulnerability marked as High priority CVSS 7.5 leading to arbitrary file read via installed plugins in Grafana application. This vulnerability works on versions 8.0.0-beta1, 8.0.0 to 8.3.0. Tested only on 8.2.0. Exploit works by creating a list of vulnerable...
EUVD-2026-101594
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...
CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...
EUVD-2026-98826
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...
CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...
CVE-2026-103928
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...
CVE-2026-103928
The business intelligence platform Metabase is vulnerable to arbitrary file read and write in versions 1.55.0 through 1.58.16, 1.59.13, 1.60.9, and 1.61.4. The root cause is the failure to restrict host-facing built-in functions when processing native queries or actions against an H2 data source ...
CVE-2026-103928: External Control of File Name or Path
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...
TVT NVMS-1000 Path Traversal (CVE-2019-20085)
Exploits CVE-2019-20085 in TVT NVMS-1000: GET /..%2F traversal reads arbitrary files from the DVR/NVR host. !/usr/bin/env python3 -- coding: utf-8 -- """TVT NVMS-1000 path traversal LFI CVE-2019-20085.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...
Caucho Resin - Legacy WEB-INF Path Traversal Detection
Detects classic Caucho Resin path-traversal tricks that expose WEB-INF/resin-web.xml: /.jsp/WEB-INF/ CVE-2001-0399, /WEB-INF../ CVE-2004-0281, and /%20../WEB-INF/ CVE-2007-2440. !/usr/bin/env python3 -- coding: utf-8 -- """Caucho Resin legacy WEB-INF path traversal CVE-2001-0399 / 2004-0281 /...
DirPHP - phpfile LFI Detection (CVE-2014-5115)
Detects CVE-2014-5115 by requesting index.php?phpfile=/etc/passwd on DirPHP. !/usr/bin/env python3 -- coding: utf-8 -- """DirPHP phpfile local file inclusion CVE-2014-5115.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...
ASUS RT - AICloud smb Traversal Detection (CVE-2013-4937)
Detects CVE-2013-4937 by requesting /smb/tmp/etc/shadow and matching passwd-style entries. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS RT AICloud smb path traversal CVE-2013-4937.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...
SharpHound Collect (optional external)
OPTIONAL: requires SharpHound.exe in data/assemblies/. Prefer native LDAP/GPO modules scanner/ldap/, post/ldap/gather/ for AD mapping. When you need a full CE-style zip: loadmodule SharpHound, pull loot, set bloodhoundexportpath, merge into attackgraph, optional BHCE upload. !/usr/bin/env python3...
Xceedium Xsuite - read_sessionlog LFI Detection
Detects Xceedium Xsuite LFI via /opm/readsessionlog.php?logFile=....//etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Xceedium Xsuite readsessionlog.php LFI CVE-2015-4666.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...
WinRM Download File
Download a remote file through an active WinRM session pypsrp fetch !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Download File",...
CVE-2026-24457
An unsafe parsing of OpenMQ's configuration in OpenMQ versions 6.5.2 and 6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ...
PHP 7.1-7.3 disable_functions bypass
PHP 7.1-7.3 json disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.1-7.3 disablefunctions bypass", "description": "PHP 7.1-7.3 json disablefunctions bypass", "arch": Arch.PHP,...
PHP 7.0-7.4 disable_functions bypass
PHP 7.0-7.4 disablefunctions bypass 7.0 - all versions 7.1 - all versions 7.2 - all versions 7.3 7.3.15 7.4 7.4.3 from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.0-7.4 disablefunctions bypass",...
