PDF XXE Payload Generator

Generate PDFs with XML external entity callbacks in XMP metadata, XFA forms, Acrobat JavaScript XMLData.parse, and OOB parameter entities targeting server-side parsers PDFBox, iText, Apache Tika. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

PDF CVE-2018-5158 PDF.js PostScript Staged Delivery

Generate CVE-2018-5158 PDF with PostScript calculator JavaScript injection and staged payloads callback, fetch+eval, WebSocket. Uses CALLBACKURL. For authorized testing against legacy Firefox PDF.js 60. !/usr/bin/env python3 -- coding: utf-8 -- from pathlib import Path from typing import List fro...

PDF CVE-2014-8452 XMLData XXE Callback

Generate PDF PoC for CVE-2014-8452: Acrobat JavaScript XMLData.parse external entity resolution phone-home. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.javascript import writejsxxexmldata class ModuleAuxiliary,...

PDF JavaScript Callback Generator

Generate PDFs with JavaScript phone-home payloads for Acrobat, Foxit, PDF.js and browser contexts. Includes OpenAction, annotation triggers, widget buttons, submitForm exfiltration, and per-API isolated test cases getURL, launchURL, SOAP, fetch, XHR, WebSocket, staged loaders. !/usr/bin/env pytho...

PDF CVE-2018-5158 PDF.js PostScript Injection

Generate PDF PoC for CVE-2018-5158: JavaScript injection via /FunctionType 4 PostScript calculator in PDF.js. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writepdfjspostscriptjs class...

History Dump

Collect navigation history signals available to JavaScript Performance API, referrer, history.length from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "History Dump", "description": "Collect navigation history signals available to JavaScript Performance API, referre...

PDF CVE-2024-4367 PDF.js FontMatrix RCE PoC

Generate PDF PoC for CVE-2024-4367: arbitrary JavaScript via unsanitized Type1 FontMatrix in PDF.js fetch callback for validation. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writepdfjsfontmatrix...

CVE-2026-41877

CVE-2026-41877 affects R-SOFT DMS. It is a Stored XSS in the file upload functionality: an authenticated attacker could inject arbitrary HTML/JS into the uploaded file’s name, which would be executed when other users view the file list or upload status. The issue has been fixed in version v3.19-2...

CVE-2026-41877 Stored XSS in R-SOFT DMS

R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inject arbitrary HTML and JS into the name of the file being uploaded, which will be executed when visiting file list or upload status by other users. This issue was fixed in version v3.19-2832 and...

CVE-2026-15026

The CVE concerns the WordPress plugin “Import and export users and customers” (versions

js-yaml: js-yaml: Denial of Service via crafted YAML merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker can exploit this vulnerability by providing a specially crafted YAML document that repeatedly uses the same alias in a merge sequence. This can lead to algorithmic CPU exhaustion, causing the Node.js worker or eve...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

DoS (Denial of Service) serialize-javascript Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

SUSE CVE-2026-59923

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...

PT-2026-57324

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single...

PT-2026-57265

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2 Description CommonMark escapes raw HTML but fails to sanitize javascript: URIs within Markdown hyperlinks. This allows a user with assets.edit permissions to insert a malicious link into a markdown-textarea...

CVE-2026-55665: Improper Neutralization of Input During Web Page Generation

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single...

CVE-2026-55466: Improper Neutralization of Input During Web Page Generation

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline, allowing a low-privilege user to upload active...

CVE-2026-57213: Improper Neutralization of Input During Web Page Generation

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmqfederationmanagement plugin renders the consumertag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute...

CVE-2026-57214: Improper Neutralization of Input During Web Page Generation

RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange...