Adobe Acrobat JavaScript Reverse Shell PDF

Generate a PDF with Acrobat OpenAction JavaScript that launches a framework-generated reverse-shell payload PowerShell by default. By default only the PDF is generated disablePayloadHandler=true; set disablePayloadHandler false to listen immediately after generation. Requires Adobe Acrobat/Reader...

PDF CVE-2017-10951 Foxit getURL Callback

Generate PDF PoC for CVE-2017-10951: Foxit Reader JavaScript this.getURL phone-home on document open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.javascript import writefoxitgeturljs class ModuleAuxiliary,...

PDF CVE-2018-5158 PDF.js PostScript Injection

Generate PDF PoC for CVE-2018-5158: JavaScript injection via /FunctionType 4 PostScript calculator in PDF.js. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writepdfjspostscriptjs class...

PDF CVE-2024-4367 PDF.js FontMatrix RCE PoC

Generate PDF PoC for CVE-2024-4367: arbitrary JavaScript via unsanitized Type1 FontMatrix in PDF.js fetch callback for validation. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writepdfjsfontmatrix...

PDF CVE-2024-4367 PDF.js Staged Delivery

Generate a CVE-2024-4367 FontMatrix PDF with staged JavaScript for authorized testing: callback, fetch+eval stager, or WebSocket C2. Uses CALLBACKURL not LHOST. PDF.js runs in a browser sandbox — for OS reverse shells use exploits/multi/fileformat/ with framework PAYLOAD. !/usr/bin/env python3 --...

PDF JavaScript Callback Generator

Generate PDFs with JavaScript phone-home payloads for Acrobat, Foxit, PDF.js and browser contexts. Includes OpenAction, annotation triggers, widget buttons, submitForm exfiltration, and per-API isolated test cases getURL, launchURL, SOAP, fetch, XHR, WebSocket, staged loaders. !/usr/bin/env pytho...

PDF CVE-2014-8452 XMLData XXE Callback

Generate PDF PoC for CVE-2014-8452: Acrobat JavaScript XMLData.parse external entity resolution phone-home. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.javascript import writejsxxexmldata class ModuleAuxiliary,...

PDF CVE-2025-59803 Foxit OCG Signing Trigger

Generate PDF PoC for CVE-2025-59803: JavaScript in /AA /WP and /DP fires during Foxit digital signing workflow OCG. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writefoxitocgsigningjs class...

PDF CVE-2018-5158 PDF.js PostScript Staged Delivery

Generate CVE-2018-5158 PDF with PostScript calculator JavaScript injection and staged payloads callback, fetch+eval, WebSocket. Uses CALLBACKURL. For authorized testing against legacy Firefox PDF.js 60. !/usr/bin/env python3 -- coding: utf-8 -- from pathlib import Path from typing import List fro...

PDF XXE Payload Generator

Generate PDFs with XML external entity callbacks in XMP metadata, XFA forms, Acrobat JavaScript XMLData.parse, and OOB parameter entities targeting server-side parsers PDFBox, iText, Apache Tika. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

History Dump

Collect navigation history signals available to JavaScript Performance API, referrer, history.length from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "History Dump", "description": "Collect navigation history signals available to JavaScript Performance API, referre...

JS Source Map Analyzer

Download client JS bundles, follow sourceMappingURL references, parse .map files, and extract decompiled sources, API routes, and secret literals. !/usr/bin/env python3 -- coding: utf-8 -- """ JavaScript source map analyzer — recover decompiled/original sources from .map files. Fetches bundled .j...

CVE-2026-41877

CVE-2026-41877 affects R-SOFT DMS. It is a Stored XSS in the file upload functionality: an authenticated attacker could inject arbitrary HTML/JS into the uploaded file’s name, which would be executed when other users view the file list or upload status. The issue has been fixed in version v3.19-2...

CVE-2026-41877 Stored XSS in R-SOFT DMS

R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inject arbitrary HTML and JS into the name of the file being uploaded, which will be executed when visiting file list or upload status by other users. This issue was fixed in version v3.19-2832 and...

CVE-2026-15026

The CVE concerns the WordPress plugin “Import and export users and customers” (versions

js-yaml: js-yaml: Denial of Service via crafted YAML merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker can exploit this vulnerability by providing a specially crafted YAML document that repeatedly uses the same alias in a merge sequence. This can lead to algorithmic CPU exhaustion, causing the Node.js worker or eve...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

DoS (Denial of Service) serialize-javascript Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

SUSE CVE-2026-59923

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...

PT-2026-57324

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single...