motionEye CVE-2025-60787 root command injection

CVE-2025-60787 motionEye /set with imagefilename $cmd — executed as root on the next interval snapshot. signingkey must be the SHA1 of the admin password same value stored as @adminpassword in motion.conf. !/usr/bin/env python3 -- coding: utf-8 -- """motionEye CVE-2025-60787 authenticated...

UnrealIRCd CVE-2010-2075 backdoor RCE

CVE-2010-2075: trojaned UnrealIRCd 3.2.8.1 executes any line starting with AB; as shell via system without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """UnrealIRCd CVE-2010-2075 trojaned backdoor AB; command execution.""" from future import annotations import socket import time fro...

Erlang OTP SSH CVE-2025-32433 pre-auth RCE

CVE-2025-32433: vulnerable Erlang/OTP SSH servers accept SSHMSGCHANNELREQUEST exec before authentication completes. Sends a file:writefile/2 Erlang snippet default writes /tmp/erlangpwned. !/usr/bin/env python3 -- coding: utf-8 -- """Erlang/OTP SSH CVE-2025-32433 pre-auth SSH channel exec...

Citrix NetScaler CVE-2026-88772 DTLS Overflow Trigger

Sends the malformed DTLS handshake fragment sequence from public CVE-2026-88772 research leviathan-offsec/lvx-vuln-research: each fragment declares fragmentlength=1 while carrying a larger payload, driving NSPPE reassembly accounting into a fixed scratch buffer overflow. This is a vulnerability...

Anuko Time Tracker CVE-2022-24707 puncher SQLi

CVE-2022-24707 Anuko = 1.20.0.5640: authenticated SQLi in puncher.php date parameter writes ttusers credentials into the entry note field. !/usr/bin/env python3 -- coding: utf-8 -- """Anuko Time Tracker CVE-2022-24707 puncher date SQLi credential extract.""" from future import annotations import ...

Cacti CVE-2025-24367 graph template RCE

CVE-2025-24367 Cacti = 1.2.28: newline injection in graph template rightaxislabel breaks out of rrdtool arguments and writes PHP to the web root. Authenticated; plants a ?c= webshell and runs the given command. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti CVE-2025-24367 authenticated...

Adobe ColdFusion CVE-2009-2265 FCKeditor upload RCE

CVE-2009-2265: unauthenticated FCKeditor upload.cfm with null-byte CurrentFolder bypass drops JSP under /userfiles/file/ for cmd execution. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion 8 CVE-2009-2265 FCKeditor unauth upload RCE.""" from future import annotations from kittysploit...

crawl4ai CVE-2026-91940 arbitrary file write

CVE-2026-91940 crawl4ai 0.9.3: POST /crawl with PDFContentScrapingStrategy and attacker-controlled imagesavedir writes extracted image streams to disk. Hosts a minimal PDF on lhost:lport and triggers /crawl. Patched versions return HTTP 400 not permitted. Requires API token on 0.9.2. !/usr/bin/en...

GitPython CVE-2022-24439 ext URL RCE

CVE-2022-24439 GitPython = 3.1.29: malicious ext::sh clone URL runs shell commands when an HTTP app passes user input to clonefrom with protocol.ext.allow=always. !/usr/bin/env python3 -- coding: utf-8 -- """GitPython CVE-2022-24439 ext:: transport RCE via clone URL injection.""" from future impo...

HFS CVE-2014-6287 search macro RCE

CVE-2014-6287 HttpFileServer 2.3–2.3c: NUL-byte desync in the search handler allows .exec|cmd. macro execution without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Rejetto HFS CVE-2014-6287 unauthenticated search macro command execution.""" from future import annotations from...

image-downloader CVE-2026-103648 path traversal

CVE-2026-103648 npm image-downloader 4.3.1: when a Node app passes a user-controlled URL to download.image, percent-encoded ../ in the URL path survives basename and writes outside the intended dest directory. Starts a short-lived payload HTTP server on lhost:lport and triggers GET...

Keycloak CVE-2026-18963 reset-credentials bypass

CVE-2026-18963 Keycloak 26.0.0–26.7.1: re-navigation to reset-credentials re-opens the authentication selector and reset-credential-email accepts success without the emailed action token. Default: detect-only; set confirm=true to overwrite the target user's password destructive ATO. !/usr/bin/env...

Joomla DJ-Classifieds CVE-2026-61424 arbitrary upload

CVE-2026-61424 DJ-Classifieds . !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-61424 — Joomla DJ-Classifieds unauthenticated imageupload write.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.joomlaprobe import Joomla class...

Laravel CVE-2018-15133 APP_KEY RCE

CVE-2018-15133: with the base64 APPKEY, forge an encrypted X-XSRF-TOKEN cookie that deserializes to Illuminate gadget chains calling system on attacker-controlled input. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel CVE-2018-15133 APPKEY decrypt cookie deserialization RCE.""" from future...

AWS Loom CVE-2026-103956 unauthenticated super-admin

CVE-2026-103956 Loom for AWS 1.6.1: when Cognito / external IdP is unset, getcurrentuser grants t-admin / g-admins-super without Authorization. Confirms via GET /api/auth/me and optional read-only MCP server listing. !/usr/bin/env python3 -- coding: utf-8 -- """AWS Loom for AWS unauthenticated...

Metabase CVE-2026-72898 reset_password SQLi

CVE-2026-72898: unauthenticated POST /api/session/resetpassword accepts user-id :raw SQL for stacked queries on PostgreSQL app DB — creates superuser and opens Metabase HTTP session. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2026-72898 resetpassword HoneySQL injection admin...

Magento CVE-2015-1398 tunnel unserialize RCE

CVE-2015-1398 Magento CE = 1.9.0.1: admin dashboard tunnel unserializes ?ga= POP chain to system; blind — read output file or use sleep oracle. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CE CVE-2015-1398 authenticated POP chain tunnel RCE blind.""" from future import annotations import...

Next.js CVE-2024-34351 Server Actions SSRF

CVE-2024-34351 Next.js 13.4.0–14.1.0: Host-header Server Action redirect SSRF. Starts a local relay HEAD text/x-component, GET 302 to internalurl and POSTs with Next-Action to fetch internal content. !/usr/bin/env python3 -- coding: utf-8 -- """Next.js CVE-2024-34351 Server Actions SSRF via...

OpenSTAManager CVE-2025-69212 P7M import RCE

CVE-2025-69212 OpenSTAManager = 2.9.8: authenticated importFEZIP upload passes unsanitized .p7m entry names into openssl exec, enabling shell command injection ZIP names must avoid '/' characters. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSTAManager CVE-2025-69212 P7M filename command...

pdfminer.six CVE-2025-64512 polyglot RCE

CVE-2025-64512: malicious gzip+PDF polyglot deserializes pickle when a service runs pdf2txt/pdfminer on attacker-uploaded files. !/usr/bin/env python3 -- coding: utf-8 -- """pdfminer.six CVE-2025-64512 pickle polyglot PDF gzip RCE.""" from future import annotations import gzip import pickle from...