LFI Log Poisoning Probe

Chains LFI confirmation with access-log User-Agent poisoning and re-inclusion to validate log-poison → code execution paths. !/usr/bin/env python3 -- coding: utf-8 -- """ LFI log poisoning probe authorized testing only. Confirms a local file inclusion primitive, poisons a web server access log vi...

Apache .htaccess Persistence

Writes a persistence payload into an Apache .htaccess file. The file acts as a CGI/PHP shell triggered on HTTP access htshells / wireghoul technique. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import os import re from kittysploit import from...

Nginx + PHP-FPM Backdoor

Deploys a hidden PHP webshell and an Nginx snippet conf.d or sites-enabled routing requests to PHP-FPM. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

WordPress Profile Builder Pro PHP object injection detection

Detects Profile Builder Pro = 3.14.5 unauthenticated PHP object injection via wppbrequestuserspins admin-ajax args parameter. Optionally sends a safe stdClass probe; HTTP 500 indicates deserialization of attacker input. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Tuple...

Joomla SP LMS <= 4.1.3 - PHP Object Injection RCE (CVE-2026-48909)

Exploits CVE-2026-48909 in JoomShaper SP LMS comsplms = 4.1.3: unauthenticated PHP object injection via the lmsOrders cookie on the cart view, chaining Joomla FormattedtextLogger to write a webshell. RCE requires Joomla 5.2.2. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotatio...

Joomla SP LMS CVE-2026-48909 (PHP object injection) detection

Detects JoomShaper SP LMS comsplms = 4.1.3 affected by unauthenticated PHP object injection via the lmsOrders cookie CVE-2026-48909. Full RCE requires Joomla 5.2.2 FormattedtextLogger gadget chain. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...

WordPress Profile Builder Pro <= 3.14.5 - PHP Object Injection RCE

Unauthenticated PHP object injection in Profile Builder Pro via the wppbrequestuserspins admin-ajax action args parameter. Full RCE requires a POP gadget chain; this module chains The Events Calendar Monolog ProcessHandler Monolog/RCE10 when that plugin is present. !/usr/bin/env python3 -- coding...

PHP user.ini Persistence

Deploys a PHP webshell via .user.ini autoprependfile / autoappendfile. Works with PHP-FPM and Apache when userini is enabled. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

WordPress Theme/Plugin Dropper

Installs PHP persistence in a WordPress site via must-use plugin, custom plugin, or theme functions.php append. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

PHP HTTP Chunked Mimic Transform

Wraps C2 bytes in HTTP/1.1 chunked transfer frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import from modules.transforms.python.protocol.httpchunked import Module as PythonHttpChunkedTransform class...

PHP HTTPS Mimic Transform

Sends a fake TLS ClientHello then wraps C2 bytes in TLS Application Data records. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.httpsmimic import CLIENTHELLOBYTES, Module as PythonHttpsTransform, class ModulePythonHttpsTransform:...

PHP WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.websocketmimic import Module as PythonWebSocketTransform class ModulePythonWebSocketTransform: """PHP WebSocket...

PHP Base64 Frame Transform

Frames C2 chunks as length-prefixed Base64 lines and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.base64frame import Module as PythonBase64FrameTransform class ModulePythonBase64FrameTransform: """PHP Base64...

PHP XOR Stream Transform

XORs the C2 stream with a repeating key and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.xor import Module as PythonXorTransform class ModulePythonXorTransform: """PHP XOR stream transform."""...

cybersecurity-exam-report

Cybersecurity Exam Project: ProFTPD Exploitation and MySQL Dat...

EUVD-2025-210450

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...

CVE-2025-11977

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...

CVE-2025-11977 HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...

CVE-2026-15070

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This is due to missing or incorrect nonce validation on the setCustomText function. This makes it possible for unauthenticated attackers to inje...

SUSE CVE-2026-59948

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...