mySCADA PRO Runtime — Unauthenticated `upgrade` Branch Command Injection → Root — Detect

Fingerprint / reachability check for mySCADA PRO Runtime — Unauthenticated upgrade Branch Command Injection → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for mySCADA PRO Runtime — Unauthenticated upgrade Branch Command Injection → Root RCE""" from kittysploit import from...

Accusoft / Apryse PrizmDoc for Java (VirtualViewer) 5.22.1 — Unauthenticated `up — Detect

Fingerprint / reachability check for Accusoft / Apryse PrizmDoc for Java VirtualViewer 5.22.1 — Unauthenticated uploadDocument Arbitrary File Write to JSP Webshell to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Accusoft / Apryse PrizmDoc for Java VirtualViewer 5.22.1 —...

ProSoft RLX-IFH24E v2.2.44 - Firmware Upgrade Package Executed Without Any Integ — Detect

Fingerprint / reachability check for ProSoft RLX-IFH24E v2.2.44 - Firmware Upgrade Package Executed Without Any Integrity Check, Reaching Root Command Execution and Full Overwrite of the Account Database CWE-494, CWE-345 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for ProSoft RLX-IFH24...

VitalPBX — Authenticated Root RCE via asterisk_cli → dialplan System() (Privileg — Detect

Fingerprint / reachability check for VitalPBX — Authenticated Root RCE via asteriskcli → dialplan System Privilege Escalation !/usr/bin/env python3 -- coding: utf-8 -- """Detection for VitalPBX — Authenticated Root RCE via asteriskcli → dialplan System Privilege Escalation""" from kittysploit...

Raritan EMX port_mux config injection root RCE

Login → download config → inject protolistenerhttp program=/bin/sh → upload → TCP connect triggers execv as root. """Raritan EMX authenticated portmux protolistener config injection root RCE.""" from future import annotations import re import socket import time import uuid from urllib.parse impor...

Auerswald COMmander provisioning zip-slip root RCE

Unauthenticated POST provisioningdataimport zip-slip overwrites hping2 then POST netdiagnosticexecute runs the replaced binary as root. """Auerswald COMmander provisioning zip-slip → hping2 hijack → unauth root RCE.""" from future import annotations import io import uuid import zipfile import...

Biamp Vocia MS-1 FTPS hardcoded cred root RCE

FTPS ftpsuser/ftpsuser → Bins/ upload filename injection or astmon replacement → mum executes as root. """Biamp Vocia MS-1 Unauthenticated Root RCE via Hardcoded FTPS Credentials""" from future import annotations from kittysploit import from ftplib import FTPTLS, errorperm, errortemp import io...

core-admin escape_param shell injection (bytecode sink)

Loads product security.pyc/command.pyc to craft shell metacharacters for configured sink templates local bytecode lab; use product UI/API on target. """core-admin — Systemic Shell Command Injection via Ineffective Quote Escaping → Authenticated Root RCE""" from future import annotations from...

Edimax BR-6478AC formWlanMP command injection root RCE

HTTP Basic POST /goform/formWlanMP — command substitution in ateFunc or other fields reaches system as root. """Edimax BR-6478AC formWlanMP authenticated command injection root.""" from future import annotations import base64 import re from urllib.parse import urlencode from kittysploit import fr...

TRENDnet TV-IP302PI NTP address command injection RCE

Authenticated CGI/ONVIF SetNTP: msntp -r sink with semicolon/command substitution in NtpIP / hostname field. """TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reaching Root Execution Through a Shell-Form system Call CWE-78""" from future import annotations from types...

Edimax BR-6478AC v2.20 - Authenticated Command Injection in the formWlanMP Manuf — Detect

Fingerprint / reachability check for Edimax BR-6478AC v2.20 - Authenticated Command Injection in the formWlanMP Manufacturing-Test Handler Reaching root Command Execution CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Edimax BR-6478AC v2.20 - Authenticated Command Injection in...

Apache Struts 2 RestfulActionMapper OGNL Injection Unauthenticated Root RCE — Detect

Fingerprint / reachability check for Apache Struts 2 RestfulActionMapper OGNL Injection Unauthenticated Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Apache Struts 2 RestfulActionMapper OGNL Injection Unauthenticated Root RCE""" from kittysploit import from...

ZesleCP admin file write cron root RCE

Admin POST /file-manager/save-file writes /etc/cron.d/ as root; crond executes attacker command. !/usr/bin/env python3 -- coding: utf-8 -- """ZesleCP admin arbitrary file write to /etc/cron.d root RCE.""" from future import annotations import json import re import time from kittysploit import fro...

MultiTech Conduit import_config filename command injection RCE

Authenticated POST /api/command/uploadconfig with malicious filename breaks out of importconfig shell quoting. """MultiTech Conduit AEP importconfig filename command injection root RCE.""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclient import...

nanoDLP Unauthenticated Root RCE via G-code Injection — Detect

Fingerprint / reachability check for nanoDLP Unauthenticated Root RCE via G-code Injection !/usr/bin/env python3 -- coding: utf-8 -- """Detection for nanoDLP Unauthenticated Root RCE via G-code Injection""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

DrayTek Vigor 2960 uploadlangs command injection root RCE

Authenticated language pack upload: filename passes cgiEscape only & then systemmv ... with ; injection. !/usr/bin/env python3 -- coding: utf-8 -- """DrayTek Vigor uploadlangs filename command injection root RCE multi platform.""" from future import annotations import uuid from kittysploit import...

CFEngine Enterprise Nova Hub — VCS Settings Command Injection → Root RCE — Detect

Fingerprint / reachability check for CFEngine Enterprise Nova Hub — VCS Settings Command Injection → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CFEngine Enterprise Nova Hub — VCS Settings Command Injection → Root RCE""" from kittysploit import from...

Wavestore VMS venusd /simple/export command injection RCE

Authenticated venusd /simple/export user=install$cmd runs as root via command substitution default creds install:a on port 8443 plain HTTP. """Wavestore VMS venusd /simple/export command injection root.""" from future import annotations import base64 import re import socket import ssl from...

Opengear NGCS PDU name command injection

Administrator POST /api/v2/pdus with injected pdu.name breaks out of ogpower -n quoting; io.popen runs attacker command as root. !/usr/bin/env python3 -- coding: utf-8 -- """Opengear NGCS PDU name field command injection authenticated root.""" from future import annotations import json import re...

Wavestore VMS venusd /simple/export Command Injection to Root RCE — Detect

Fingerprint / reachability check for Wavestore VMS venusd /simple/export Command Injection to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Wavestore VMS venusd /simple/export Command Injection to Root RCE""" from kittysploit import from lib.protocols.http.httpclient import...