Ontotext GraphDB .pie Ruleset Namespace Prefix Injection Unauthenticated Root RC — Detect

Fingerprint / reachability check for Ontotext GraphDB .pie Ruleset Namespace Prefix Injection Unauthenticated Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Ontotext GraphDB .pie Ruleset Namespace Prefix Injection Unauthenticated Root RCE""" from kittysploit import from...

Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE — Detect

Fingerprint / reachability check for Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE""" from kittysploit import from...

Lantronix EDS3000PR — Authenticated Command Injection in FsUnmount → Root RCE — Detect

Fingerprint / reachability check for Lantronix EDS3000PR — Authenticated Command Injection in FsUnmount → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Lantronix EDS3000PR — Authenticated Command Injection in FsUnmount → Root RCE""" from kittysploit import from...

Lantronix SGX5150 — Authenticated Command Injection in FsBrowseClean → Root RCE — Detect

Fingerprint / reachability check for Lantronix SGX5150 — Authenticated Command Injection in FsBrowseClean → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Lantronix SGX5150 — Authenticated Command Injection in FsBrowseClean → Root RCE""" from kittysploit import from...

Minuteman UPS NMC — Unauthenticated Command Injection in system_param.csp → Root — Detect

Fingerprint / reachability check for Minuteman UPS NMC — Unauthenticated Command Injection in systemparam.csp → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Minuteman UPS NMC — Unauthenticated Command Injection in systemparam.csp → Root RCE""" from kittysploit import from...

MultiTech Conduit AEP — Authenticated Command Injection in `import_config` → Roo — Detect

Fingerprint / reachability check for MultiTech Conduit AEP — Authenticated Command Injection in importconfig → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for MultiTech Conduit AEP — Authenticated Command Injection in importconfig → Root RCE""" from kittysploit import from...

Accusoft / Apryse PrizmDoc for Java (VirtualViewer) 5.22.1 — Unauthenticated `up — Detect

Fingerprint / reachability check for Accusoft / Apryse PrizmDoc for Java VirtualViewer 5.22.1 — Unauthenticated uploadDocument Arbitrary File Write to JSP Webshell to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Accusoft / Apryse PrizmDoc for Java VirtualViewer 5.22.1 —...

StreamSets Transformer 3.17.0 — "none" Authentication Mode Fallback + Un-sandbox — Detect

Fingerprint / reachability check for StreamSets Transformer 3.17.0 — "none" Authentication Mode Fallback + Un-sandboxed ScalaDTransform Code Execution → Anonymous Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for StreamSets Transformer 3.17.0 — "none" Authentication Mode Fallbac...

TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reachi — Detect

Fingerprint / reachability check for TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reaching Root Execution Through a Shell-Form system Call CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Serv...

ZesleCP — Authenticated Arbitrary File Write → Cron → Root RCE — Detect

Fingerprint / reachability check for ZesleCP — Authenticated Arbitrary File Write → Cron → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for ZesleCP — Authenticated Arbitrary File Write → Cron → Root RCE""" from kittysploit import from lib.protocols.http.httpclient import...

Edimax BR-6478AC formWlanMP command injection root RCE

HTTP Basic POST /goform/formWlanMP — command substitution in ateFunc or other fields reaches system as root. """Edimax BR-6478AC formWlanMP authenticated command injection root.""" from future import annotations import base64 import re from urllib.parse import urlencode from kittysploit import fr...

Edimax BR-6478AC setWAN command injection root RCE

HTTP Basic auth POST /goform/setWAN — pppUserName/pptpUserName/L2TPUserName injected into system pipeline as root boa User root. """Edimax BR-6478AC setWAN authenticated command injection root.""" from future import annotations import base64 from urllib.parse import urlencode from kittysploit...

ZesleCP admin file write cron root RCE

Admin POST /file-manager/save-file writes /etc/cron.d/ as root; crond executes attacker command. !/usr/bin/env python3 -- coding: utf-8 -- """ZesleCP admin arbitrary file write to /etc/cron.d root RCE.""" from future import annotations import json import re import time from kittysploit import fro...

atvise SCADA OPC UA Authentication Bypass Unauthenticated Root RCE

atvise SCADA OPC UA Authentication Bypass Unauthenticated Root RCE """atvise SCADA OPC UA Authentication Bypass Unauthenticated Root RCE""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import Httpclient import sys, os, json, random, hashlib,...

Auerswald COMmander provisioning zip-slip root RCE

Unauthenticated POST provisioningdataimport zip-slip overwrites hping2 then POST netdiagnosticexecute runs the replaced binary as root. """Auerswald COMmander provisioning zip-slip → hping2 hijack → unauth root RCE.""" from future import annotations import io import uuid import zipfile import...

Docmosis Tornado storeTo file write cron RCE

Anonymous POST /api/render with storeTo=file:/etc/cron.d/... writes a cron line as root when the service runs with elevated privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Docmosis Tornado unauthenticated storeTo=file arbitrary write → cron root RCE.""" from future import annotations...

HiveMQ Data Hub Zip-Slip custom module cron root RCE

Admin POST /api/v1/cc-data-hub/module-instances/custom with Zip-Slip archive writing /etc/cron.d/. !/usr/bin/env python3 -- coding: utf-8 -- """HiveMQ Platform Data Hub custom module Zip-Slip cron root RCE.""" from future import annotations import base64 import io import json import random import...

Lantronix SGX5150 FsBrowseClean command injection root RCE

Authenticated POST ajax=FsBrowseClean with path=x'\n breaks out of ltrxusbumount shell quoting. """Lantronix SGX5150 FsBrowseClean newline command injection root RCE.""" from future import annotations import base64 import re from urllib.parse import urlencode from kittysploit import from...

nanoDLP unauthenticated G-code injection RCE

Guest POST /formula evaluates JavaScript with nanodlpContext; ShieldUnpause is persisted via Config.Save, then GET /printer/unpause executes Exec cmd as root. !/usr/bin/env python3 -- coding: utf-8 -- """nanoDLP unauthenticated G-code injection RCE via /formula and /printer/unpause.""" from futur...

Opengear NGCS PDU name command injection

Administrator POST /api/v2/pdus with injected pdu.name breaks out of ogpower -n quoting; io.popen runs attacker command as root. !/usr/bin/env python3 -- coding: utf-8 -- """Opengear NGCS PDU name field command injection authenticated root.""" from future import annotations import json import re...