QNAP - pingping.cgi Command Injection (CVE-2013-0143)

Exploits CVE-2013-0143 via /cgi-bin/pingping.cgi?pingip=1;;. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP pingping.cgi RCE CVE-2013-0143 — opens execute session.""" import base64 import re from urllib.parse import quote from kittysploit import from...

Vacron NVR - board.cgi Command Injection (CVE-2025-34043)

Exploits unauthenticated OS command injection via Vacron /board.cgi?cmd=. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Vacron NVR board.cgi RCE CVE-2025-34043 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

Beward IP Camera - servetest NTP Command Injection (CVE-2025-34042)

Exploits Beward camera command injection in ServerName of /cgi-bin/operator/servetest?cmd=ntp. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera servetest NTP RCE — opens execute session.""" import re from urllib.parse import quote from kittysploi...

HomeMatic CCU2 - TCL RCE (CVE-2018-7297)

Exploits unauthenticated TCL system.Exec via /Text.exe on HomeMatic CCU2. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """HomeMatic CCU2 TCL interpreter RCE CVE-2018-7297 — opens execute session.""" import re from kittysploit import from...

TBK DVR - Unauthenticated OS Command Injection (CVE-2024-3721)

Exploits CVE-2024-3721 on TBK DVR devices via /device.rsp command injection with Cookie uid=1. Command output is returned in the HTTP response; opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TBK DVR unauthenticated OS command injection CVE-2024-3721 — opens...

D-Link DIR-300/600 - command.php RCE (CVE-2013-10048)

Exploits CVE-2013-10048 via POST /command.php with Cookie uid=vttest. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300/600 command.php RCE CVE-2013-10048 — opens execute session.""" from kittysploit import from lib.protocols.http.httpclient import...

FreeSWITCH - /api/system Command Execution (CVE-2018-19911)

Exploits CVE-2018-19911 by passing OS commands to /api/system/?. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreeSWITCH /api/system RCE CVE-2018-19911 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

D-Link DSL-2888A - Cookie Auth Bypass Detection (CVE-2020-24579)

Detects D-Link DSL-2888A session elevation by fetching /page/login/loginsucc.html with a random uid cookie, then /index.html with the same cookie and looking for authenticated UI markers. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2888A cookie privilege escalation / auth bypass...

Zyxel NAS - setCookie Command Injection (CVE-2024-29973)

Exploits unauthenticated command injection in Zyxel NAS via multipart POST to /cmd,/simZysh/registermain/setCookie. Command output is returned; opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS setCookie command injection CVE-2024-29973 — opens execute...

D-Link DNS-320 - system_mgr.cgi Command Injection (CVE-2020-25506)

Exploits CVE-2020-25506 by injecting OS commands into fntpserver on /cgi-bin/systemmgr.cgi, writing stdout under /cgi-bin/.txt. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320 systemmgr.cgi NTP command injection CVE-2020-25506 — opens execute...

agensic v0.3.0

Know what ran, where, when and who executed it The missing observability layer for AI-powered terminal workflows Signed Provenance Tracked Sessions Git Time Travel Replayable Sessions IDE style Tab Autocomplete Agensic upgrades your existing terminal workflow for the AI era. It is built for...

PT-2026-69989

Name of the Vulnerable Software and Affected Versions PingFederate versions prior to 13.1 Description Cross-Site Request Forgery CSRF weaknesses in the Administrative Console may allow actors to perform unauthorized actions. This occurs when administrators with active sessions are triggered to...

PT-2026-69530

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ntlm authenticate function, the destroy previous session function is called using a user pointer derived from the client-supplied NTLM blob username field before the NTLMv2 respon...

VulnCheck KEV: CVE-2026-48294

Adobe Acrobat PDF Extension Chrome versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in tha...

PT-2026-69839

Name of the Vulnerable Software and Affected Versions systemd-machined versions 258 through 259 and later Description When running on a desktop system, an unprivileged user logged into a desktop graphical session can terminate arbitrary processes, including those with higher privileges. This issu...

PT-2026-69338

Name of the Vulnerable Software and Affected Versions AutoNetTV Relay WordPress plugin versions prior to 3.0.14 Description The plugin fails to perform capability or authentication checks before setting a WordPress administrator authentication cookie during its scheduled content-synchronization...

CVE-2026-13600: Improper Authentication

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

CVE-2026-15060: Improper Access Control

When systemd-machined = v259 or v258 with a custom polkit policy that allows register-machine access is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless...

PT-2026-76483

Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...

PT-2026-69901

Name of the Vulnerable Software and Affected Versions OP-TEE OS versions prior to 4.10.0 commit 0aadfc2 Description A null pointer dereference occurs in the Widevine pseudo-TA open session handler when CFG WIDEVINE PTA is enabled. Normal World clients can trigger this by opening a session directl...