Windows HTA / mshta Reverse TCP

HTA payload launched via mshta.exe; VBS drops/compiles a C reverse shell with csc.exe no powershell.exe required from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "hta" info = "name": "Windows HTA / mshta Reverse TCP", "description": "HTA payload launched via mshta.exe;...

Windows JScript Reverse TCP (csc on-box)

JScript/cscript delivery vector: writes a tiny C reverse shell, compiles with csc.exe .NET Framework, and runs it — no powershell.exe. Useful when .ps1 execution is restricted AppLocker. from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "jscript" info = "name": "Windows...

Windows VBScript Reverse TCP (csc on-box)

VBScript/cscript delivery vector: writes a tiny C reverse shell, compiles with csc.exe .NET Framework, and runs it — no powershell.exe from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "vbscript" info = "name": "Windows VBScript Reverse TCP csc on-box", "description":...

Linux x86 Reverse TCP Stager

Position-independent x86 Linux reverse TCP shellcode socket+connect+dup2+/bin/sh from kittysploit import class ModulePayload: """Linux x86 reverse TCP stager connect + dup2 + execve /bin/sh.""" info = "name": "Linux x86 Reverse TCP Stager", "description": "Position-independent x86 Linux reverse T...

Python DNS Reverse Shell

Poll DNS TXT records for commands and exfil output via result queries stdlib UDP DNS — no dnspython required on target. Pairs with listeners/covert/dns. from kittysploit import from lib.c2.dnsreverseagent import buildpythondnsagentscript class ModulePayload: """DNS TXT polling agent — deliverable...

PowerShell Reverse WebSocket Shell

Connect back over WebSocket .NET ClientWebSocket and run commands from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "powershell" info = "name": "PowerShell Reverse WebSocket Shell", "description": "Connect back over WebSocket .NET ClientWebSocket and run commands",...

Python Reverse WebSocket Shell

Connect back over WebSocket and provide an interactive command shell stdlib only from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Python Reverse WebSocket Shell", "description": "Connect back over WebSocket and provide an interactive command she...

PowerShell Command Shell, Reverse UDP

Connect-back UDP shell line-oriented. Pairs with listeners/multi/reverseudp from kittysploit import import base64 from lib.c2.stagerevasion import powershellprelude class ModulePayload: CLIENTLANGUAGE = "powershell" info = "name": "PowerShell Command Shell, Reverse UDP", "description":...

CVE-2026-17347

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

EUVD-2026-51560

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-17347

The CVE describes an OS command injection in pgAdmin 4: a MASTER_PASSWORD_HOOK setting allows an administrator to configure an external command containing %u, which substitutes the current user name (potentially from external sources) into the command string. Previously this could be injected int...

CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-6890

This CVE-2026-6890 entry, as reflected by PT-2026-66670, concerns a default-credentials vulnerability in Advantech ECU-1251D. A remote attacker could gain unauthorised SSH access via the device’s default root account with no password, because credentials are not changed during configuration. The ...

CVE-2026-17347: Improper Neutralization of Special Elements used in an OS Command

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

PT-2026-66772

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 7.2 through 9.16 Description An issue exists in the MASTER PASSWORD HOOK setting where the application substitutes the username directly into a command string and executes it using subprocess.Popen..., shell=True. Since...

PT-2026-66846

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...

envocabulary v1.0.4

envocabulary For every variable in your current shell, find the file and line that set it — or which subsystem direnv, launchd, terminal, SSH, system injected it. Plus a few static-file commands for the moment your shell config has sprawled across N files and backups and you've lost the plot. I...

SUSE CVE-2026-29050

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a melange configuration file - for example through pull-request-driven CI or build-as-a-service scenarios - could set pipeline.uses to a...

SUSE CVE-2026-34528

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Defaults.Applyuser, then strips only Admin. The Execu...