Vanguard-Map

VANGUARD1 — Multi-Domain Tactical Intelligence Map A real-time 3D map of the world's moving things: live ship traffic AIS, aircraft, satellites, submarine cables, ports, chokepoints, and space weather — rendered as a 1.5M-point terrain cloud with day/night, ocean simulation, and cinematic camera...

tactical-exploitation

tactical-exploitation "The Other Way to Pen-Test" -- HD Moore & Valsmith I've always been a big proponent of a tactical approach to penetration testing that does not focus on exploiting known software vulnerabilities, but relies on old school techniques such as information gathering and brute...

CVE-2025-69516

CVE-2025-69516 - Tactical RMM Remote Code Execution This repository contains a Python script that automates the exploitation of the CVE-2025-69516 SSTI vulnerability in Tactical RMM. It has been tested on version 1.3.1. Usage root@kitploit: python xpl.py -d api.tactical.xyz -t SESSIONTOKEN -c "id...

CVE-2025-69516

CVE-2025-69516 - Tactical RMM Remote Code Execution This repository contains a Python script that automates the exploitation of the CVE-2025-69516 SSTI vulnerability in Tactical RMM. It has been tested on version 1.3.1. Usage root@kitploit: python xpl.py -d api.tactical.xyz -t SESSIONTOKEN -c "id...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Amidaware Tactical_Rmm

C...

Metasploit Wrap-Up 03/06/2026

Encoder exposed! Some of our releases add new ways in; this one adds new ways to stay in. There are, of course, still new RCE toys in the box Tactical RMM via Jinja2 SSTI and an unauthenticated MajorDoMo exploit. Still, the underlying theme is payloads: more control over how they are packaged and...

Signed malware impersonating workplace apps deploys RMM backdoors

In February 2026, Microsoft Defender Experts identified multiple phishing campaigns attributed to an unknown threat actor. The campaigns used workplace meeting lures, PDF attachments, and abuse of legitimate binaries to deliver signed malware. Phishing emails directed users to download malicious...

📄 Tactical RMM 1.3.1 Jinja2 Server-Side Template Injection

This Metasploit module targets a server-side template injection vulnerability in Tactical RMM's template preview endpoint. The implementation is clearly marked as experimental and manually ranked due to the inherently unstable exploitation technique it relies on. The module attempts to achieve...

CBP Signs Clearview AI Deal to Use Face Recognition for ‘Tactical Targeting’

US Border Patrol intelligence units will gain access to a face recognition tool built on billions of images scraped from the internet...

Exploit for CVE-2025-69516

CVE-2025-69516 - Tactical RMM Remote Code Execution This repo...

CVE-2025-69517

An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creation of a new agent via the POST /api/v3/newagent/ endpoint. The agentid parameter accepts up to 255 characters and is improperly sanitized...

CVE-2025-69516

A Server-Side Template Injection SSTI vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the...

Tactical RMM security vulnerabilities

Tactical RMM is an open-source remote monitoring and management tool developed by AmidaWare Inc. Versions of Tactical RMM prior to v1.3.1 contained security vulnerabilities. These vulnerabilities were caused by improper handling of the templatemd parameter, which could lead to server-side templat...

Tactical RMM Jinja2 SSTI Remote Code Execution

This module exploits a Server-Side Template Injection SSTI vulnerability in Tactical RMM versions prior to 1.4.0 CVE-2025-69516. The reporting template preview endpoint passes user-controlled Jinja2 template content to Environment.fromstring without sandboxing, allowing arbitrary Python code...

PT-2026-5334

Name of the Vulnerable Software and Affected Versions Amidaware Tactical RMM versions prior to 1.3.2 Description A Server-Side Template Injection SSTI exists in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM. The issue stems from insufficient sanitization of the template md...

CVE-2025-69516

A Server-Side Template Injection SSTI vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the...

CVE-2025-69516

A Server-Side Template Injection SSTI vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the...

CVE-2025-69517

An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creation of a new agent via the POST /api/v3/newagent/ endpoint. The agentid parameter accepts up to 255 characters and is improperly sanitized...

CVE-2025-69517

An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creation of a new agent via the POST /api/v3/newagent/ endpoint. The agentid parameter accepts up to 255 characters and is improperly sanitized...

Tactical RMM security vulnerabilities

Tactical RMM is an open-source remote monitoring and management tool developed by AmidaWare Inc. Versions of Tactical RMM v1.3.1 and earlier contain security vulnerabilities. These vulnerabilities stem from issues with the/api/tacticalrmm/apiv3/views.py component, which may allow for remote...