Vulners Software Audit

Query the Vulners Software Audit API for known vulnerabilities matching one or more software products/versions CPE string or vendor:product:version. Bring-your-own-key BYOK: set apikey, plugin config, or VULNERSAPIKEY. Prefer plugin run vulners … as the hub; this scanner is a thin wrapper...

Fortinet FortiNAC keyUpload Cron RCE (CVE-2022-39952)

Horizon3 PoC: unauthenticated POST to /configWizard/keyUpload.jsp with a ZIP placing a cron job under /etc/cron.d/. Use a CMD reverse payload. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2022-39952 — Fortinet FortiNAC arbitrary file write via keyUpload.jsp Horizon3. Uploads a ZIP whose entr...

FortiSIEM Phoenix Monitor RCE (CVE-2025-64155)

CVE-2025-64155 Horizon3: Phoenix Monitor clusterurl injection writes CMD payload to /opt/charting/redishb.sh; phxctl.service runs within 1 min. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2025-64155 — FortiSIEM Phoenix Monitor clusterurl injection → delayed RCE. Reference:...

Palo Alto Expedition Cron RCE (CVE-2024-9464)

Horizon3 chain for CVE-2024-9464: unauthenticated admin password reset CVE-2024-5910 then cron starttime injection to wget and execute an attacker-hosted script. Supports framework CMD payloads reverse shell. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2024-9464 — Palo Alto Expedition admin...

FortiSIEM SendQueryResult RCE (CVE-2026-106173)

CVE-2026-106173 Horizon3: unauthenticated SendQueryResult gRPC write to /opt/charting/redishb.sh with CMD payload; phxctl.service executes within 1 min. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-106173 — FortiSIEM gRPC file write → delayed RCE via phxctl.service. """ from future impo...

osTicket CVE-2026-22200 Patch Detect

Unauthenticated checks from Horizon3 check.py: login username pre-validation v1.18.3+/v1.17.7+ patch and optional open.php HTML srcset stripping. Full CNEXT RCE chain is not bundled — file read alone does not yield a session. !/usr/bin/env python3 -- coding: utf-8 -- """Detect osTicket...

Apache Superset CVE-2023-27524 Default Secret Detect

Horizon3: verifies the session cookie is signed with a known default Flask SECRETKEY. Requires optional flask-unsign package. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Superset default Flask SECRETKEY CVE-2023-27524, Horizon3.""" from future import annotations import re from...

SolarWinds Web Help Desk Ticket Read (CVE-2024-28987)

Horizon3 PoC: default helpdeskIntegrationUser Basic auth on /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets — data read only. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2024-28987 — SolarWinds Web Help Desk hardcoded API credentials Horizon3. Auxiliary: reads Orion tickets via Basic auth...

FortiSIEM SendQueryResult Arbitrary File Write (CVE-2026-106173)

CVE-2026-106173: unauthenticated path traversal and embedded NUL in SendQueryResult gRPC/HTTP/2, TCP 27918. Overwrite or create arbitrary files — blind, no session. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-106173 — FortiSIEM unauthenticated arbitrary file write blind. Auxiliary:...

Ivanti Sentry MICSLog RCE (CVE-2023-38035)

Horizon3: unauthenticated Hessian uploadFileUsingFileInput on /mics/services/MICSLogService with root command execution. Uses framework HTTP/Hessian client proxy-aware. CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2023-38035 — Ivanti Sentry MICSLogService Hessian command injecti...

FortiSIEM Phoenix Monitor Port Probe (CVE-2025-64155)

Checks whether TCP 7900 Phoenix Monitor TLS is reachable on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FortiSIEM Phoenix Monitor TLS port CVE-2025-64155.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner,...

FortiClient EMS CVE-2023-48788 Registration SQLi Detect

Horizon3 probe: TLS registration message with SQLi; vulnerable hosts respond with KAINTERVAL. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FortiClient EMS registration SQLi CVE-2023-48788, Horizon3.""" from kittysploit import from lib.protocols.tcp.forticlientemsclient import...

osTicket PDF PHP Filter File Read (CVE-2026-22200)

Horizon3: submits an open.php ticket whose rich-text message abuses mPDF list-style-image php://filter chains. Retrieve bytes from the ticket PDF extract BMP / use Horizon3 extractpdfimages.py. No framework session. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-22200 — osTicket anonymous...

Zammad WebSocket Session Leak RCE (CVE-2026-102489)

Horizon3 chain for CVE-2026-102489: WebSocket event base triggers NoMethodError leaking connected users Cookie headers; hijacked session installs malicious ERB via packages API and triggers password-reset template evaluation. Blind file output on target default /tmp/zammadrce.txt. !/usr/bin/env...

Palo Alto Expedition CVE-2024-9465 SQLi Detect

Horizon3 check: Checkpoint parser SQL injection via SLEEP10. No session — chain with exploits/multi/http/paloaltoexpeditioncve20249464rce. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Palo Alto Expedition unauthenticated SQLi CVE-2024-9465, Horizon3.""" import time from kittysploit import...

FortiSIEM gRPC HTTP/2 Probe (CVE-2026-106173)

Probes FortiSIEM gRPC TCP 27918: TLS with ALPN h2 or plaintext HTTP/2. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FortiSIEM gRPC surface CVE-2026-106173.""" from kittysploit import from lib.protocols.http2.http2client import Http2client from lib.protocols.tcp.tcpscannerclient import...

Exasol default SYS credential PYTHON3 UDF RCE

Default sys/exasol over TLS SQL port: CREATE PYTHON3 UDF with os.popen; requires local exaplus client or docker exec into DB container. """Exasol Database 7.1.30 docker-db - Shipped Default SYS Credential Reaching a PYTHON3 UDF os.popen Command Execution with Output Returned Through SELECT...

FME Flow Zip-Slip file write JSP RCE as LocalSystem

Authenticated FMEToken POST /fmedataupload// with Zip-Slip drops JSP under webapps then HTTP trigger. """FME Flow Zip-Slip archive extract arbitrary JSP write LocalSystem RCE.""" from future import annotations import io import re import zipfile from kittysploit import from lib.exploit.handler...

GraphDB .pie unicode-escape ruleset injection RCE

Anonymous upload of malicious .pie ruleset, graphdb:Sail repository creation, and /size trigger runs injected Runtime.exec on init. """GraphDB .pie ruleset namespace prefix injection unicode-escape unauth RCE.""" from future import annotations import json import re import uuid from kittysploit...

InterSystems IRIS FolderManager Property Injection RCE

InterSystems IRIS FolderManager Property Injection RCE """InterSystems IRIS FolderManager Property Injection RCE""" from future import annotations from kittysploit import from lib.exploit.handler import Handler from lib.protocols.http.httpclient import Httpclient from urllib.parse import urlparse...

Lantronix EDS3000PR SSL passin command injection

Authenticated POST /ssl with certpasswd/keypasswd injected into openssl -passin pass:%s system enables root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Lantronix EDS SSL -passin pass:%s command injection RCE.""" from future import annotations import re import time from...

Maian Guardian license generator command injection RCE

Admin ajax-ops=generate — shell expansion in projid writes marker under content/ and runs attacker command. """Maian Guardian license generator command injection RCE.""" from future import annotations import re import uuid from urllib.parse import urlencode from kittysploit import from...

mySCADA PRO Runtime unauthenticated upgrade command injection root RCE

POST /s.fcgi?upgrade= with X-File directory triggers systemchmod 777 /opt/myscada/fw/ as root. """mySCADA PRO Runtime unauthenticated /s.fcgi upgrade branch command injection.""" from future import annotations import re from urllib.parse import quote from kittysploit import from lib.exploit.handl...

nanoDLP unauthenticated G-code injection RCE

Guest POST /formula evaluates JavaScript with nanodlpContext; ShieldUnpause is persisted via Config.Save, then GET /printer/unpause executes Exec cmd as root. !/usr/bin/env python3 -- coding: utf-8 -- """nanoDLP unauthenticated G-code injection RCE via /formula and /printer/unpause.""" from futur...

NCache Enterprise — Unauthenticated Assembly.LoadFrom RCE via Web Manager

NCache Enterprise — Unauthenticated Assembly.LoadFrom RCE via Web Manager """NCache Enterprise — Unauthenticated Assembly.LoadFrom RCE via Web Manager""" from future import annotations import base64 import random import re import urllib.parse from kittysploit import from...

ITRS OP5 Monitor command_test.php patch bypass RCE

Authenticated monitor/monitor → CSRF → commandtest.php $ injection with base64 output retrieval. !/usr/bin/env python3 -- coding: utf-8 -- """ITRS OP5 Monitor commandtest.php authenticated command injection RCE.""" from future import annotations import base64 import re from urllib.parse import...

PrizmDoc VirtualViewer unauth uploadDocument JSP RCE

Unauthenticated multipart uploadDocument writes a JSP under sample-documents/; GET executes arbitrary commands. """PrizmDoc VirtualViewer unauthenticated uploadDocument JSP webshell RCE.""" from future import annotations import re import uuid from urllib.parse import quote, urlencode from...

ProSoft RLX-IFH24E unsigned upgrade package root RCE

Authenticated POST toolreprogramming.cgi with crafted upgradepkg; pre script runs attacker command as root during upgrade. """ProSoft RLX-IFH24E unsigned upgrade package pre-script root RCE.""" from future import annotations import base64 import gzip import hashlib import io import tarfile import...

RCDevs WebADM logfile_viewer sid command injection RCE

Post-auth OS command injection in admin/logfileviewer.php sid parameter grep -E popen sink; proof via log readback. """RCDevs WebADM 2.4.14 - OS Command Injection in the Log Viewer sid Parameter CWE-78""" from future import annotations from kittysploit import from lib.protocols.http.httpclient...

Royal Server ExecuteScript LocalSystem RCE

POST /managementendpoint with Basic auth user + product-encrypted password runs batch ScriptContent as LocalSystem on the Royal Server host. """Royal Server authenticated ExecuteScript → LocalSystem batch RCE.""" from future import annotations import base64 import json from kittysploit import fro...

Server Technology PRO3X port_mux listener override root RCE

Authenticated JSON-RPC setConfiguration overrides protolistener program to /bin/sh; TCP connect triggers execv as root. """Server Technology PRO3X portmux listener program override root RCE.""" from future import annotations import json import re import socket from kittysploit import from...

SmartBear Collaborator DOORS review upload Zip-Slip GSP RCE

Authenticated JSON login + DOORS review archive upload; Zip-Slip drops Groovy server page under Tomcat ROOT. """SmartBear Collaborator DOORS review Zip-Slip Groovy GSP RCE.""" from future import annotations import io import json import uuid import zipfile from kittysploit import from...

StreamSets default credentials Shell executor RCE

Basic-auth REST API creates a pipeline with Dev Raw Source + ShellDExecutor, starts it, and runs attacker shell script as the SDC user sudo -n when root mode. !/usr/bin/env python3 -- coding: utf-8 -- """StreamSets Data Collector default creds + Shell executor pipeline RCE.""" from future import...

TigerGraph default creds GSQL write REST++ SSH RCE

GUI login tigergraph/tigergraph, install PRINT TOCSV query, unauth REST++ writes authorizedkeys, optional SSH command. """TigerGraph default creds GSQL file write REST++ unauth SSH RCE.""" from future import annotations import base64 import json import os import subprocess import tempfile import...

VitalPBX asterisk_cli System() root RCE

Authenticated admin POST index.php asteriskcli runCommand adds dialplan System extension and originates a call to run as root. !/usr/bin/env python3 -- coding: utf-8 -- """VitalPBX asteriskcli dialplan System root privilege escalation.""" from future import annotations import json import re impor...

Biamp Devio DTP quote-injection root RCE

Plaintext biampdtp on 4030: DEVICE set password with ';cmd;' breaks echo -e 'biamp:VALUE' | chpasswd quoting. """Biamp Devio SCR-20/25 — Unauthenticated DTP Protocol Quote-Injection → Root RCE""" from future import annotations from kittysploit import import socket import sys import time import re...

MidVision RapidDeploy Remote Agent Unauthenticated Arbitrary File Write RCE

MidVision RapidDeploy Remote Agent Unauthenticated Arbitrary File Write RCE """MidVision RapidDeploy Remote Agent Unauthenticated Arbitrary File Write RCE""" from future import annotations from kittysploit import import base64 import os import subprocess import sys import tempfile import textwrap...

Royal Render unauth rrServer job submission RCE

TCP 7773 captured Execute/Once job record no auth. Scene script path embedded in record — write locally only if worker shares that storage. """Royal Render 9.1.26b - Default-Unauthenticated Job Submission on rrServer Port 7773 Reaching a Worker-Side Shell Script Execution as root CWE-306, CWE-118...

Altus BluePlant Hardcoded Credentials RCE — Detect

Fingerprint / reachability check for Altus BluePlant Hardcoded Credentials RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Altus BluePlant Hardcoded Credentials RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

Asustor ADM 3.5.9 (AS602T) — Post-Authentication Command Injection in `music.cgi — Detect

Fingerprint / reachability check for Asustor ADM 3.5.9 AS602T — Post-Authentication Command Injection in music.cgi act=live → Command Execution in the CGI Process !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Asustor ADM 3.5.9 AS602T — Post-Authentication Command Injection in music.c...

Auerswald COMmander 6000 / 6000R 8.6D - Path Traversal in the Provisioning Archi — Detect

Fingerprint / reachability check for Auerswald COMmander 6000 / 6000R 8.6D - Path Traversal in the Provisioning Archive Import Leading to Unauthenticated Root Code Execution CWE-22 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Auerswald COMmander 6000 / 6000R 8.6D - Path Traversal in...

Countersoft Gemini Authenticated SQL Injection to xp_cmdshell RCE — Detect

Fingerprint / reachability check for Countersoft Gemini Authenticated SQL Injection to xpcmdshell RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Countersoft Gemini Authenticated SQL Injection to xpcmdshell RCE""" from kittysploit import from lib.protocols.http.httpclient import...

Edimax BR-6478AC v2.20 - Authenticated Command Injection in the setWAN WAN-Confi — Detect

Fingerprint / reachability check for Edimax BR-6478AC v2.20 - Authenticated Command Injection in the setWAN WAN-Configuration Handler Reaching root Command Execution CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Edimax BR-6478AC v2.20 - Authenticated Command Injection in the...

GigaSpaces XAP Unauthenticated Path Traversal to Root RCE — Detect

Fingerprint / reachability check for GigaSpaces XAP Unauthenticated Path Traversal to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for GigaSpaces XAP Unauthenticated Path Traversal to Root RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

IceWarp Server Static Route External Filter UNC DLL Remote Code Execution — Detect

Fingerprint / reachability check for IceWarp Server Static Route External Filter UNC DLL Remote Code Execution !/usr/bin/env python3 -- coding: utf-8 -- """Detection for IceWarp Server Static Route External Filter UNC DLL Remote Code Execution""" from kittysploit import from...

KeyHelp Apache Custom Directive ErrorLog Pipe to Root RCE — Detect

Fingerprint / reachability check for KeyHelp Apache Custom Directive ErrorLog Pipe to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for KeyHelp Apache Custom Directive ErrorLog Pipe to Root RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Lantronix EDS3000PR — Authenticated Command Injection in SSL `-passin pass:%s` → — Detect

Fingerprint / reachability check for Lantronix EDS3000PR — Authenticated Command Injection in SSL -passin pass:%s → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Lantronix EDS3000PR — Authenticated Command Injection in SSL -passin pass:%s → Root RCE""" from kittysploit impor...

Maian Guardian 2.1 - OS Command Injection in the License Generator (`guardianLic — Detect

Fingerprint / reachability check for Maian Guardian 2.1 - OS Command Injection in the License Generator guardianLicense::create CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Maian Guardian 2.1 - OS Command Injection in the License Generator guardianLicense::create CW""" from...

Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT - Unfiltered Java Deseriali — Detect

Fingerprint / reachability check for Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT - Unfiltered Java Deserialization in the Database Restore Path Behind a Raw-URI License Gate Bypass and a Fail-Open Authentication Gate, Reaching A !/usr/bin/env python3 -- coding: utf-8 -- """Detection for...

Puppet Enterprise — CVE-2025-5459 Patch-Bypass Variant → keytool Shell Injection — Detect

Fingerprint / reachability check for Puppet Enterprise — CVE-2025-5459 Patch-Bypass Variant → keytool Shell Injection → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Puppet Enterprise — CVE-2025-5459 Patch-Bypass Variant → keytool Shell Injection → Root RCE""" from kittysplo...