Hikvision Auth Bypass (CVE-2017-7921)

Exploits CVE-2017-7921 in multiple Hikvision cameras/NVRs: forged auth parameter grants access to deviceInfo and configuration download endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Hikvision auth bypass and config leak CVE-2017-7921.""" from kittysploit import from...

Spring Boot Actuator H2 RCE

Exploits exposed Spring Boot Actuator /actuator/env to inject an H2 connection-test-query CREATE ALIAS EXEC and restart the application, yielding remote command execution when spring.datasource.hikari is active. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Actuator H2...

Node-RED Unauthenticated Flow RCE

Deploys a malicious Node-RED flow via the admin API when authentication is disabled or credentials are known. Uses an inject + exec node chain to run the configured reverse CMD payload. Complements CVE-2026-71269 detection. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED unauthenticated flo...

FUEL CMS PHP Code Evaluation RCE (CVE-2018-16763)

Exploits CVE-2018-16763 in FUEL CMS 1.4.1 via PHP code evaluation in the /fuel/pages/select/ filter parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS filter parameter PHP RCE CVE-2018-16763.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

ChurchCRM API Authentication Bypass (CVE-2026-39339)

Exploits CVE-2026-39339 in ChurchCRM 7.1.0: URL injection with ?bypass=/api/public on protected API routes bypasses AuthMiddleware and returns sensitive person/family records without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM API auth bypass via URL injection...

QNAP Photo Station File Read (CVE-2019-7192)

Exploits CVE-2019-7192 in QNAP Photo Station: album/slideshow workflow plus filename traversal in /p/api/video.php reads arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP Photo Station path traversal file read CVE-2019-7192.""" import re from kittysploit import from...

D-Link DIR850 Open Redirect (CVE-2021-46379)

Exploits CVE-2021-46379 in D-Link DIR850: unauthenticated open redirect via formWlanRedirect redirect-url parameter phishing / token theft chain. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR850 open redirect CVE-2021-46379.""" import re import urllib.parse from kittysploit import from...

VMware vCenter VSAN RCE (CVE-2021-21985)

Exploits CVE-2021-21985 in VMware vCenter: unauthenticated RCE via the VSAN Health Check plugin JSON API Virtual SAN Health Check. !/usr/bin/env python3 -- coding: utf-8 -- """VMware vCenter VSAN Health Check RCE CVE-2021-21985.""" import re from kittysploit import from...

Citrix ShareFile File Read (CVE-2020-8982)

Exploits CVE-2020-8982 in Citrix ShareFile StorageZones str: depth = r'\..\' 8 target = re...

SAP NetWeaver Metadata Uploader RCE (CVE-2025-31324)

Exploits CVE-2025-31324 unauthenticated file upload via SAP NetWeaver Visual Composer Metadata Uploader to deploy a JSP webshell and execute a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Visual Composer Metadata Uploader RCE CVE-2025-31324.""" import re import...

Next.js RSC Multi-CVE Chain RCE

Full-chain Next.js RSC exploitation: tries CVE-2025-55182 React2Shell first, then falls back to Next.js-specific RSC endpoints. Integrates detection signals from CVE-2026-44582/44573/44578 auxiliary modules. !/usr/bin/env python3 -- coding: utf-8 -- """Next.js RSC multi-CVE exploit chain...

Kibana Timelion RCE (CVE-2019-7609)

Exploits CVE-2019-7609 in Kibana 5.6.15 / 6.6.1: Timelion sheet prototype pollution yields Node.js childprocess execution. !/usr/bin/env python3 -- coding: utf-8 -- """Kibana Timelion prototype pollution RCE CVE-2019-7609.""" import json import re from kittysploit import from...

Cisco SD-WAN Manager Auth Bypass (CVE-2026-76504)

Exploits CVE-2026-76504 in Cisco Catalyst SD-WAN Manager: POST to a percent-encoded /jsecuritycheck path bypasses WildFly authentication constraints and yields an admin-level JSESSIONID, enabling full vManage API access and device template deployment. !/usr/bin/env python3 -- coding: utf-8 --...

Cisco ASA Path Traversal LFI (CVE-2018-0296)

Exploits CVE-2018-0296 in Cisco ASA/FTD: directory traversal via +CSCOU+/.. paths exposes session listings and sensitive files without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco ASA/FTD path traversal LFI CVE-2018-0296.""" import json from kittysploit import from...

Apache Struts2 S2-053 OGNL RCE (CVE-2017-12611)

Exploits CVE-2017-12611 S2-053 in Apache Struts 2 via Freemarker tag OGNL injection in the name parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 S2-053 Freemarker OGNL RCE CVE-2017-12611.""" import re import urllib.parse from kittysploit import from...

TVT DVR Device Info Disclosure (CVE-2024-7339)

Exploits CVE-2024-7339 in TVT/Provision-ISR/AVISION DVRs: unauthenticated POST /queryDevInfo leaks firmware, network, and device metadata. !/usr/bin/env python3 -- coding: utf-8 -- """TVT DVR queryDevInfo disclosure CVE-2024-7339.""" from kittysploit import from lib.protocols.http.httpclient impo...

Citrix NetScaler SAML RCE Chain (CVE-2023-3519)

Targets CVE-2023-3519 on Citrix ADC/Gateway SAML IdP/Gateway configurations. Confirms /saml/login processing, then attempts CVE-2019-19781 template injection as a fallback when directory traversal is available on the same appliance. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix NetScaler SA...

Zyxel NBG2105 Auth Bypass (CVE-2021-3297)

Exploits CVE-2021-3297 in Zyxel NBG2105: Cookie login=1 grants administrator access to status and configuration pages without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NBG2105 cookie auth bypass CVE-2021-3297.""" from kittysploit import from lib.protocols.http.httpclient...

Zyxel GS1900 CGI Stack Overflow RCE (CVE-2026-7273)

Exploits CVE-2026-7273 pre-authentication stack-based buffer overflow in Zyxel GS1900 smart-managed switch CGI handlers. Sends an oversized HTTP POST to /cgi-bin/dispatcher.cgi and alternate CGI endpoints to trigger memory corruption and attempt command execution. Firmware = 2.90XXXX.1C0 is...

TOTOLINK A3002RU Credential Leak (CVE-2018-13317)

Exploits CVE-2018-13317 in TOTOLINK A3002RU 1.0.8: unauthenticated GET to /password.htm exposes plaintext admin username and password in JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """TOTOLINK A3002RU password.htm leak CVE-2018-13317.""" import re from kittysploit import from...

D-Link Router Sip Parameter RCE (CVE-2018-10823)

Exploits CVE-2018-10823 in D-Link DWR routers: command injection via the Sip parameter on chkisg.htm. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link router chkisg.htm command injection CVE-2018-10823.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

Zeroshell kerbynet RCE (CVE-2019-12725)

Exploits CVE-2019-12725 in Zeroshell 3.9.0: newline injection in the User parameter of kerbynet StartSessionSubmit yields unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet command injection CVE-2019-12725.""" import re import urllib.parse from kittysploit import...

Cisco Secure FMC Authentication Bypass (CVE-2026-20079)

Exploits CVE-2026-20079 in Cisco Secure Firewall Management Center: crafted CGISESSID=csmprocesses cookie bypasses authentication on CGI endpoints, exposing FMC system information and privileged management surfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Secure Firewall FMC boot-time...

Check Point Management Path Traversal RCE (CVE-2026-93616)

Exploits CVE-2026-93616 on Check Point Quantum Security Management: pre-authentication path traversal on TCP/19009 allows writing attacker-controlled content to reachable paths, enabling remote code execution on the SMS/Gaia host. !/usr/bin/env python3 -- coding: utf-8 -- """Check Point Quantum...

Zyxel NAS remote_help RCE (CVE-2024-29972)

Exploits CVE-2024-29972 in Zyxel NAS326/NAS542: unauthenticated command injection in remotehelp-cgi NsaRescueAngel backdoor path yields root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS remotehelp-cgi command injection CVE-2024-29972.""" import re import urllib.parse...

Sophos Firewall Auth Bypass RCE (CVE-2022-1040)

Exploits CVE-2022-1040 in Sophos Firewall =18.5 MR3: authentication bypass in User Portal /userportal/Controller enables pre-auth Java deserialization RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall userportal auth bypass RCE CVE-2022-1040.""" import re from kittysploit import...

Zammad CVE-2026-102489 Session Fixation Detect

Detects Zammad helpdesk instances potentially vulnerable to CVE-2026-102489 session fixation leading to RCE as the zammad user. Affects Zammad 6.3.0–6.5.4; chain with CVE-2026-102490 for root LPE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zammad session fixation RCE surface...

Apache Struts2 S2-061 RCE (CVE-2020-17530)

Exploits CVE-2020-17530 S2-061 in Apache Struts 2.0.0–2.5.25: forced OGNL evaluation in tag attributes yields remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 S2-061 forced OGNL RCE CVE-2020-17530.""" import re import urllib.parse from kittysploit import from...

Sonatype Nexus Jexl RCE (CVE-2019-7238)

Exploits CVE-2019-7238 in Nexus Repository Manager 3.15.0: missing ACL on /service/extdirect previewAssets allows Jexl expression remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Sonatype Nexus Repository Manager Jexl RCE CVE-2019-7238.""" import json import re from kittysploit...

Grafana Plugin Path Traversal LFI (CVE-2021-43798)

Exploits CVE-2021-43798 in Grafana 8.x: directory traversal via /public/plugins/NAME/ allows reading arbitrary local files. !/usr/bin/env python3 -- coding: utf-8 -- """Grafana plugin path traversal LFI CVE-2021-43798.""" import re from kittysploit import from lib.protocols.http.httpclient import...

GitLab Commits API file.path LFI (CVE-2026-85706)

Exploits CVE-2026-85706 in self-managed GitLab CE/EE: unauthenticated multipart POST to /api/v4/projects/id/repository/commits with attacker-controlled file.path reads arbitrary host files outside Workhorse temp directories. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab unauthenticated...

GitLab ExifTool DjVu RCE (CVE-2021-22205)

Exploits CVE-2021-22205 in GitLab CE/EE: malformed DjVu metadata embedded in a JPEG upload triggers ExifTool Perl injection during image processing. Delivers a reverse shell via the configured payload or runs verifycmd in-band when possible. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab...

ForgeRock OpenAM Deserialization RCE (CVE-2021-35464)

Exploits CVE-2021-35464 in ForgeRock OpenAM 7.0: pre-auth Java deserialization via jato.pageSession on /openam/oauth2/..;/ccversion/ path traversal routes. !/usr/bin/env python3 -- coding: utf-8 -- """ForgeRock OpenAM Jato deserialization RCE CVE-2021-35464.""" import re from kittysploit import...

GitHub Enterprise Server Push Option RCE (CVE-2026-3854)

Exploits CVE-2026-3854 in GitHub Enterprise Server: crafted git push option values inject internal service headers during push operations, leading to remote code execution. Requires push access to a repository. !/usr/bin/env python3 -- coding: utf-8 -- """GitHub Enterprise Server push-option RCE...

Flowise NVIDIA NIM Auth Bypass (CVE-2026-30824)

Exploits CVE-2026-30824 in Flowise 3.0.13: /api/v1/nvidia-nim/ routes are whitelisted in auth middleware, allowing unauthenticated token generation and container management API access. !/usr/bin/env python3 -- coding: utf-8 -- """Flowise NVIDIA NIM auth bypass token leak CVE-2026-30824.""" import...

Drupal Drupalgeddon2 RCE (CVE-2018-7600)

Exploits CVE-2018-7600 in Drupal 7/8 via form API render array injection on /user/register mailpostrender=passthru for unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Drupalgeddon2 RCE CVE-2018-7600.""" import re from kittysploit import from lib.protocols.http.httpclient...

Confluence Widget Connector SSTI (CVE-2019-3396)

Exploits CVE-2019-3396 in Confluence Server: Widget Connector macro template path traversal reads local files and enables Velocity SSTI RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Confluence Widget Connector SSTI / path traversal CVE-2019-3396.""" import json import re from kittysploit impo...

GeoServer Jiffle WPS RCE (CVE-2022-24816)

Exploits CVE-2022-24816 in GeoServer via WPS ras:Jiffle: malicious Jiffle script is compiled through Janino into Java for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer Jiffle/Janino WPS RCE CVE-2022-24816.""" import re from kittysploit import from...

Adobe ColdFusion RDS Auth Bypass (CVE-2013-0632)

Exploits CVE-2013-0632 in Adobe ColdFusion: empty adminpassword with rdsPasswordAllowed=1 on administrator.cfc?method=login yields CF admin session. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion RDS auth bypass CVE-2013-0632.""" import re from kittysploit import from...

FortiOS SSL VPN Credential Leak (CVE-2018-13379)

Exploits CVE-2018-13379 path traversal in FortiOS/FortiProxy SSL VPN web portal to download /dev/cmdb/sslvpnwebsession and extract active session credentials. !/usr/bin/env python3 -- coding: utf-8 -- """FortiOS SSL VPN session credential leak CVE-2018-13379.""" import re from kittysploit import...

Citrix NetScaler Pre-Auth Command Injection (CVE-2026-88771)

Exploits CVE-2026-88771 in Citrix NetScaler ADC/Gateway: attacker-controlled login values are logged and later interpolated into nsmonuploadderr.pl shell commands, yielding root command execution. Sends the pitboss/PPE log-poisoning payload via /nf/auth/doAuthentication.do watchTowr pattern...

Razer Sila Router LFI (CVE-2022-29014)

Exploits CVE-2022-29014 in Razer Sila 2.0.418: unauthenticated ubus JSON-RPC file.read on /ubus/ allows reading arbitrary files such as /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Razer Sila ubus file read LFI CVE-2022-29014.""" import json import re from kittysploit import from...

NETGEAR DGN syscmd RCE (CVE-2024-12847)

Exploits CVE-2024-12847 in NETGEAR DGN routers: unauthenticated command injection via setup.cgi todo=syscmd&cmd= parameter. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGN setup.cgi syscmd RCE CVE-2024-12847.""" import re import urllib.parse from kittysploit import from...

NETGEAR Debug Auth Bypass (CVE-2020-27866)

Exploits CVE-2020-27866 on multiple NETGEAR routers: unauthenticated access to /setup.cgi?todo=debug exposes debug mode and configuration pages. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR password recovery auth bypass CVE-2020-27866.""" from kittysploit import from...

NETGEAR Router cgi-bin RCE (CVE-2016-6277)

Exploits CVE-2016-6277 in multiple NETGEAR routers: shell metacharacters in the cgi-bin path segment yield unauthenticated command execution. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR router cgi-bin path command injection CVE-2016-6277.""" import re from kittysploit import from...

LiteSpeed cPanel Plugin Privesc RCE (CVE-2026-48172)

Exploits CVE-2026-48172 in the LiteSpeed cPanel plugin: mishandled Redis enable/disable API allows privilege escalation and arbitrary command execution as root via crafted cpaneljsonapi requests. !/usr/bin/env python3 -- coding: utf-8 -- """LiteSpeed cPanel plugin privesc to RCE CVE-2026-48172.""...

FortiMail Path Traversal RCE (CVE-2026-102490)

Exploits CVE-2026-102490 in FortiMail: unauthenticated path traversal and NULL-byte mishandling allows writing arbitrary files, enabling webshell deployment and remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """FortiMail unauthenticated path traversal RCE CVE-2026-102490.""" fro...

D-Link NAS Backdoor RCE (CVE-2024-3272)

Exploits CVE-2024-3272 in D-Link DNS-320L/325/327L/340L: hard-coded messagebus account in nassharing.cgi cmd=15 runs base64-encoded shell commands. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link NAS messagebus backdoor RCE CVE-2024-3272.""" import base64 import re from kittysploit import fro...

D-Link DIR-600M Auth Bypass (CVE-2019-13101)

Exploits CVE-2019-13101 in D-Link DIR-600M: unauthenticated access to WAN configuration pages such as /wan.htm. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-600M auth bypass CVE-2019-13101.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DAR-8000 Command Injection (CVE-2023-4542)

Exploits CVE-2023-4542 in D-Link DAR-8000-10: OS command injection via the id parameter of /app/sys1.php. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAR-8000 sys1.php command injection CVE-2023-4542.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...