Sonicwall - Pre-Authentication Arbitrary File Read Detection

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

Swim Team <= v1.44.10777 - Local File Inclusion Detection

The program /wp-swimteam/include/user/download.php allows unauthenticated attackers to retrieve arbitrary files from the system. !/usr/bin/env python3 -- coding: utf-8 -- """The program /wp-swimteam/include/user/download.""" import re from kittysploit import from lib.protocols.http.httpclient...

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect Detection

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. !/usr/bin/env python3 -- coding: utf-8 -- """In Apache HTTP server 2.""" impo...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting Detection

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

Apache HTTPD - Optionsbleed Detection (CVE-2017-9798)

Detects CVE-2017-9798 by sending repeated OPTIONS requests and looking for malformed Allow headers double commas / numeric garbage. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OPTIONS Allow header memory leak / Optionsbleed CVE-2017-9798.""" import re from kittysploit import from...

Apache mod_userdir CRLF injection Detection

Apache CRLF injection allowing HTTP response splitting attacks on sites using moduserdir. !/usr/bin/env python3 -- coding: utf-8 -- """Apache CRLF injection allowing HTTP response splitting attacks on sites using moduserdir.""" import re from kittysploit import from lib.protocols.http.httpclient...

Zerologon CVE-2020-1472 Detect

Detects CVE-2020-1472 Zerologon by attempting Netlogon NetrServerAuthenticate3 with all-zero credentials against the domain controller Netlogon RPC interface TCP/135 or 445. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zerologon Netlogon authentication bypass CVE-2020-1472.""" from...

KubeOperator Foreground `kubeconfig` - File Download Detection

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used t...

Eyou E-Mail <3.6 - Remote Code Execution Detection

Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/iploginset/diploginget.php via the getloginipconfigfile function. !/usr/bin/env python3 -- coding: utf-8 -- """Eyou Mail System before 3.""" import re...

Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting Detection

A cross-site scripting vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in the...

Hotel Druid 3.0.2 - Cross-Site Scripting Detection

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. !/usr/bin/env python3 -- coding: utf-8 -- """Hotel Druid 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Pi-hole Reflected XSS in 404-Error Page Detection

Pi-hole Admin Interface = 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the class attribute of the body tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. !/usr/bin/env python3 --...

Traefik - Open Redirect Detection

Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding...

Apache Tomcat Tribes EncryptInterceptor bypass (CVE-2026-34486)

Cleartext Tribes ChannelReceiver traffic may be deserialized after failed decryption EncryptInterceptor. Provide command CommonsCollections6, no JVM or serializedpath for a custom chain. Requires commons-collections 3.x on the target matching this gadget. !/usr/bin/env python3 -- coding: utf-8 --...

Next.js CSP-nonce reflected XSS (CVE-2026-44581) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44581 CSP nonce reflected XSS. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

ThinkPHP 5.0.23 RCE (CVE-2018-20062)

Exploits CVE-2018-20062 in ThinkPHP 5.0.23 via calluserfuncarray in index/think\app/invokefunction for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.0.23 invokefunction RCE CVE-2018-20062.""" import re from kittysploit import from lib.protocols.http.httpclient...

Zerologon DC Password Reset (CVE-2020-1472)

Exploits CVE-2020-1472 Zerologon: brute-forces NetrServerAuthenticate3 with all-zero credentials, then resets the domain controller machine account password to empty via NetrServerPasswordSet2. Enables DCSync with secretsdump using -hashes...

Stage Verify (PowerShell)

Verify staged artifact SHA256 before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify PowerShell", "description": "Verify staged artifact SHA256 before callback",...

Miele Professional PG 8528 Path Traversal

Module exploits Miele Professional PG 8528 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Miele Professional PG 8528 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

Home Assistant - Supervisor Auth Bypass Detection (CVE-2023-27482)

Home Assistant supervised installs are vulnerable to authentication bypass via path traversal under /api/hassio/app/ and /api/hassioingress/ CVE-2023-27482, exposing supervisor/core info without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant Supervisor authentication...

Payment Gateway for Telcell < 2.0.4 - Open Redirect Detection

The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue !/usr/bin/env python3 -- coding: utf-8 -- """The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Ope.""" import re fr...

Chyrp 2.x - Local File Inclusion Detection

A directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the action parameter to the default URI. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in Chyrp...

Msmtp - Config Exposure Detection

Msmtp configuration was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Msmtp configuration was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Msmtp - Config Exposure Detection', 'description':...

Alert Manager - Unauthenticated Access Detection

Alert Manager was able to be accessed with no authentication requirements in place. !/usr/bin/env python3 -- coding: utf-8 -- """Alert Manager was able to be accessed with no authentication requirements in place.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Toshiba TopAccess Panel - Detect

Detects Toshiba TopAccess Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Toshiba TopAccess Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Toshiba TopAccess Panel - Detect',...

WAVLINK - Access Control Detection

Wavlink WN530HG4, WN531G3, WN533A8, and WN551K are susceptible to improper access control via /cgi-bin/ExportAllSettings.sh, where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform...

OX Appsuite - Cross-Site Scripting Detection

OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI. !/usr/bin/env python3 -- coding: utf-8 -- """OX App Suite through 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

FUDForum 3.1.0 - Cross-Site Scripting Detection

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUDForum 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Pega Infinity - Authentication Bypass Detection

Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass vulnerability because the password reset functionality for local accounts can be used to bypass local authentication checks. !/usr/bin/env python3 -- coding: utf-8 -- """Pega Infinity versions 8.""" from kittysploit impor...

Cisco CUCM CVE-2026-20230 SSRF to arbitrary file write RCE

CVE-2026-20230 chains SSRF via /cmplatform/installClusterStatusExecute, Axis LogHandler arbitrary file write, and JSP webshell deployment to obtain remote command execution on Cisco Unified Communications Manager 15.0.1.13901-2. Opens an interactive HTTP command shell and optionally dispatches th...

PostgreSQL COPY FROM PROGRAM RCE (CVE-2019-9193)

Authenticated remote code execution via COPY FROM PROGRAM on PostgreSQL 9.3 through 11.7. Requires a superuser database session. import re from typing import Optional, Tuple from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost,...

FastAPI Injection RCE

Remote Code Execution exploit for FastAPI applications including template injection and code injection vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse import json class ModuleExploit,...

FortiWeb Reflected XSS (CVE-2021-22122)

Exploits CVE-2021-22122 in FortiWeb 6.2/6.3: unauthenticated reflected XSS via error3 and omnisuccess API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """FortiWeb reflected XSS CVE-2021-22122.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Stage Cache (PowerShell)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

OmniPCX - masterCGI RCE (CVE-2007-3010)

Exploits CVE-2007-3010 by injecting OS commands into the user parameter of /cgi-bin/masterCGI. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Alcatel-Lucent OmniPCX masterCGI RCE CVE-2007-3010 — execute session.""" from future import annotations import re from...

Apache Solr Velocity Template RCE (CVE-2019-0193)

Exploits CVE-2019-0193 Velocity template injection on /core/select when the VelocityResponseWriter is enabled. Runs OS commands via wt=velocity and opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr Velocity template RCE CVE-2019-0193 — execute...

Linksys SMART WiFi Password Disclosure

Exploit implementation for Linksys SMART WiFi Password Disclosure vulnerability. If target is vulnerable administrator's MD5 passsword is retrieved. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys SMART WiFi Password Disclosure""" import re from kittysploit import from...

ESVA - learn-msg.cgi RCE Detection (CVE-2012-10046)

Detects CVE-2012-10046 by requesting /cgi-bin/learn-msg.cgi?id=|id; after fingerprinting released.html. !/usr/bin/env python3 -- coding: utf-8 -- """ESVA learn-msg.cgi command injection CVE-2012-10046.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DAP-2020 - webproc File Read (CVE-2021-27250)

Reads arbitrary files from D-Link DAP-2020 via POST /cgi-bin/webproc errorpage= parameter CVE-2021-27250. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-2020 webproc errorpage arbitrary file read CVE-2021-27250.""" from kittysploit import from lib.protocols.http.httpclient import...

phpMyFAQ - Compromised Package Backdoor RCE (CVE-2010-4558)

Exploits CVE-2010-4558 by sending base64 PHP via phpmyfaqnew parameter. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ backdoor RCE CVE-2010-4558.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class...

vBulletin - decodeArguments RCE Detection (CVE-2015-7808)

Detects CVE-2015-7808 by sending a crafted serialized payload to /ajax/api/hook/decodeArguments that triggers phpinfo. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin 5.x pre-auth object injection RCE CVE-2015-7808.""" from urllib.parse import quote from kittysploit import from...

vsftpd - Compromised Package Backdoor Detection (CVE-2011-2523)

Detects CVE-2011-2523 by sending USER X: / PASS X then checking for a shell on TCP/6200 that responds to id. !/usr/bin/env python3 -- coding: utf-8 -- """vsftpd 2.3.4 backdoor CVE-2011-2523.""" import re import socket import time from kittysploit import from lib.protocols.tcp.tcpscannerclient...

MediaWiki CVE-2026-58025 Detect

Fingerprints MediaWiki and flags versions affected by CVE-2026-58025: LogEntryBase::extractParams called unserialize on user-controlled logparams from WikiImporter XML . Affected: Optionalbool: """Affected: 1 else 0 patch = parts2 if lenparts 2 else 0 if minor = 46: return False if minor == 45:...

ONVIF Client

Discovers an ONVIF device service, loads Media/PTZ/Events capabilities, and creates an interactive ONVIF shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ONVIF bind listener — opens an interactive ONVIF camera session.""" from kittysploit import from lib.protocols.onvif.client import...

Samba CVE-2017-7494 (version check)

Non-intrusive SambaCry likelihood check based on disclosed Samba version NSE smb-vuln-cve-2017-7494 check-version mode. Does not upload libraries. !/usr/bin/env python3 -- coding: utf-8 -- """SambaCry CVE-2017-7494 version check NSE smb-vuln-cve-2017-7494 check-version.""" from kittysploit import...

WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure Detection

WAVLINK WN579 X3 M79X3.V5030.180719 is susceptible to information disclosure in /cgi-bin/ExportAllSettings.sh. An attacker can obtain sensitive router information via a crafted POST request and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized...

Jenkins build-metrics 1.3 - Cross-Site Scripting Detection

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins build-metrics 1.""" from kittysploit import from...

Joomla! Component com_rokdownloads - Local File Inclusion Detection

A directory traversal vulnerability in the RokDownloads comrokdownloads component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory...

Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection Detection

Teclib GLPI = 9.3.3 exposes a script /scripts/unlocktasks.php that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature to alter the semantic original SQL query and retrieve database records. !/usr/bin/env python3 -- coding:...

Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion Detection

A directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. This can be leveraged to execute arbitrary code by obtaining LDAP...