Metabase CVE-2026-72898 reset_password SQLi

CVE-2026-72898: unauthenticated POST /api/session/resetpassword accepts user-id :raw SQL for stacked queries on PostgreSQL app DB — creates superuser and opens Metabase HTTP session. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2026-72898 resetpassword HoneySQL injection admin...

ZoneMinder CVE-2024-51482 removetag SQLi

CVE-2024-51482 ZoneMinder = 1.37.64: boolean SQLi in ajax/event.php removetag tid parameter HTTP 200=true, 500=false. Extracts credentials. !/usr/bin/env python3 -- coding: utf-8 -- """ZoneMinder CVE-2024-51482 authenticated boolean-blind SQLi.""" from future import annotations import re from...

motionEye CVE-2025-60787 Detect

Fingerprints motionEye web UI config API requires signingkey for exploit. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprints motionEye web UI config API requires signingkey for exploit.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Adobe ColdFusion CVE-2009-2265 FCKeditor upload RCE

CVE-2009-2265: unauthenticated FCKeditor upload.cfm with null-byte CurrentFolder bypass drops JSP under /userfiles/file/ for cmd execution. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion 8 CVE-2009-2265 FCKeditor unauth upload RCE.""" from future import annotations from kittysploit...

OP5 Monitor CVE-2025-34115 command_test RCE

CVE-2025-34115 bypass: authenticated cmdstr on /monitor/op5/nacoma/commandtest.php runs $... via naemon shell mode. !/usr/bin/env python3 -- coding: utf-8 -- """ITRS OP5 Monitor CVE-2025-34115 patch-bypass commandtest RCE.""" from future import annotations import base64 import re from kittysploit...

Nezha Monitoring CVE-2026-53519 JWT forgery

CVE-2026-53519: path traversal under the Nezha dashboard exposes data/config.yaml jwtsecretkey and data/sqlite.db. Forges an HS256 admin JWT and verifies access to /api/v1/profile. !/usr/bin/env python3 -- coding: utf-8 -- """Nezha Monitoring CVE-2026-53519 path traversal + JWT forgery admin...

Ahsay CBS CVE-2026-105134 UpdateReceivers detect

Detects POST /rps/api/json/UpdateReceivers.do used in CVE-2026-105134 OS command injection via unsanitized random parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Ahsay CBS-style UpdateReceivers endpoint CVE-2026-105134 pattern.""" import json from kittysploit import from...

image-downloader CVE-2026-103648 wrapper detect

Detects Node.js apps exposing a user-controlled image URL fetch endpoint pattern associated with CVE-2026-103648 image-downloader 4.3.1 path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HTTP wrappers around vulnerable image-downloader 4.3.1.""" import json from kittysploit impor...

LiteLLM CVE-2026-47101 Detect

Fingerprints LiteLLM proxy API /health, OpenAI-compatible routes. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprints LiteLLM proxy API /health, OpenAI-compatible routes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

TensorFlow CVE-2024-3660 Detect

Heuristic for TensorFlow Serving / model upload APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Heuristic for TensorFlow Serving / model upload APIs.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "TensorFlow...

WordPress Mail Mint CVE-2026-10196 Detect

Detects Mail Mint ≤ 1.31.0 CVE-2026-10196: plugin readme version and public mint-mail REST nonce on the site front page. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Mail Mint WordPress plugin CVE-2026-10196 exposure.""" import re from kittysploit import from lib.protocols.http.httpclient...

TensorFlow CVE-2024-3660 Keras H5 Lambda RCE

CVE-2024-3660: crafted Keras .h5 with Lambda layer deserializes marshal code via legacy loadmodel path when ML service loads uploads. !/usr/bin/env python3 -- coding: utf-8 -- """TensorFlow/Keras CVE-2024-3660 malicious H5 Lambda layer RCE.""" from future import annotations import codecs import...

x64 AES-128 AES-NI Encoder

Encrypts shellcode with AES-128-ECB and prepends an x64 AES-NI decoder stub requires AES-NI on the target CPU. !/usr/bin/env python3 -- coding: utf-8 -- """AES-128 AES-NI encoder for x64 shellcode — same layout as Awesome-EDR 02 style runners.""" from kittysploit import from core.lib.shellcodeaes...

ImageMagick CVE-2022-44268 PNG profile file read

CVE-2022-44268 ImageMagick = 7.1.0-49: tEXt profile chunk treats value as filename; leaked bytes appear in output PNG when the app processes attacker PNG upload + download workflow. !/usr/bin/env python3 -- coding: utf-8 -- """ImageMagick CVE-2022-44268 PNG profile arbitrary file read.""" from...

Cacti CVE-2022-46169 remote_agent Detect

Detects auth bypass on /remoteagent.php via X-Forwarded-For and pollerid injection surface. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti CVE-2022-46169 remoteagent X-Forwarded-For bypass detect.""" from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient...

WordPress Beaver Builder CVE-2026-92084 detect

Detects Beaver Builder Lite = 2.11.0.5 CVE-2026-92084: Sidebar module widget output may execute registered shortcodes via layout-wide doshortcode. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Beaver Builder Lite CVE-2026-92084 exposure.""" from kittysploit import from...

Bludit CVE-2019-16113 upload traversal RCE

CVE-2019-16113 Bludit 3.9.2: authenticated ajax/upload-images with uuid=../../tmp drops a PHP-capable PNG webshell under /bl-content/tmp/. !/usr/bin/env python3 -- coding: utf-8 -- """Bludit CVE-2019-16113 authenticated upload path traversal RCE.""" from future import annotations import random...

LiteSpeed cPanel Plugin Privesc RCE (CVE-2026-48172)

Exploits CVE-2026-48172 in the LiteSpeed cPanel plugin: mishandled Redis enable/disable API allows privilege escalation and arbitrary command execution as root via crafted cpaneljsonapi requests. !/usr/bin/env python3 -- coding: utf-8 -- """LiteSpeed cPanel plugin privesc to RCE CVE-2026-48172.""...

D-Link DNS-320 login_mgr RCE (CVE-2019-16057)

Exploits CVE-2019-16057 in D-Link DNS-320 str: inj = urllib.parse.quotef'80|cmd', safe='' p...

Ivanti EPMM Authentication Bypass (CVE-2023-35082)

Exploits CVE-2023-35082 in Ivanti EPMM MobileIron Core 11.2 and older: unauthenticated access to /mifs/asfV3/api/v2/admins/users allows admin enumeration and account creation. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPMM/MobileIron unauthenticated API access CVE-2023-35082.""" import...

Zeroshell kerbynet RCE (CVE-2020-29390)

Exploits CVE-2020-29390 in Zeroshell 3.9.3: shell metacharacter injection via ampersand-wrapped commands in StartSessionSubmit User parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet ampersand injection CVE-2020-29390.""" import re import urllib.parse from kittysploit impo...

DFSCoerce NTLM Coercion

Coerces a Windows target to authenticate to an attacker listener via NetrDfsRemoveStdRoot over the netdfs named pipe DFSCoerce. Use with SMB/HTTP relay listeners. !/usr/bin/env python3 -- coding: utf-8 -- """DFSCoerce NTLM coercion via NetrDfsRemoveStdRoot MS-DFSNM.""" from kittysploit import fro...

Zeroshell kerbynet RCE (CVE-2019-12725)

Exploits CVE-2019-12725 in Zeroshell 3.9.0: newline injection in the User parameter of kerbynet StartSessionSubmit yields unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet command injection CVE-2019-12725.""" import re import urllib.parse from kittysploit import...

Flowise NVIDIA NIM Auth Bypass (CVE-2026-30824)

Exploits CVE-2026-30824 in Flowise 3.0.13: /api/v1/nvidia-nim/ routes are whitelisted in auth middleware, allowing unauthenticated token generation and container management API access. !/usr/bin/env python3 -- coding: utf-8 -- """Flowise NVIDIA NIM auth bypass token leak CVE-2026-30824.""" import...

Sonatype Nexus Jexl RCE (CVE-2019-7238)

Exploits CVE-2019-7238 in Nexus Repository Manager 3.15.0: missing ACL on /service/extdirect previewAssets allows Jexl expression remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Sonatype Nexus Repository Manager Jexl RCE CVE-2019-7238.""" import json import re from kittysploit...

Kemp LoadMaster Command Injection (CVE-2024-1212)

Exploits CVE-2024-1212 in Progress Kemp LoadMaster: unauthenticated command injection via /access/set?param=enableapi&value=... management API. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster unauth command injection CVE-2024-1212.""" import re import urllib.parse from...

Buffalo WSR Auth Bypass (CVE-2021-20090)

Exploits CVE-2021-20090 in Buffalo WSR-2533 and Arcadyan-based routers: /images/..%2f traversal bypasses authentication and exposes admin info.html. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo/Arcadyan path traversal auth bypass CVE-2021-20090.""" from kittysploit import from...

bad_epoll UAF LPE (CVE-2026-46242)

Local privilege escalation via CVE-2026-46242 epoll use-after-free. Compiles and uploads exploit to target session for root shell. !/usr/bin/env python3 -- coding: utf-8 -- """Linux LPE via epoll UAF CVE-2026-46242.""" import os import shlex import tempfile from kittysploit import from...

Cisco Secure Email CVE-2026-76461 Detect

Detects on-prem Cisco Secure Email Gateway AsyncOS appliances exposed to CVE-2026-76461 pre-authentication SQL injection in email parsing. Fingerprints the ESA/IronPort login panel and parses AsyncOS release markers to flag branches before fixed builds 15.5.5-014 / 16.0.4-302 / 16.5.0-780...

ILIAS <= 9.21 / 10.9 / 11.2 - PHP Object Injection RCE (CVE-2026-80428)

Unauthenticated PHP object injection in ILIAS via ltiauth.php session seeding and shiblogout.php SOAP LogoutNotification mass-unserialize. Chains GuzzleHttp\Cookie\FileCookieJar to write a webshell under the ILIAS docroot. Fixed in ILIAS 9.22 / 10.10 / 11.3. Packaged ILIAS 11.x shiblogout.php is...

Netcore NAP930 CVE-2026-102240 Detect

Detects CVE-2026-102240 in Netcore NAP930 access points: pre-auth command injection in /cgi-bin/networktools via eval on raw QUERYSTRING before the sid session check. Confirms endpoint presence and optionally writes a marker file to /www/ when activeprobe is enabled. !/usr/bin/env python3 --...

LiteLLM CVE-2026-59822 MCP Auth Bypass Detect

Detects CVE-2026-59822 in LiteLLM proxy before 1.84.0: failed LiteLLM key validation on the MCP Streamable HTTP endpoint falls back to an empty UserAPIKeyAuth object when a fabricated Authorization Bearer is supplied. !/usr/bin/env python3 -- coding: utf-8 -- """Detect LiteLLM CVE-2026-59822 MCP...

Froxlor CVE-2026-100717 CRLF Detect

Detects Froxlor server administration panels affected by CVE-2026-100717 Validate::validateUrl CRLF in userinfo. Versions 2.3.10 and earlier allow authenticated customers with subdomain rights to inject nginx/Apache directives via redirect URLs. Fingerprints Froxlor and compares reported version...

PaperCut CVE-2026-81578 Auth Bypass Detect

Detects CVE-2026-81578 in PaperCut NG/MF before 24.1.10 / 25.0.13 / 26.0.5. Apache Tapestry direct/1/Home/ConfigEditor requests validate only the render page Home while invoking privileged ConfigEditor listeners without a session. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

Apache Solr Backup/Restore RCE (CVE-2023-50386)

Exploits CVE-2023-50386 by uploading a malicious ConfigSet containing SourceParser.class, creating a collection, using BACKUP APIs to place the class on Solr's classpath, then loading it via a second ConfigSet. Requires SolrCloud ZooKeeper. Solr 6.0.0–8.11.2 and 9.0.0–9.4.0. !/usr/bin/env python3...

jQuery File Upload RCE (CVE-2018-9206)

Exploits CVE-2018-9206 by uploading a PHP shell to blueimp jQuery-File-Upload endpoints and executing commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """blueimp jQuery File Upload unauth PHP upload RCE CVE-2018-9206 — execute session.""" from futu...

Apache Solr CVE-2023-50386 Backup/Restore RCE Detection

Detects Apache Solr 6.0.0–8.11.2 / 9.0.0–9.4.0 in SolrCloud mode with reachable ConfigSets API CVE-2023-50386 attack surface. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr CVE-2023-50386 detection backup/restore ConfigSet RCE surface.""" import re from kittysploit import from...

D-Link DIR-645 & DIR-815 RCE

Module exploits D-Link DIR-645 and DIR-815 Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 & DIR-815 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Misfortune Cookie

Exploit implementation for Misfortune Cookie Authentication Bypass vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Misfortune Cookie""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Misfortune...

D-Link DIR-825 Path Traversal

Module exploits D-Link DIR-825 path traversal vulnerability, which allows reading files from the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-825 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

PaperCut Path Traversal File Read (CVE-2023-39143)

Reads files from unpatched PaperCut NG/MF on Windows 22.1.3 via CustomReportExample path traversal. Optional WebDAV COPY stages unreadable paths into data/scan/webdav before download. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-39143 — PaperCut NG/MF Windows path traversal file read."""...

phpMyAdmin - server_sync.php Backdoor Detection (CVE-2012-5159)

Detects CVE-2012-5159 by POSTing c=phpinfo; to /serversync.php. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin serversync.php backdoor CVE-2012-5159.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyAdmi...

ManageEngine SDP - FILENAME Traversal Detection (CVE-2011-2757)

Detects CVE-2011-2757 via FileDownload.jsp?module=agent&FILENAME=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-2757 via FileDownload.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

CasaOS - Arbitrary File Read via users/image (CVE-2024-24765)

CasaOS-UserService 0.4.7 insufficiently filters the path parameter of /v1/users/image, allowing unauthenticated arbitrary file read e.g. user.db /etc/passwd — CVE-2024-24765. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS-UserService arbitrary file read via /v1/users/image CVE-2024-24765."""...

eXtplorer - password[] Auth Bypass Detection

Detects eXtplorer auth bypass via password= empty array login as admin. !/usr/bin/env python3 -- coding: utf-8 -- """eXtplorer password authentication bypass.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'eXtplorer...

QNAP QTS - authLogin.cgi RCE (CVE-2017-6361)

Exploits command injection in QNAP /cgi-bin/authLogin.cgi rebootnoticemsg. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP QTS authLogin.cgi RCE CVE-2017-6361 — opens execute session.""" import base64 import re import time from kittysploit import from...

Piwik - Loader.php Backdoor Detection

Detects Piwik analytics backdoor via /core/Loader.php?s=1&g=system'id'. !/usr/bin/env python3 -- coding: utf-8 -- """Piwik Loader.php backdoor RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Piwik -...

CasaOS - Unauth Config/Debug Leak (CVE-2025-34171)

Fetches CasaOS /v1/sys/debug and /v1/users/image?path=/var/lib/casaos/1/ without authentication CVE-2025-34171. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS unauthenticated config/debug leak CVE-2025-34171.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

hybris Commerce - medias context File Read (CVE-2014-8871)

Reads arbitrary files via CVE-2014-8871 base64 context parameter on /medias/. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce medias context file read CVE-2014-8871.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Intel AMT - Digest Auth Bypass Detection (CVE-2017-5689)

Detects CVE-2017-5689 INTEL-SA-00075 by replaying Digest Authorization with empty response and checking access to /index.htm hardware info. !/usr/bin/env python3 -- coding: utf-8 -- """Intel AMT/ISM empty Digest response auth bypass CVE-2017-5689.""" import re from kittysploit import from...