Dahua Devices - Path Traversal Account Leak (CVE-2024-13130)

Multiple Dahua devices and OEMs allow path traversal to ../mtd/Config/Sha1Account1 or Account1, leaking SerialID and Password hashes. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua and OEM path traversal to account config files CVE-2024-13130.""" from kittysploit import from...

Beward IP Camera - servetest NTP Command Injection (CVE-2025-34042)

Exploits Beward camera command injection in ServerName of /cgi-bin/operator/servetest?cmd=ntp. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera servetest NTP RCE — opens execute session.""" import re from urllib.parse import quote from kittysploi...

NETGEAR DGN - setup.cgi syscmd RCE (CVE-2024-12847)

Exploits unauthenticated setup.cgi?todo=syscmd command injection. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGN setup.cgi syscmd RCE CVE-2024-12847 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

ManageEngine SDP - FILENAME Traversal Detection (CVE-2011-2757)

Detects CVE-2011-2757 via FileDownload.jsp?module=agent&FILENAME=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-2757 via FileDownload.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

CasaOS - Arbitrary File Read via users/image (CVE-2024-24765)

CasaOS-UserService 0.4.7 insufficiently filters the path parameter of /v1/users/image, allowing unauthenticated arbitrary file read e.g. user.db /etc/passwd — CVE-2024-24765. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS-UserService arbitrary file read via /v1/users/image CVE-2024-24765."""...

eXtplorer - password[] Auth Bypass Detection

Detects eXtplorer auth bypass via password= empty array login as admin. !/usr/bin/env python3 -- coding: utf-8 -- """eXtplorer password authentication bypass.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'eXtplorer...

QNAP QTS - authLogin.cgi RCE (CVE-2017-6361)

Exploits command injection in QNAP /cgi-bin/authLogin.cgi rebootnoticemsg. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP QTS authLogin.cgi RCE CVE-2017-6361 — opens execute session.""" import base64 import re import time from kittysploit import from...

Piwik - Loader.php Backdoor Detection

Detects Piwik analytics backdoor via /core/Loader.php?s=1&g=system'id'. !/usr/bin/env python3 -- coding: utf-8 -- """Piwik Loader.php backdoor RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Piwik -...

CasaOS - Unauth Config/Debug Leak (CVE-2025-34171)

Fetches CasaOS /v1/sys/debug and /v1/users/image?path=/var/lib/casaos/1/ without authentication CVE-2025-34171. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS unauthenticated config/debug leak CVE-2025-34171.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

hybris Commerce - medias context File Read (CVE-2014-8871)

Reads arbitrary files via CVE-2014-8871 base64 context parameter on /medias/. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce medias context file read CVE-2014-8871.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Intel AMT - Digest Auth Bypass Detection (CVE-2017-5689)

Detects CVE-2017-5689 INTEL-SA-00075 by replaying Digest Authorization with empty response and checking access to /index.htm hardware info. !/usr/bin/env python3 -- coding: utf-8 -- """Intel AMT/ISM empty Digest response auth bypass CVE-2017-5689.""" import re from kittysploit import from...

D-Link DSR - Default Credentials Detection

Tries admin:admin against /scgi-bin/platform.cgi on D-Link DSR devices and looks for authenticated UI markers or already-logged-in session prompts. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSR devices default credentials admin:admin.""" from urllib.parse import quote from kittysploit...

D-Link DAP-2020 - webproc File Read (CVE-2021-27250)

Reads arbitrary files from D-Link DAP-2020 via POST /cgi-bin/webproc errorpage= parameter CVE-2021-27250. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-2020 webproc errorpage arbitrary file read CVE-2021-27250.""" from kittysploit import from lib.protocols.http.httpclient import...

PTZOptics Camera - Unauth RCE via NTP Config (CVE-2024-8957)

Chains CVE-2024-8956 missing auth on param.cgi with CVE-2024-8957 OS command injection in ntpaddr. Delivers a reverse CMD payload via POST /cgi-bin/param.cgi?postnetworkotherconf and waits for a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """PTZOptics / VHD camera unauthenticated RCE...

osCommerce - file_manager.php Arbitrary Upload Detection (CVE-2009-20006)

Detects CVE-2009-20006 by uploading a marker PHP via admin/filemanager.php/login.php?action=save. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2009-20006 by uploading a marker PHP via admin/filemanager.""" import re from kittysploit import from lib.protocols.http.httpclient import...

ManageEngine Desktop Central - FileUploadServlet Detection (CVE-2015-8249)

Detects CVE-2015-8249 by uploading a JSP via FileUploadServlet connectionId path traversal into jspf/ and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central FileUploadServlet path traversal CVE-2015-8249.""" from kittysploit import from...

TWiki - debugenableplugins RCE Detection (CVE-2014-7236)

Detects CVE-2014-7236 by injecting Perl systemid via debugenableplugins on /view/Main/WebHome. !/usr/bin/env python3 -- coding: utf-8 -- """TWiki debugenableplugins RCE CVE-2014-7236.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import...

SAP NetWeaver Portal - ConfigServlet RCE Detection

Detects SAP ConfigServlet command execution via EXECUTECMD;CMDLINE=id on /ctc/servlet/ConfigServlet/. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Portal ConfigServlet RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

ManageEngine DC - statusUpdate Upload Detection (CVE-2014-5005)

Detects CVE-2014-5005/5006 by uploading a JSP via statusUpdate LFU path traversal and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central statusUpdate arbitrary file upload CVE-2014-5005.""" from kittysploit import from lib.protocols.http.httpclient impo...

Emby Server - swagger-ui Path Traversal Detection

Detects Emby Server =3.2.5 directory traversal via encoded /emby/swagger-ui/../../../../etc/passwd path. !/usr/bin/env python3 -- coding: utf-8 -- """Emby Server swagger-ui path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

SiYuan MCP Auth Bypass (CVE-2026-66012)

CVE-2026-66012 in SiYuan kernel 3.7.0 = v 3.7.2 fixed 3.7.2: POST /mcp on the Publish port checks auth presence only and accepts RoleReader. With anonymous Publish mode Conf.Publish.Enable=true, Conf.Publish.Auth.Enable=false all MCP tools including file read/write reach the workspace without...

Flowise TypeORM RCE (CVE-2026-69251)

Exploits CVE-2026-69251 in Flowise = 3.1.2 fixed 3.1.3: record-manager nodes spread additionalConfig JSON into TypeORM DataSource; entities globs trigger require of attacker-uploaded JavaScript during initialize. Chains first-account register, cookie login, File Loader upload, and...

WordPress Instant Appointment RCE (CVE-2026-15282)

Exploits CVE-2026-15282 in Instant Appointment = 1.2: unauthenticated addservicefront AJAX passes imageurl/imagename to filegetcontents and fileputcontents. Delivers the configured framework PHP payload via data:// base64 primary or a local HTTP server fallback, writes under wp-content/uploads/,...

ASUS GT-AC2900 - Authentication Bypass Detection

ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator application. This relates to handlerequest in router/httpd/httpd.c and authcheck in webhook.o. An...

WordPress Mailchimp for WordPress Plugin - Full Path Disclosure Detection

WordPress plugin MC4WP: Mailchimp for WordPress internal file system path is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress plugin MC4WP: Mailchimp for WordPress internal file system path is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

ChurchCRM - API Authentication Bypass via URL Injection Detection

ChurchCRM 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public !/usr/bin/env python3 -- coding...

Zenphoto <1.5 Installer - Detect

Zenphoto setup page before version 1.5 is susceptible to sensitive information disclosure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Zenphoto setup page before version 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Zzcms `register_nodb.php` - Cross Site Scripting Detection

Identified a reflected Cross-Site Scripting XSS vulnerability in registernodb.php of ZZCMS, which allowed injection of malicious scripts via user-supplied input. !/usr/bin/env python3 -- coding: utf-8 -- """Identified a reflected Cross-Site Scripting XSS vulnerability in registernodb.""" from...

Apache Kafka Broker Detection

Detects Kafka brokers by sending an ApiVersions request on TCP 9092. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Kafka brokers via ApiVersions on TCP 9092.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.kafka.detectors...

Unauth Hawkeye Dashboard - Detect

Hawkeye Dashboard was detected and appeared to be accessible without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Hawkeye Dashboard was detected and appeared to be accessible without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

GE Proficy WebSpace - Login Panel Detection

GE Proficy WebSpace is a thin-client delivery platform for GE Proficy HMI/SCADA iFIX, CIMPLICITY applications over the web. It exposes industrial HMI screens via browser on TCP/491 by default. The Server header "WebSocket++/0.7.0" is a unique indicator. !/usr/bin/env python3 -- coding: utf-8 --...

FXServer < v9601 - Information Exposure Detection

Incorrect Access Control in FXServer version's v9601 and prior, for CFX.re FiveM, allows unauthenticated users to modify and read userdata via exposed api endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Incorrect Access Control in FXServer version's v9601 and prior, for CFX.""" from...

TP-Link Archer A20 v3 Router - Cross-site Scripting Detection

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

Alibaba Druid Monitor Unauthorized Access Detection

Alibaba Druid Monitor is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Alibaba Druid Monitor is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Alibaba Druid Monitor Unauthorized Access Detection',...

Odoo - Database Manager Discovery Detection

Odoo database manager was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Odoo database manager was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Odoo - Database Manager Discovery Detection',...

XWiki Platform - Path Traversal Detection

XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform 4.""" from...

Array Networks SSL VPN - Login Panel Detection

Array Networks AG Series SSL VPN appliances provide enterprise remote access. The web login portal Pilot is typically accessible on port 8889 or via /prx/ paths. !/usr/bin/env python3 -- coding: utf-8 -- """Array Networks AG Series SSL VPN appliances provide enterprise remote access.""" from...

Sophos Firewall <=18.5 MR3 - Remote Code Execution Detection

Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall version v18.""" from kittysploit import from...

Ivanti Cloud Services Appliance - Path Traversal Detection

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. !/usr/bin/env python3 -- coding: utf-8 -- """Path Traversal in the Ivanti CSA before 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

LearnDash LMS < 4.10.3 - Sensitive Information Exposure Detection

The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions. !/usr/bin/env python3 -- coding: utf-8 -- """The LearnDash LMS plug...

CrushFTP WebInterface Panel - Detect

CrushFTP WebInterface login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CrushFTP WebInterface login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CrushFTP WebInterface Panel...

WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting Detection

WordPress Goto Tour & Travel theme before 2.0 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize the keywords and startdate GET parameters on its Tour List page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Goto Tour & Travel theme before 2.""...

Python Flask-Security - Open Redirect Detection

Python Flask-Security contains an open redirect vulnerability. Existing code validates that the URL specified in the next parameter is either relative or has the same network location as the requesting URL. Certain browsers accept and fill in the blanks of possibly incomplete or malformed URLs. A...

Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass Detection

Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x are vulnerable to authentication bypass. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the...

ConnectWise Setup Wizard - Exposure Detection

Detects ConnectWise Setup Wizard - Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ConnectWise Setup Wizard - Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ConnectWise Setup Wizard - Exposu...

Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion Detection

A directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. This can be leveraged to execute arbitrary code by obtaining LDAP...

TIBCO JasperReports Library - Directory Traversal Detection

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for...

Craft CMS Admin Login Panel - Detect

Craft CMS admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Craft CMS admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Craft CMS Admin Login Panel - Detect',...

Cacti - Cross-Site Scripting Detection

Cacti contains a cross-site scripting vulnerability via "http:///authchangepassword.php?ref=alert1" which can successfully execute the JavaScript payload present in the "ref" URL parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti contains a cross-site scripting vulnerability via...

Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read Detection

Citrix ShareFile StorageZones aka storage zones Controller versions through at least 5.10.x are susceptible to an unauthenticated arbitrary file read vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix ShareFile StorageZones aka storage zones Controller versions through at least...