Docmosis Tornado storeTo file write cron RCE

Anonymous POST /api/render with storeTo=file:/etc/cron.d/... writes a cron line as root when the service runs with elevated privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Docmosis Tornado unauthenticated storeTo=file arbitrary write → cron root RCE.""" from future import annotations...

CIRCUTOR PowerStudio SCADA WAVE Unauthenticated shellExecute SYSTEM RCE — Detect

Fingerprint / reachability check for CIRCUTOR PowerStudio SCADA WAVE Unauthenticated shellExecute SYSTEM RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CIRCUTOR PowerStudio SCADA WAVE Unauthenticated shellExecute SYSTEM RCE""" from kittysploit import from...

Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE — Detect

Fingerprint / reachability check for Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE""" from kittysploit import from...

Veeam ONE Reporter CommandExecutor authenticated RCE

PowerUser+ OAuth token; dashboard schedule reportSettings.command runs as VeeamSvc local Administrators. !/usr/bin/env python3 -- coding: utf-8 -- """Veeam ONE Reporter dashboard schedule CommandExecutor RCE.""" from future import annotations import json import time from kittysploit import from...

Raritan EMX — Authenticated Config Injection into port_mux proto_listener → Root — Detect

Fingerprint / reachability check for Raritan EMX — Authenticated Config Injection into portmux protolistener → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Raritan EMX — Authenticated Config Injection into portmux protolistener → Root RCE""" from kittysploit import from...

Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx Leadin — Detect

Fingerprint / reachability check for Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx Leading to Code Execution in the IIS Worker Process !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx...

Ahsay CBS CVE-2026-105134 UpdateReceivers command injection

CVE-2026-105134: Ahsay AhsayCBS Replication Receiver POST /rps/api/json/UpdateReceivers.do passes the JSON random field into a shell command without sanitization. Supports confirm-only echo injection whoami/id when stdout is reflected in JSON, or time-based check. !/usr/bin/env python3 -- coding:...

Samba CVE-2007-2447 usermap script RCE

CVE-2007-2447 Samba 3.0.20: SMB Session Setup username is passed unsanitized to username map script when configured — shell injection. !/usr/bin/env python3 -- coding: utf-8 -- """Samba CVE-2007-2447 username map script command injection.""" from future import annotations import socket import tim...

GitPython CVE-2022-24439 ext URL RCE

CVE-2022-24439 GitPython = 3.1.29: malicious ext::sh clone URL runs shell commands when an HTTP app passes user input to clonefrom with protocol.ext.allow=always. !/usr/bin/env python3 -- coding: utf-8 -- """GitPython CVE-2022-24439 ext:: transport RCE via clone URL injection.""" from future impo...

CMS Made Simple CVE-2019-9053 SQLi Detect

Time-based blind SQLi on moduleinterface.php News m1idlist. !/usr/bin/env python3 -- coding: utf-8 -- """CMS Made Simple CVE-2019-9053 time-based SQLi detection.""" from future import annotations import time from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Nezha CVE-2026-53519 Detect

Fingerprints Nezha monitoring dashboard/API. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprints Nezha monitoring dashboard/API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Nezha CVE-2026-53519 Detect",...

WordPress Unlimited Elements CVE-2026-103355 detect

Detects Unlimited Elements for Elementor = 2.0.20 CVE-2026-103355: terms-listing widget may concatenate parent-term IDs into SQL unvalidated. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Unlimited Elements for Elementor CVE-2026-103355 exposure.""" from kittysploit import from...

Joomla Helix3 <= 3.1.1 - Unauthenticated Arbitrary File Write (CVE-2026-49049)

CVE-2026-49049 in JoomShaper Helix3 = 3.1.1: unauthenticated file write via comajax helix3 save path traversal in layoutName, arbitrary file delete via remove, and template parameter overwrite via import Helix3 v3.x. The save action always appends .json — no reliable shell; use for authorized fil...

AWS Loom CVE-2026-103956 unauthenticated super-admin

CVE-2026-103956 Loom for AWS 1.6.1: when Cognito / external IdP is unset, getcurrentuser grants t-admin / g-admins-super without Authorization. Confirms via GET /api/auth/me and optional read-only MCP server listing. !/usr/bin/env python3 -- coding: utf-8 -- """AWS Loom for AWS unauthenticated...

Magento CVE-2015-1397 Shoplift admin SQLi

CVE-2015-1397 Magento CE = 1.9.0.1: stacked SQLi via CmsWysiwyg/directive/index creates a full admin user without SUPEE-5344. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CE CVE-2015-1397 Shoplift unauthenticated admin SQLi.""" from future import annotations import base64 import re from...

WordPress Beaver Builder CVE-2026-92084 shortcode execution

CVE-2026-92084 Beaver Builder Lite = 2.11.0.5: posts a comment whose author name contains a registered shortcode; if the builder page Sidebar module renders Recent Comments, doshortcode executes the payload on page render. Requires comment approval auto-approve or moderator. Lab marker shortcode...

ISPConfig CVE-2023-46818 Detect

Detects ISPConfig panel login. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ISPConfig panel login.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "ISPConfig CVE-2023-46818 Detect", "description": "Detects...

OpenNetAdmin CVE-2019-25065 Detect

Detects OpenNetAdmin installation. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenNetAdmin installation.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "OpenNetAdmin CVE-2019-25065 Detect", "description":...

pyLoad CVE-2023-0297 Detect

Fingerprints pyLoad UI and /flash/addcrypted2 endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """pyLoad CVE-2023-0297 /flash/addcrypted2 js2py surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "pyLoad...

CrushFTP CVE-2025-31161 auth bypass user creation

CVE-2025-31161: crafted CrushAuth / AWS4 Authorization headers allow unauthenticated setUserItem on /WebInterface/function/, creating a new FTP/WebInterface user. Default is detect-only; set confirm=true to create the configured account destructive. !/usr/bin/env python3 -- coding: utf-8 --...

Next.js CVE-2024-34351 Detect

Detects Next.js Server Actions / middleware headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Next.js Server Actions / middleware headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Next.js...

WordPress WPMobile.App CVE-2026-94541 detect

Detects WPMobile.App plugin = 11.82 CVE-2026-94541: unauthenticated wpappcategory subscription updates when mail-to-push mirrors wpmail. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WPMobile.App wpappninja CVE-2026-94541 exposure.""" import re from kittysploit import from...

Callback Execution Evasion

Run decrypted shellcode through a Windows callback API EnumWindows or CreateTimerQueueTimer instead of CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from lib.compile.callbackexecution...

Anuko Time Tracker CVE-2022-24707 Detect

Fingerprints Anuko Time Tracker login/register surface. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprints Anuko Time Tracker login/register surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Anuko Time...

HFS CVE-2014-6287 Detect

Detects HttpFileServer HFS web UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detects HttpFileServer HFS web UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "HFS CVE-2014-6287 Detect", "description": "Detects...

Joomla DJ-Classifieds CVE-2026-61424 detect

Detects comdjclassifieds imageupload task CVE-2026-61424: unauthenticated file write to tmp/djupload/ in DJ-Classifieds 3.9.5. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Joomla DJ-Classifieds CVE-2026-61424 imageupload exposure.""" from kittysploit import from lib.protocols.http.httpclie...

Metabase CVE-2026-72898 SQLi Detect

Probes POST /api/session/resetpassword for undeclared user-id :raw acceptance and optional pgsleep timing oracle. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2026-72898 resetpassword SQLi detection.""" from future import annotations import json import re import time from kittysploit...

Wing FTP Server CVE-2025-47812 unauth Lua RCE

CVE-2025-47812 Wing FTP = 7.4.3: NULL-byte truncation in loginok.html breaks out of the per-session Lua username string and injects io.popen when dir.html loads the session. Works with anonymous login when enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Wing FTP Server CVE-2025-47812...

MikroTik RouterOS CVE-2026-67279 SSH session bypass

CVE-2026-67279: RouterOS 6.42 and related 6.x builds before 6.49.21 may accept a new SSH session channel after a client-initiated rekey while the control channel no rekey is refused. Default mode is safe detect-only; set confirm=true to run read-only RouterOS commands on an interactive shell...

Adobe ColdFusion CVE-2009-2265 FCKeditor Detect

Detects CFIDE FCKeditor upload.cfm connector null-byte upload class. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion 8 CVE-2009-2265 FCKeditor upload surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Adminer CVE-2020-35572 Detect

Detects Adminer database console elasticsearch plugin LFI chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adminer database console elasticsearch plugin LFI chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

ConnectWise ScreenConnect Guest Transfer (CVE-2026-84869)

Targets CVE-2026-84869 in ScreenConnect before 26.6.5.9742: guest file transfer without Host confirmation during active sessions. Validates vulnerable build markers and probes guest-accessible transfer endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """ConnectWise ScreenConnect guest file...

D-Link DIR-600M Auth Bypass (CVE-2019-13101)

Exploits CVE-2019-13101 in D-Link DIR-600M: unauthenticated access to WAN configuration pages such as /wan.htm. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-600M auth bypass CVE-2019-13101.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

NUUO NVRmini Command Injection (CVE-2018-14933)

Exploits CVE-2018-14933 in NUUO NVRmini via command injection in the uploaddir parameter of upgradehandle.php. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini upgradehandle.php RCE CVE-2018-14933.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclien...

ThinkPHP 5.0.23 RCE (CVE-2018-20062)

Exploits CVE-2018-20062 in ThinkPHP 5.0.23 via calluserfuncarray in index/think\app/invokefunction for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.0.23 invokefunction RCE CVE-2018-20062.""" import re from kittysploit import from lib.protocols.http.httpclient...

N-able N-central Pre-Auth RCE (CVE-2026-86218)

Exploits CVE-2026-86218 in N-able N-central builds before 2026.3.1.14: pre-authentication static code injection via /remoteControlAction.do getPierDetails allows arbitrary Java code execution on the N-central server. !/usr/bin/env python3 -- coding: utf-8 -- """N-able N-central pre-auth static co...

D-Link DAP-1620 LFI (CVE-2021-46381)

Exploits CVE-2021-46381 in D-Link DAP-1620: path traversal via htmlresponsepage in POST /apply.cgi reads /etc/passwd and /etc/shadow without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-1620 apply.cgi traversal LFI CVE-2021-46381.""" import re from kittysploit import fr...

HPE iLO4 Authentication Bypass (CVE-2017-12542)

Exploits CVE-2017-12542 in HPE Integrated Lights-Out 4 before 2.53: unauthenticated REST access to /rest/v1/AccountService/Accounts and related APIs. !/usr/bin/env python3 -- coding: utf-8 -- """HPE iLO4 authentication bypass CVE-2017-12542.""" import json from kittysploit import from...

Ruby on Rails YAML Deserialization RCE (CVE-2013-0156)

Exploits CVE-2013-0156 in Rails 3.x: XML requests with type=yaml deserialize attacker-controlled YAML into Ruby objects, reaching Kernelsystem via Gem gadgets. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails XML/YAML deserialization RCE CVE-2013-0156.""" from kittysploit import from...

GL.iNET Wi-Fi Key Disclosure (CVE-2023-31478)

Exploits CVE-2023-31478 in GL.iNet routers 3.216: unauthenticated POST to /api/router/mesh/status leaks SSID and Wi-Fi encryption key. !/usr/bin/env python3 -- coding: utf-8 -- """GL.iNET mesh status Wi-Fi key disclosure CVE-2023-31478.""" from kittysploit import from lib.protocols.http.httpclien...

QNAP Photo Station File Read (CVE-2019-7192)

Exploits CVE-2019-7192 in QNAP Photo Station: album/slideshow workflow plus filename traversal in /p/api/video.php reads arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP Photo Station path traversal file read CVE-2019-7192.""" import re from kittysploit import from...

D-Link DIR-868L Credential Leak (CVE-2019-17506)

Exploits CVE-2019-17506 in D-Link DIR-868L/817LW: unauthenticated POST to getcfg.php with AUTHORIZEDGROUP newline injection returns admin credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-868L getcfg credential leak CVE-2019-17506.""" from kittysploit import from...

Progress LoadMaster Command Injection (CVE-2026-8037)

Exploits CVE-2026-8037 unauthenticated OS command injection in Progress ADC LoadMaster /accessv2 JSON API via malformed g0-g15 fields WatchTowr pattern. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster pre-auth command injection CVE-2026-8037.""" import json import re from...

Netis Router Info Disclosure (CVE-2024-48455)

Exploits CVE-2024-48455 in Netis WiFi routers: unauthenticated POST to skkget.cgi with modename/wllink leaks device stats and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Netis router skkget.cgi info disclosure CVE-2024-48455.""" from kittysploit import from...

NETGEAR Debug Auth Bypass (CVE-2020-27866)

Exploits CVE-2020-27866 on multiple NETGEAR routers: unauthenticated access to /setup.cgi?todo=debug exposes debug mode and configuration pages. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR password recovery auth bypass CVE-2020-27866.""" from kittysploit import from...

Kibana Console Path Traversal LFI (CVE-2018-17246)

Exploits CVE-2018-17246 in Kibana 6.4.3 / 5.6.13: path traversal in /api/console/apiserver apis parameter reads arbitrary local files. !/usr/bin/env python3 -- coding: utf-8 -- """Kibana Console plugin path traversal LFI CVE-2018-17246.""" import re from kittysploit import from...

SolarWinds WHD Deserialization RCE (CVE-2024-28986)

Exploits CVE-2024-28986 in SolarWinds Web Help Desk 12.8.3: Java deserialization on Helpdesk.woa endpoints allows remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """SolarWinds Web Help Desk deserialization RCE CVE-2024-28986.""" import re from kittysploit import from...

PaperCut NG/MF Pre-Auth RCE (CVE-2026-81578 + CVE-2026-82078)

Chains CVE-2026-81578 Tapestry direct-service auth bypass with CVE-2026-82078 external user-lookup JDBC abuse. On PaperCut 26.x, reconfigures H2 INIT SQL to evaluate Groovy that launches a shell command, then restores factory lookup settings. !/usr/bin/env python3 -- coding: utf-8 -- """PaperCut...

Stage Verify (PowerShell)

Verify staged artifact SHA256 before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify PowerShell", "description": "Verify staged artifact SHA256 before callback",...

Capability Probe (Zig)

Detect OS, architecture, runtime, privileges, writable directory, and network capabilities before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "capabilityprobe" info = "name": "Capability Probe Zig",...