Swim Team <= v1.44.10777 - Local File Inclusion Detection

The program /wp-swimteam/include/user/download.php allows unauthenticated attackers to retrieve arbitrary files from the system. !/usr/bin/env python3 -- coding: utf-8 -- """The program /wp-swimteam/include/user/download.""" import re from kittysploit import from lib.protocols.http.httpclient...

ThinkPHP 5.0.23 RCE (CVE-2018-20062)

Exploits CVE-2018-20062 in ThinkPHP 5.0.23 via calluserfuncarray in index/think\app/invokefunction for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.0.23 invokefunction RCE CVE-2018-20062.""" import re from kittysploit import from lib.protocols.http.httpclient...

Stage Verify (PowerShell)

Verify staged artifact SHA256 before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify PowerShell", "description": "Verify staged artifact SHA256 before callback",...

OmniPCX - masterCGI RCE (CVE-2007-3010)

Exploits CVE-2007-3010 by injecting OS commands into the user parameter of /cgi-bin/masterCGI. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Alcatel-Lucent OmniPCX masterCGI RCE CVE-2007-3010 — execute session.""" from future import annotations import re from...

phpMyFAQ - Compromised Package Backdoor RCE (CVE-2010-4558)

Exploits CVE-2010-4558 by sending base64 PHP via phpmyfaqnew parameter. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ backdoor RCE CVE-2010-4558.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class...

MediaWiki CVE-2026-58025 Detect

Fingerprints MediaWiki and flags versions affected by CVE-2026-58025: LogEntryBase::extractParams called unserialize on user-controlled logparams from WikiImporter XML . Affected: Optionalbool: """Affected: 1 else 0 patch = parts2 if lenparts 2 else 0 if minor = 46: return False if minor == 45:...

KubeOperator Foreground `kubeconfig` - File Download Detection

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used t...

Pi-hole Reflected XSS in 404-Error Page Detection

Pi-hole Admin Interface = 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the class attribute of the body tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. !/usr/bin/env python3 --...

ChurchCRM Panel - Detect

ChurchCRM panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ChurchCRM Panel - Detect', 'description': 'ChurchCRM panel...

FUDForum 3.1.0 - Cross-Site Scripting Detection

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUDForum 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Joomla! Component com_rokdownloads - Local File Inclusion Detection

A directory traversal vulnerability in the RokDownloads comrokdownloads component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory...

Toshiba TopAccess Panel - Detect

Detects Toshiba TopAccess Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Toshiba TopAccess Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Toshiba TopAccess Panel - Detect',...

Reflected XSS Detection

Reflected cross-site scripting vulnerability was discovered via generic testing. Manual testing is needed to verify exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected cross-site scripting vulnerability was discovered via generic testing.""" from kittysploit import from...

Apache Tomcat Tribes EncryptInterceptor bypass (CVE-2026-34486)

Cleartext Tribes ChannelReceiver traffic may be deserialized after failed decryption EncryptInterceptor. Provide command CommonsCollections6, no JVM or serializedpath for a custom chain. Requires commons-collections 3.x on the target matching this gadget. !/usr/bin/env python3 -- coding: utf-8 --...

Stage Cache (PowerShell)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Linksys SMART WiFi Password Disclosure

Exploit implementation for Linksys SMART WiFi Password Disclosure vulnerability. If target is vulnerable administrator's MD5 passsword is retrieved. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys SMART WiFi Password Disclosure""" import re from kittysploit import from...

Orkes Conductor CVE-2026-58138 (unauthenticated RCE) detection

Detects Conductor OSS / Orkes Conductor instances running a version below 3.30.2 that may be vulnerable to CVE-2026-58138 unauthenticated INLINE JavaScript RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Orkes Conductor / Conductor OSS instances vulnerable to CVE-2026-58138.""" from futu...

ONVIF Client

Discovers an ONVIF device service, loads Media/PTZ/Events capabilities, and creates an interactive ONVIF shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ONVIF bind listener — opens an interactive ONVIF camera session.""" from kittysploit import from lib.protocols.onvif.client import...

Msmtp - Config Exposure Detection

Msmtp configuration was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Msmtp configuration was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Msmtp - Config Exposure Detection', 'description':...

Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting Detection

A cross-site scripting vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in the...

Chyrp 2.x - Local File Inclusion Detection

A directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the action parameter to the default URI. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in Chyrp...

Pega Infinity - Authentication Bypass Detection

Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass vulnerability because the password reset functionality for local accounts can be used to bypass local authentication checks. !/usr/bin/env python3 -- coding: utf-8 -- """Pega Infinity versions 8.""" from kittysploit impor...

Celonis Login - Panel Detection

Detects Celonis Process Intelligence login panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Celonis Process Intelligence login panels.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Celonis Login - Panel...

Directum Login Panel - Detect

Directum login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Directum login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Directum Login Panel - Detect', 'description':...

Ship Manager DNV - Panel Detection

Ship Manager DNV Login Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Ship Manager DNV Login Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ship Manager DNV - Panel Detection',...

Qualys Cloud Platform Login Panel - Detect

Qualys Cloud Platform login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Qualys Cloud Platform login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Qualys Cloud Platform Login...

Keycloak JSON File Detection

Detects Keycloak JSON File. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Keycloak JSON File.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Keycloak JSON File Detection', 'description': 'Detects Keycloak JSO...

Adobe ColdFusion - Cross-Site Scripting Detection

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

SAPControl ReadDeveloperTrace Log - Disclosure Detection

Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the ReadDeveloperTrace web method without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the...

Procfile Config - Detect

Procfile configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Procfile configuration information was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Procfile Config...

RomPager Misfortune Cookie Auth Bypass (CVE-2014-9222)

Exploits CVE-2014-9222 in Allegro RomPager: malformed C107373883 cookie bypasses authentication on embedded device admin interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Allegro RomPager Misfortune Cookie auth bypass CVE-2014-9222.""" from kittysploit import from...

Tenda AC1200 Auth Bypass (CVE-2022-40843)

Exploits CVE-2022-40843 in Tenda AC1200 V-W15Ev2: empty W15Ev2user cookie bypasses authentication and exposes syslog/config containing admin password hash. !/usr/bin/env python3 -- coding: utf-8 -- """Tenda AC1200 session auth bypass CVE-2022-40843.""" import re from kittysploit import from...

Güralp MAN-EAM XXE LFI (CVE-2022-38840)

Exploits CVE-2022-38840 in Güralp MAN-EAM-0003 3.2.4: XXE via xmldata in POST /cgi-bin/xmlstatus.cgi reads local files such as /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Güralp MAN-EAM-0003 xmlstatus XXE LFI CVE-2022-38840.""" import re from kittysploit import from...

MOVEit Transfer CVE-2023-34362 Detect

Detects Progress MOVEit Transfer instances exposing the CVE-2023-34362 attack surface: /moveitisapi/moveitisapi.dll?action=m2 header-smuggling path and guestaccess.aspx guest session workflow. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Progress MOVEit Transfer CVE-2023-34362 SQLi...

FortiWeb Reflected XSS (CVE-2021-22122)

Exploits CVE-2021-22122 in FortiWeb 6.2/6.3: unauthenticated reflected XSS via error3 and omnisuccess API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """FortiWeb reflected XSS CVE-2021-22122.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ManageEngine ServiceDesk RCE (CVE-2021-44077)

Exploits CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus: unauthenticated zip upload to /RestAPI/ImportTechnicians achieves path traversal and RCE. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus ImportTechnicians RCE CVE-2021-44077.""" import io import zipfile fro...

Zerologon CVE-2020-1472 Detect

Detects CVE-2020-1472 Zerologon by attempting Netlogon NetrServerAuthenticate3 with all-zero credentials against the domain controller Netlogon RPC interface TCP/135 or 445. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zerologon Netlogon authentication bypass CVE-2020-1472.""" from...

Oracle EBS Unauth Upload RCE (CVE-2022-21587)

Exploits CVE-2022-21587 in Oracle EBS 12.2.3–12.2.11: unauthenticated file upload via BneOfflineLOVService uueupload extracts a JSP webshell under /forms/. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle E-Business Suite BneOfflineLOVService RCE CVE-2022-21587.""" import uuid from kittysploit...

CKAN DataStore SQL Injection (CVE-2026-42031)

Exploits CVE-2026-42031 unauthenticated SQL injection in CKAN datastoresearchsql API via PostgreSQL tsrewrite primitives. !/usr/bin/env python3 -- coding: utf-8 -- """CKAN datastoresearchsql unauth SQLi CVE-2026-42031.""" import json import urllib.parse from kittysploit import from...

PaperCut NG/MF Pre-Auth RCE (CVE-2026-81578 + CVE-2026-82078)

Chains CVE-2026-81578 Tapestry direct-service auth bypass with CVE-2026-82078 external user-lookup JDBC abuse. On PaperCut 26.x, reconfigures H2 INIT SQL to evaluate Groovy that launches a shell command, then restores factory lookup settings. !/usr/bin/env python3 -- coding: utf-8 -- """PaperCut...

AirLive cgi_test.cgi RCE (CVE-2015-2279)

Exploits CVE-2015-2279 OS command injection in /cgitest.cgi via the writetan parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AirLive cgitest.cgi command injection RCE CVE-2015-2279 — execute session.""" from future import annotations import re from...

Miele Professional PG 8528 Path Traversal

Module exploits Miele Professional PG 8528 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Miele Professional PG 8528 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

Daemonize Process (Python)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Python", "description": "Detach from the controlling terminal on...

Blocksy Companion <= 2.1.46 - Unauthenticated File Upload RCE (CVE-2026-58480)

CVE-2026-58480: unauthenticated arbitrary file upload via blc-review-images in blcsavereviewattachments. Double-extension bypass .woff2.php when Advanced Reviews and Custom Fonts are enabled. Fixed in 2.1.47. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import json...

Home Assistant - Supervisor Auth Bypass Detection (CVE-2023-27482)

Home Assistant supervised installs are vulnerable to authentication bypass via path traversal under /api/hassio/app/ and /api/hassioingress/ CVE-2023-27482, exposing supervisor/core info without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant Supervisor authentication...

D-Link DNS - Info Disclosure CGI Detection

Detects unauthenticated info disclosure on D-Link DNS via /cgi-bin/info.cgi, discovery.cgi, or statusmgr.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS devices unauthenticated info disclosure CGIs.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WD NAS - language_configuration RCE (CVE-2018-18472)

Exploits backtick injection in PUT /api/1.0/rest/languageconfiguration on WD My Cloud / My Book Live. Output is written under /var/www and fetched via HTTP. !/usr/bin/env python3 -- coding: utf-8 -- """Western Digital NAS languageconfiguration RCE CVE-2018-18472 — opens execute session.""" import...

Bitwarden Web Vault Detection

Detects Bitwarden Web Vault login panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Bitwarden Web Vault panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Bitwarden Web Vault Detection", "description":...

Pa11y Dashboard Exposure Detection

Pa11y Dashboard is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Pa11y Dashboard is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pa11y Dashboard Exposure Detection', 'description': 'Pa11y Dashboar...

Caddy 2.4.6 - Open Redirect Detection

Caddy 2.4.6 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site via a crafted URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Caddy 2.""" import re from...