Kibana Console Path Traversal LFI (CVE-2018-17246)

Exploits CVE-2018-17246 in Kibana 6.4.3 / 5.6.13: path traversal in /api/console/apiserver apis parameter reads arbitrary local files. !/usr/bin/env python3 -- coding: utf-8 -- """Kibana Console plugin path traversal LFI CVE-2018-17246.""" import re from kittysploit import from...

SolarWinds WHD Deserialization RCE (CVE-2024-28986)

Exploits CVE-2024-28986 in SolarWinds Web Help Desk 12.8.3: Java deserialization on Helpdesk.woa endpoints allows remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """SolarWinds Web Help Desk deserialization RCE CVE-2024-28986.""" import re from kittysploit import from...

PaperCut NG/MF Pre-Auth RCE (CVE-2026-81578 + CVE-2026-82078)

Chains CVE-2026-81578 Tapestry direct-service auth bypass with CVE-2026-82078 external user-lookup JDBC abuse. On PaperCut 26.x, reconfigures H2 INIT SQL to evaluate Groovy that launches a shell command, then restores factory lookup settings. !/usr/bin/env python3 -- coding: utf-8 -- """PaperCut...

Stage Verify (PowerShell)

Verify staged artifact SHA256 before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify PowerShell", "description": "Verify staged artifact SHA256 before callback",...

Capability Probe (Zig)

Detect OS, architecture, runtime, privileges, writable directory, and network capabilities before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "capabilityprobe" info = "name": "Capability Probe Zig",...

PaperCut CVE-2026-82078 SQL Primitive Detect

Detects CVE-2026-82078 in PaperCut NG/MF when chained with CVE-2026-81578: attacker-controlled user-lookup SQL templates and JDBC driver settings can be written via unauthenticated Tapestry ConfigEditor direct-service requests. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

WSO2 JWT Auth Bypass Admin Enum (CVE-2026-5430)

Uses CVE-2026-5430 to reach WSO2 admin APIs with a forged alg:none JWT in X-JWT-Assertion. Lists applications and subscription keys when the gateway fails open on unsupported JWT algorithms. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 CVE-2026-5430 JWT alg:none admin API access via...

Stage Cache (PowerShell)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Signed Config (Zig)

Embed encrypted and signed operator config separate from the payload body !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.signedconfigcontext import resolvesignedconfigcontext class ModulePrestage: PRESTAGEID =...

SharePoint CVE-2026-65660 ToolPane Detect

Detects on-prem SharePoint farms exposed to CVE-2026-65660: ToolPane Register directive quote injection on AddGallery/ToolPane endpoints. Fingerprints MicrosoftSharePointTeamServices build and reachable layouts/15/ gallery edit surfaces without sending exploit markup. !/usr/bin/env python3 --...

Magento CVE-2026-71362 Customer Account Takeover

Exploits CVE-2026-71362 APSB26-92: a failed customer account editPost leaves attacker-controlled customerformdata in session, and a later edit consumes mass-assigned id to rebind the session to another customer. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CVE-2026-71362 customer session...

WSO2 CVE-2026-5430 JWT Auth Bypass Detect

Detects CVE-2026-5430 in WSO2 API Manager / Control Plane / Traffic Manager / Universal Gateway: JWTUtil accepts tokens whose alg header is outside the supported RS256/384/512 set. Probes admin APIs with an alg:none X-JWT-Assertion. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WSO2...

FreePBX - Unauth SQLi Detection (CVE-2025-57819)

Detects CVE-2025-57819 via error-based SQL injection on /admin/ajax.php brand parameter, Endpoint Manager module. Confirms MySQL XPATH error leaking freepbxuser. Full RCE requires stacked-query cronjobs injection. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX Endpoint Manager unauth SQLi...

ALCASAR Host Header RCE

Exploits ALCASAR command injection via a crafted Host header on /alcasar/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ALCASAR Host header command injection RCE — execute session.""" from future import annotations import re from kittysploit import...

DotCMS Arbitrary File Upload RCE (CVE-2022-26352)

Exploits CVE-2022-26352 path traversal in multipart filenames on POST /api/content/ to write a JSP shell under webapps/ROOT, then triggers a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """DotCMS arbitrary file upload RCE CVE-2022-26352 — JSP upload + reverse CMD.""" from future...

SAP NetWeaver ConfigServlet RCE

Exploits unauthenticated command execution via EXECUTECMD on /ctc/servlet/ConfigServlet/. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver ConfigServlet EXECUTECMD RCE — execute session.""" from future import annotations import re from urllib.parse...

Drupal RESTWS passthru RCE

Exploits Drupal RESTWS module RCE via taxonomyvocabulary passthru callbacks SA-CONTRIB-2016-040. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal RESTWS taxonomyvocabulary passthru RCE — execute session.""" from future import annotations import re from...

TWiki debugenableplugins RCE (CVE-2014-7236)

Exploits CVE-2014-7236 Perl injection via debugenableplugins on /view/Main/WebHome. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TWiki debugenableplugins Perl RCE CVE-2014-7236 — execute session.""" from future import annotations import re from urllib.parse...

DedeCMS flink.php RCE

Exploits DedeCMS 5.8.1-beta variable override via Referer header injection on /plus/flink.php with the c query parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """DedeCMS 5.8.1-beta flink.php variable override RCE — execute session.""" from future import...

Ghost CMS Remote Code Execution (CVE-2026-29053)

Exploits CVE-2026-29053 in Ghost CMS 0.7.2–6.19.0: a malicious theme template abuses Handlebars get filter parsing to reach Node.js childprocess.exec. Requires Ghost Admin access password, API key, session cookie, session secret, or invite flow. Versions 5.105.0–5.130.5 and 6.0.0–6.10.3 also...

routeros_jailbreak

routerosjailbreak !/usr/bin/env python3 -- coding: utf-8 -- """routerosjailbreak""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'routerosjailbreak', 'description': 'routerosjailbreak', 'author': 'KittySploit Team',...

P2P wificam credential disclosure

A credential disclosure in several cameras which utilize the GoAhead webserver. !/usr/bin/env python3 -- coding: utf-8 -- """P2P wificam credential disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name'...

Cisco Firepower Management 6.0 Path Traversal

Module exploits Cisco Firepower Management 6.0 Path Traversal vulnerability. If the target is vulnerable, it is possible to retrieve content of the arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Firepower Management 6.0 Path Traversal""" import re from kittysploit import from...

Orkes Conductor / Conductor OSS < 3.30.2 - Unauthenticated RCE (CVE-2026-58138)

CVE-2026-58138: Conductor OSS and Orkes Conductor versions below 3.30.2 allow unauthenticated remote code execution by registering a workflow with a malicious INLINE JavaScript task that abuses unsandboxed GraalVM HostAccess.ALL for Java reflection and Runtime.exec. !/usr/bin/env python3 -- codin...

PHPMoAdmin - find Parameter RCE Detection (CVE-2015-2208)

Detects CVE-2015-2208 by requesting moadmin.php with find=array;phpinfo; and matching phpinfo markers. !/usr/bin/env python3 -- coding: utf-8 -- """PHPMoAdmin find=array;phpinfo; RCE CVE-2015-2208.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Beward IP Camera - servetest NTP RCE Detection (CVE-2025-34042)

Detects Beward camera command injection via /cgi-bin/operator/servetest?cmd=ntp&ServerName=pool.ntp.org|id|| !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera servetest NTP command injection CVE-2025-34042 / Feb 2019.""" import re from kittysploit import from...

AWStats - Config Path Traversal Detection (CVE-2017-1000501)

Detects CVE-2017-1000501 by requesting awstats.pl?config=../../../../../etc/passwd and matching AWStats syntax-error markers that include the traversed path. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats config path traversal CVE-2017-1000501.""" from kittysploit import from...

Monit - Default Credentials Detection

Tries admin:monit against Monit Basic auth WWW-Authenticate realm=monit and looks for Monit: in a 200 response. !/usr/bin/env python3 -- coding: utf-8 -- """Monit default credentials admin:monit.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

PHP File Manager - Backdoor Login Detection

Detects PHP File Manager backdoor account DONOTREMOVETHISENTRY / travan44 via multipart login. !/usr/bin/env python3 -- coding: utf-8 -- """PHP File Manager hardcoded backdoor credentials.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Synology DSM/BSM - File Disclosure via RedirectURI (CVE-2024-50629)

Exploits improper encoding in SYNO.API.Auth.RedirectURI to inject an X-Accel-Redirect header and read limited internal files default: Synology Drive cloud-workerd.log. Works on vulnerable DSM and BeeStation. !/usr/bin/env python3 -- coding: utf-8 -- """Synology DSM/BSM limited file read via...

QNAP - pingping.cgi Command Injection (CVE-2013-0143)

Exploits CVE-2013-0143 via /cgi-bin/pingping.cgi?pingip=1;;. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP pingping.cgi RCE CVE-2013-0143 — opens execute session.""" import base64 import re from urllib.parse import quote from kittysploit import from...

CasaOS - Arbitrary File Read via users/image (CVE-2024-24765)

Reads arbitrary files through CasaOS-UserService /v1/users/image?path= CVE-2024-24765, fixed in 0.4.7. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS arbitrary file read via /v1/users/image CVE-2024-24765.""" import re from kittysploit import from...

ASUS RT - AICloud smb Traversal Detection (CVE-2013-4937)

Detects CVE-2013-4937 by requesting /smb/tmp/etc/shadow and matching passwd-style entries. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS RT AICloud smb path traversal CVE-2013-4937.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

HP Data Protector - EXEC_CMD RCE Detection (CVE-2011-0923)

Detects CVE-2011-0923 by sending an EXECCMD omniback request that runs windows\system32\ipconfig.exe and matching IP configuration output. !/usr/bin/env python3 -- coding: utf-8 -- """HP Data Protector EXECCMD RCE CVE-2011-0923.""" import socket import time from kittysploit import from...

Apache ActiveMQ - Double-Slash Source Disclosure Detection (CVE-2010-1587)

Detects CVE-2010-1587 by requesting //admin/queues.jsp and matching the raw JSP expression $sessionScope"secret" in the response body. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-1587 by requesting //admin/queues.""" import re from kittysploit import from...

Beward IP Camera - fileread File Read

Reads arbitrary files via /cgi-bin/operator/fileread?READ.filePath=. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera arbitrary file read via fileread.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

osCommerce - file_manager.php Upload RCE (CVE-2009-20006)

Exploits CVE-2009-20006 by writing PHP via admin/filemanager.php/login.php?action=save. !/usr/bin/env python3 -- coding: utf-8 -- """osCommerce filemanager.php upload RCE CVE-2009-20006.""" from random import randint from kittysploit import from lib.protocols.http.httpclient import Httpclient fro...

WD NAS - language_configuration RCE (CVE-2018-18472)

Exploits backtick injection in PUT /api/1.0/rest/languageconfiguration on WD My Cloud / My Book Live. Output is written under /var/www and fetched via HTTP. !/usr/bin/env python3 -- coding: utf-8 -- """Western Digital NAS languageconfiguration RCE CVE-2018-18472 — opens execute session.""" import...

Eir D1000 - CWMP WLAN Key Disclosure Detection (CVE-2016-10372)

Soft-detects Eir D1000 CWMP exposure by confirming /globe fingerprint then calling GetSecurityKeys and extracting NewPreSharedKey Mirai-era TR-069 RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Eir D1000 CWMP WLAN key disclosure CVE-2016-10372 soft check.""" import re from kittysploit...

tRPC / OpenAPI Procedure Enumeration

Probes /api/trpc for common procedures, batch amplification, and exposed openapi.json routes. Extracts dotted procedure names from JS bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate tRPC procedures and related OpenAPI routes on Next.js apps.""" from kittysploit import from...

Terraform State Secrets Detection

Probes common terraform.tfstate paths on the web root and extracts passwords, API keys, private keys, and connection strings from state JSON. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Terraform state files and extract sensitive values.""" from kittysploit import from...

Auth0 Passwordless Enumeration

Uses leaked Auth0 domain and clientid to probe /passwordless/start for active email magic-link and OTP flows. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Auth0 passwordless email link and OTP flows.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

GCP Compute SSH BIND

BIND payload for listeners/gcp/computessh. Operator connects to a Compute Engine VM via gcloud compute ssh or direct Paramiko. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: info = "name": "GCP Compute SSH BIND", "description": "BIND payload for...

SSH Client BIND

BIND payload for listeners/multi/sshclient !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "SSH Client BIND", "description": "BIND payload for listeners/multi/sshclient", "category":...

Ollama GGUF Heap OOB Read (CVE-2026-7482)

CVE-2026-7482 in ollama/ollama then triggers model creation. Success leaks heap memory into the stored Q80 layer. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-7482 — Ollama GGUF heap out-of-bounds read info disclosure.""" import hashlib import json import struct import requests from...

SiYuan CVE-2026-66012 MCP Auth Bypass Detect

Detects CVE-2026-66012 in SiYuan kernel 3.7.0 = v 3.7.2: POST /mcp on the Publish port default 6808 accepts anonymous RoleReader JWTs when Publish auth is disabled, exposing MCP tools including workspace file read without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SiYuan...

WordPress Podlove Podcast Publisher RCE (CVE-2026-13001)

Exploits CVE-2026-13001 in Podlove Podcast Publisher = 4.5.1: serves a GIF89a polyglot built from the configured framework payload, triggers the image-cache fetch shell.php?.gif bypass, then executes the cached PHP via HTTP reversetcp connects back through the normal listener. !/usr/bin/env pytho...

TFTP Enum

Attempts TFTP RRQ for common config/boot filenames NSE tftp-enum. !/usr/bin/env python3 -- coding: utf-8 -- """TFTP common-file enum NSE tftp-enum.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.tftp.detectors import probetftpenum class...

PowerShell DNS Reverse Shell

Poll DNS TXT for commands and exfil output via result subdomain queries raw UDP DNS — custom nameserver IP:port. Pairs with listeners/covert/dns. from kittysploit import import base64 from lib.c2.dnsreverseagent import buildpowershelldnsagentscript class ModulePayload: """PowerShell DNS TXT polli...

TIBCO Managed File Transfer - Panel Detection

TIBCO Managed File Transfer Login Panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """TIBCO Managed File Transfer Login Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'TIBCO Manag...