Vulners Software Audit

Query the Vulners Software Audit API for known vulnerabilities matching one or more software products/versions CPE string or vendor:product:version. Bring-your-own-key BYOK: set apikey, plugin config, or VULNERSAPIKEY. Prefer plugin run vulners … as the hub; this scanner is a thin wrapper...

Sonicwall - Pre-Authentication Arbitrary File Read Detection

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

Apache HTTPD - Optionsbleed Detection (CVE-2017-9798)

Detects CVE-2017-9798 by sending repeated OPTIONS requests and looking for malformed Allow headers double commas / numeric garbage. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OPTIONS Allow header memory leak / Optionsbleed CVE-2017-9798.""" import re from kittysploit import from...

Apache mod_userdir CRLF injection Detection

Apache CRLF injection allowing HTTP response splitting attacks on sites using moduserdir. !/usr/bin/env python3 -- coding: utf-8 -- """Apache CRLF injection allowing HTTP response splitting attacks on sites using moduserdir.""" import re from kittysploit import from lib.protocols.http.httpclient...

Paystack Secret/Live Key - Exposure Detection

Detected exposed Paystack secret keys test or live found in application source code, configuration files, or client-side assets. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Paystack secret keys test or live found in application source code, configuration files, or.""" import re...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting Detection

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect Detection

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. !/usr/bin/env python3 -- coding: utf-8 -- """In Apache HTTP server 2.""" impo...

Zerologon DC Password Reset (CVE-2020-1472)

Exploits CVE-2020-1472 Zerologon: brute-forces NetrServerAuthenticate3 with all-zero credentials, then resets the domain controller machine account password to empty via NetrServerPasswordSet2. Enables DCSync with secretsdump using -hashes...

Samba CVE-2017-7494 (version check)

Non-intrusive SambaCry likelihood check based on disclosed Samba version NSE smb-vuln-cve-2017-7494 check-version mode. Does not upload libraries. !/usr/bin/env python3 -- coding: utf-8 -- """SambaCry CVE-2017-7494 version check NSE smb-vuln-cve-2017-7494 check-version.""" from kittysploit import...

Pure-FTPd Service - Detect

Pure-FTPd FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Pure-FTPd FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'Pure-FTPd Service -...

XWiki < 14.10.14 - Cross-Site Scripting Detection

XWiki is vulnerable to reflected cross-site scripting RXSS via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the...

Zerologon CVE-2020-1472 Detect

Detects CVE-2020-1472 Zerologon by attempting Netlogon NetrServerAuthenticate3 with all-zero credentials against the domain controller Netlogon RPC interface TCP/135 or 445. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zerologon Netlogon authentication bypass CVE-2020-1472.""" from...

Heimdall Application Dashboard < 2.7.3 - Reflected XSS Detection

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. !/usr/bin/env python3 -- coding: utf-8 -- """LinuxServer.""" from kittysploit import from...

MajorDoMo Admin Console RCE (CVE-2026-27174)

Exploits CVE-2026-27174 in MajorDoMo: unauthenticated access to the admin PHP console via /admin.php?ajaxpanel=1&op=console&command= allows arbitrary PHP/code execution. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo unauthenticated admin console PHP execution CVE-2026-27174.""" import re...

ClearML Panel - Detect

ClearML was detected. ClearML is an open-source MLOps platform for experiment tracking, model management, and pipeline orchestration. Exposed instances may allow access to ML experiments, models, and infrastructure configurations. !/usr/bin/env python3 -- coding: utf-8 -- """ClearML was...

Dreamweaver Dwsync.xml Exposure Detection

The Dreamweaver file dwsync.xml was discovered. The dwsync.xml file is a file generated by Dreamweaver which contains information related to what files are in the website directory. !/usr/bin/env python3 -- coding: utf-8 -- """The Dreamweaver file dwsync.""" from kittysploit import from...

Express.js RCE

Remote Code Execution exploit for Express.js applications including template injection and code injection vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse import json class ModuleExploit,...

H3C SSL VPN <=2022-07-10 - Cross-Site Scripting Detection

H3C SSL VPN 2022-07-10 and prior contains a cookie-based cross-site scripting vulnerability in wnm/login/login.json svpnlang. !/usr/bin/env python3 -- coding: utf-8 -- """H3C SSL VPN 2022-07-10 and prior contains a cookie-based cross-site scripting vulnerability in wnm/login/login.""" from...

WordPress Events Manager - Full Path Disclosure Detection

WordPress WP Super Cache plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WP Super Cache plugin files are publicly accessible withou...

Microsoft FTP Service Detect

The File Transfer Protocol FTP is a standard network protocol used to transfer computer files between a client and server on a computer network. !/usr/bin/env python3 -- coding: utf-8 -- """The File Transfer Protocol FTP is a standard network protocol used to transfer computer files between a...

Basilic - diff.php RCE Detection

Detects Basilic = 1.5.14 RCE via /Config/diff.php?file=;id&new=1&old=2. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Cryptobox Panel - Detect

Cryptobox was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cryptobox was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cryptobox Panel - Detect', 'description': 'Cryptobox was detected.',...

Well-Known ATProto DID Detection

Detects AT Protocol DID reference used by Bluesky. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AT Protocol DID reference used by Bluesky.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Well-Known ATProto DI...

Home Assistant - Supervisor Auth Bypass Info Leak (CVE-2023-27482)

Uses CVE-2023-27482 path-traversal auth bypass to fetch supervisor/core JSON info without credentials. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant Supervisor auth bypass info leak CVE-2023-27482.""" from kittysploit import from...

PostgreSQL COPY FROM PROGRAM RCE (CVE-2019-9193)

Authenticated remote code execution via COPY FROM PROGRAM on PostgreSQL 9.3 through 11.7. Requires a superuser database session. import re from typing import Optional, Tuple from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost,...

Dashy <= 4.3.6 - Reflected XSS via Workspace Detection

Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...

Apache Tomcat Tribes EncryptInterceptor bypass (CVE-2026-34486)

Cleartext Tribes ChannelReceiver traffic may be deserialized after failed decryption EncryptInterceptor. Provide command CommonsCollections6, no JVM or serializedpath for a custom chain. Requires commons-collections 3.x on the target matching this gadget. !/usr/bin/env python3 -- coding: utf-8 --...

Control Web Panel /admin/index.php Unauthenticated RCE

Control Web Panel CWP versions = 0.9.8.1208 are vulnerable to unauthenticated OS command injection. User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly sanitized before being used to execute OS commands. This can be exploited by...

Bash Shellshock - HTTP CGI RCE (CVE-2014-6271)

Exploits Shellshock via User-Agent injection against a CGI path. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Bash Shellshock HTTP CGI RCE CVE-2014-6271 — opens execute session.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Bash Shellshock HTTP CGI RCE (CVE-2014-6271)

Exploits CVE-2014-6271 by injecting :;; into HTTP headers against CGI-enabled paths. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Bash Shellshock HTTP CGI RCE CVE-2014-6271 — execute session.""" from future import annotations import re from kittysploit import...

Bash Shellshock - HTTP CGI Detection (CVE-2014-6271)

Detects Shellshock by injecting :;; id into User-Agent/Referer/Cookie against common CGI paths and matching uid=/gid=. !/usr/bin/env python3 -- coding: utf-8 -- """GNU Bash Shellshock HTTP CGI RCE CVE-2014-6271 / CVE-2014-6278.""" import re from kittysploit import from lib.protocols.http.httpclie...

WordPress Plugin File Manager (wp-file-manager) Backup Disclosure Detection

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fmbackups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken...

CMSimple 3.1 - Local File Inclusion Detection

CMSimple 3.1 is susceptible to local file inclusion via cmsimple/cms.php when registerglobals is enabled which allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including...

Samba CVE-2026-4480 detection

Fingerprints Samba and flags versions affected by CVE-2026-4480 print-command %J command injection. Fixed upstream in 4.22.10, 4.23.8, and 4.24.3. Actual exploitability also requires a custom print command that references %J and is not using cups/iprint. !/usr/bin/env python3 -- coding: utf-8 --...

ASUS DSL-AC88U Auth Bypass (CVE-2024-3080)

Exploits CVE-2024-3080 in ASUS DSL-AC88U: /js/..%2f%2f or /images/..%2f%2e traversal bypasses authentication and exposes admin wizard pages. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS DSL-AC88U path traversal auth bypass CVE-2024-3080.""" from kittysploit import from...

ProFTPD mod_sql is_escaped_text() pre-auth RCE (CVE-2026-42167)

CVE-2026-42167: ProFTPD modsql skips escaping when isescapedtext decides a value is already quoted. A crafted FTP USER value that starts and ends with a single quote and contains none in between injects stacked SQL into SQLLog / SQLNamedQuery templates. With a PostgreSQL backend whose role can CO...

Spring Boot Actuator H2 RCE

Exploits exposed Spring Boot Actuator /actuator/env to inject an H2 connection-test-query CREATE ALIAS EXEC and restart the application, yielding remote command execution when spring.datasource.hikari is active. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Actuator H2...

ProFTPD mod_sql STOR basename RCE (CVE-2026-42167)

CVE-2026-42167 post-auth variant: an authenticated FTP user uploads a file whose basename starts/ends with a single quote isescapedtext bypass and embeds stacked SQL. With SQLLog STOR logging %basename into PostgreSQL, COPY TO PROGRAM runs an OS command on the DB host. Filenames cannot contain '/...

Sangoma Switchvox CVE-2026-9586 /pa SQLi RCE

Exploits CVE-2026-9586 via the unauthenticated /pa XML phone-notification endpoint. Injects stacked PostgreSQL into the PhoneIP field and uses COPY ... TO PROGRAM to run a shell command as the database superuser. !/usr/bin/env python3 -- coding: utf-8 -- """Sangoma Switchvox CVE-2026-9586...

Zeroshell 3.9.3 - Command Injection Detection

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell 3."...

MajorDoMo - Unauthenticated RCE Detection

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo contains a remote...

N-able N-central CVE-2026-86218 Detect

Detects N-able N-central builds before 2026.3.1.14 Hotfix 4 that expose the pre-authentication /remoteControlAction.do?method=getPierDetails reconnaissance endpoint associated with CVE-2026-86218 static code injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect N-able N-central...

ZTE F460/F660 - web_shell_cmd.gch RCE (CVE-2014-2321)

Exploits CVE-2014-2321 by POSTing Cmd= to /webshellcmd.gch. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE F460/F660 webshellcmd.gch RCE CVE-2014-2321 — opens execute session.""" from urllib.parse import quote from kittysploit import from...

vsftpd - Compromised Package Backdoor Detection (CVE-2011-2523)

Detects CVE-2011-2523 by sending USER X: / PASS X then checking for a shell on TCP/6200 that responds to id. !/usr/bin/env python3 -- coding: utf-8 -- """vsftpd 2.3.4 backdoor CVE-2011-2523.""" import re import socket import time from kittysploit import from lib.protocols.tcp.tcpscannerclient...

Apache Tomcat - PUT JSP Upload RCE (CVE-2017-12617)

Uploads a JSP webshell via Tomcat PUT trailing-slash bypass CVE-2017-12615/12617 and opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat PUT JSP upload RCE CVE-2017-12617 — opens execute session.""" import re from kittysploit import from...

Apache Tomcat - PUT JSP Upload Detection (CVE-2017-12615/12617)

Detects CVE-2017-12615/12617 by PUT-uploading a JSP via trailing-slash path and verifying execution on GET. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat HTTP PUT JSP upload RCE CVE-2017-12615 / CVE-2017-12617.""" from kittysploit import from lib.protocols.http.httpclient import...

kotaemon Insecure Deserialization RCE (CVE-2026-69098)

Exploits CVE-2026-69098 in kotaemon = 0.12.0: unauthenticated Gradio handlers createllm and checkconnection deserialize attacker-controlled YAML/JSON with deserializesafe=False. A unittest.mock.Mock wrapper around subprocess.checkoutput executes arbitrary commands; stdout is returned in-band via...

Apache Tomcat - Cross-Site Scripting Detection

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, fro...

Search Engine Footprint

Run passive search-engine dorks site:, filetype:, inurl: and collect indexed URLs, titles, and sensitive path hints. !/usr/bin/env python3 -- coding: utf-8 -- """Passive search-engine footprinting via HTML search results.""" from future import annotations import json import re from typing import...

Linux Kernel LPE Router (CVE-2026)

From a low-privilege Linux shell, scores public 2026 kernel LPE modules Copy Fail, badepoll, nftables catch-all, ptrace, PackageKit, etc. and optionally runs the highest-priority eligible module on this session. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Linux kernel LPE candidates 2026 a...