WordPress Podlove Podcast Publisher RCE (CVE-2026-13001)

Exploits CVE-2026-13001 in Podlove Podcast Publisher = 4.5.1: serves a GIF89a polyglot built from the configured framework payload, triggers the image-cache fetch shell.php?.gif bypass, then executes the cached PHP via HTTP reversetcp connects back through the normal listener. !/usr/bin/env pytho...

ProFTPD mod_sql STOR basename RCE (CVE-2026-42167)

CVE-2026-42167 post-auth variant: an authenticated FTP user uploads a file whose basename starts/ends with a single quote isescapedtext bypass and embeds stacked SQL. With SQLLog STOR logging %basename into PostgreSQL, COPY TO PROGRAM runs an OS command on the DB host. Filenames cannot contain '/...

ProFTPD mod_sql is_escaped_text() pre-auth RCE (CVE-2026-42167)

CVE-2026-42167: ProFTPD modsql skips escaping when isescapedtext decides a value is already quoted. A crafted FTP USER value that starts and ends with a single quote and contains none in between injects stacked SQL into SQLLog / SQLNamedQuery templates. With a PostgreSQL backend whose role can CO...

UPnP Device Inventory

Dump UPnP device identity and service list from an SSDP session or direct LOCATION/rhost discover. !/usr/bin/env python3 -- coding: utf-8 -- """Inventory UPnP device description and services.""" from kittysploit import from lib.protocols.upnp.client import SSDPPORT from lib.protocols.upnp.session...

IEC 61850 MMS Client

Connects to an IEC 61850 MMS server ISO-on-TCP, completes COTP + Initiate, and creates an interactive MMS shell session. !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS bind listener — opens an MMS session for identify / directory.""" from kittysploit import from...

Windows x64 Meterpreter/Stage Reverse TCP Stager

x64 reverse TCP stager: connect, read 4-byte LE size + stage, VirtualAlloc RWX and jump. Use with a stage pusher or pair stagemode=shell for embedded cmd.exe stage. Listener: listeners/multi/meterpreterreversetcp or reversetcp for shell mode. from kittysploit import import base64 import struct...

PowerShell DNS Reverse Shell

Poll DNS TXT for commands and exfil output via result subdomain queries raw UDP DNS — custom nameserver IP:port. Pairs with listeners/covert/dns. from kittysploit import import base64 from lib.c2.dnsreverseagent import buildpowershelldnsagentscript class ModulePayload: """PowerShell DNS TXT polli...

Lua / awk Reverse TCP

Reverse TCP shell via Lua or awk minimal hosts / CTF / constrained Unix from kittysploit import class ModulePayload: CLIENTLANGUAGE = "lua" info = "name": "Lua / awk Reverse TCP", "description": "Reverse TCP shell via Lua or awk minimal hosts / CTF / constrained Unix", "category":...

Windows x64 Reverse TCP Stager

Position-independent x64 reverse TCP shellcode that connects back and spawns cmd.exe from kittysploit import class ModulePayload: """Windows x64 reverse TCP stager cmd.exe. Compatible with listeners/multi/reversetcp.""" info = "name": "Windows x64 Reverse TCP Stager", "description":...

Apache Druid - Remote Code Execution Detection

Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Drui...

Bottle debug mode enabled Detection

Detects Bottle debug mode enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Bottle debug mode enabled.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bottle debug mode enabled Detection', 'description':...

Kubernetes Dashboard <1.10.1 - Authentication Bypass Detection

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. !/usr/bin/env python3 -- coding: utf-8 -- """Kubernetes Dashboard before 1.""" from kittysploit import from lib.protocols.http.httpclient import...

Prometheus Config API Endpoint Discovery Detection

A Prometheus config API endpoint was discovered. The config endpoint returns the loaded Prometheus configuration file along with the addresses of targets and alerting/discovery services alongside the credentials required to access them. Usually, Prometheus replaces the passwords in the credential...

Tenable Nessus Panel - Detect

Tenable Nessus panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Tenable Nessus panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tenable Nessus Panel - Detect', 'description': 'Tenab...

Totemomail SMTP Server Detection

Totemomail is a comprehensive email solution designed to address all aspects of digital communication security. !/usr/bin/env python3 -- coding: utf-8 -- """Totemomail is a comprehensive email solution designed to address all aspects of digital communication security.""" import socket from...

Zend Server Test Page Detection

Detects Zend Server Test Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Zend Server Test Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zend Server Test Page Detection', 'description': 'Detects Zen...

Yearning - Directory Traversal Detection

Yearning has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information. The vulnerability is present in multiple versions of Yearning. !/usr/bin/env python3 -- coding: utf-8 -- """Yearning has a directory traversal vulnerability that can be exploited b...

Server Backup Manager SE Panel - Detect

Server Backup Manager SE login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Server Backup Manager SE login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Server Back...

Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure Detection

Fides versions 2.19.0 to before 2.39.2rc0 contain an information disclosure caused by unauthenticated HTTP GET request to the Privacy Center, letting attackers access the SERVERSIDEFIDESAPIURL, which may reveal server configuration details, exploit requires no authentication. !/usr/bin/env python...

FOSSBilling - Server-Side Template Injection

FOSSBilling stringrender API evaluates unsandboxed Twig, allowing SQL/info disclosure via guest.getDi.db.getCell. !/usr/bin/env python3 -- coding: utf-8 -- """FOSSBilling - Server-Side Template Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

Zabbix - SAML SSO Authentication Bypass Detection

When SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor because a user login stored in the session was not verified. !/usr/bin/env python3 -- coding: utf-8 -- """When SAML SSO authentication is enabled non-default, session data can be modified by a...

Ruijie RG-NBS2009G-P - Improper Authentication Detection

An issue in Ruijie RG-NBS2009G-P RGOS v.10.41P2 Release9736 allows a remote attacker to gain privileges via the system/configmenu.htm. !/usr/bin/env python3 -- coding: utf-8 -- """An issue in Ruijie RG-NBS2009G-P RGOS v.""" from kittysploit import from lib.protocols.http.httpclient import...

Cisco Finesse - Detect

Detected Cisco Finesse application and extracted version information from multiple sources. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Cisco Finesse application and extracted version information from multiple sources.""" from kittysploit import from lib.protocols.http.httpclient import...

Somfy Login Panel - Detect

Somfy login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Somfy login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Somfy Login Panel - Detect', 'description': 'Somfy login...

Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting Detection

Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Open-School 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Piano LED Visualizer 1.3 - Local File Inclusion Detection

Piano LED Visualizer 1.3 and prior are vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Piano LED Visualizer 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Piano LED...

WordPress Plugin InfiniteWP Client - Full Path Disclosure Detection

WordPress InfiniteWP Client plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress InfiniteWP Client plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

Gradio - Open Redirect Detection

Gradio allows an open redirect bypass via URL encoding, enabling attackers to redirect users to malicious sites. This can lead to phishing attacks and loss of trust in the application. !/usr/bin/env python3 -- coding: utf-8 -- """Gradio allows an open redirect bypass via URL encoding, enabling...

SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting Detection

SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'timebegin' parameter to SolarHistory.php. !/usr/bin/env python3 -- coding: utf-8 -- """SolarView Compact version 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Duplicator < 1.4.7.1 - Information Disclosure Detection

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site. !/usr/bin/env python3 -- coding: utf-8 -- """The Duplicator WordPress plugin before...

WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Read Detection

WordPress MultiSafepay for WooCommerce plugin through 4.13.1 contains an arbitrary file read vulnerability. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 --...

Enigma NMS - Detection

Detects Enigma NMS - Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Enigma NMS - Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Enigma NMS - Detection', 'description': 'Detects Enigma NMS...

Check Point FireWall-1 FTP Service - Detect

Check Point FireWall-1 FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Check Point FireWall-1 FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info =...

WordPress Duplicate Page - Full Path Disclosure Detection

WordPress Plugin Duplicate Page files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Duplicate Page files are publicly accessible withou...

Area Rat C2 - Detect

Ares is a Python Remote Access Tool. !/usr/bin/env python3 -- coding: utf-8 -- """Ares is a Python Remote Access Tool.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Area Rat C2 - Detect', 'description': 'Ares is a...

Vanna - SQL injection Detection

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...

Ellucian Ethos Identity CAS - Cross-Site Scripting Detection

A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. !/usr/bin/env python...

Teleport - Authentication Bypass Detection

Teleport versions prior to 17.5.2 are vulnerable to a remote authentication bypass vulnerability. This issue allows attackers to gain unauthorized access to affected systems. !/usr/bin/env python3 -- coding: utf-8 -- """Teleport versions prior to 17.""" from kittysploit import from...

Cacti - Cross-Site Scripting Detection

Cacti contains a cross-site scripting vulnerability via "http:///authchangepassword.php?ref=alert1" which can successfully execute the JavaScript payload present in the "ref" URL parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti contains a cross-site scripting vulnerability via...

VMWare Workspace ONE UEM - Server-Side Request Forgery Detection

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

ExaGrid Manager Login Panel - Detect

ExaGrid Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ExaGrid Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ExaGrid Manager Login Panel - Detect',...

Whisparr Dashboard - Unauthenticated Detection

Exposure of Whisparr dashboard which can lead to sensitive information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Exposure of Whisparr dashboard which can lead to sensitive information disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Liferay Portal & DXP - Cross-Site Scripting Detection

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Liferay Portal 7."""...

Fortinet FortiManager Panel - Detect

Fortinet FortiManager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiManager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fortinet FortiManager Panel - Detect',...

SOGo Detect

This template will detect a running SOGo instance !/usr/bin/env python3 -- coding: utf-8 -- """This template will detect a running SOGo instance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SOGo Detect',...

NETGEAR - Authentication Bypass Detection

NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers are vulnerable to authentication bypass vulnerabilities which could allow network-adjacent attackers to bypass authentication on affected installations...

Cisco Secure Firewall Management Center - Authentication Bypass Detection

Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests. !/usr/bin/env python3 -- coding: utf-8 --...

CKAN DataStore SQL Search - SQL Injection Detection

CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastoresearchsql API endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """CKAN, an open-source data management system used for powering open data...

Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read Detection

Citrix ShareFile StorageZones aka storage zones Controller versions through at least 5.10.x are susceptible to an unauthenticated arbitrary file read vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix ShareFile StorageZones aka storage zones Controller versions through at least...

Semi Arbitrary File Read in Dev Mode - Nuxt.js Detection

Arbitrary File Read in Dev Mode in Nuxt.js !/usr/bin/env python3 -- coding: utf-8 -- """Arbitrary File Read in Dev Mode in Nuxt.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Semi Arbitrary File Read in Dev Mode -...