XWiki Platform - Unauthorized Document History Access Detection

A vulnerability in XWiki Platform's REST API allows unauthorized users to access document history information. The REST API endpoint exposes the history of any page including modification times, version numbers, author details username and display name, and version comments, regardless of access...

Argus Surveillance DVR 4.0.0.0 - Local File Inclusion Detection

Argus Surveillance DVR 4.0.0.0 devices allow unauthenticated local file inclusion, leading to file disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Argus Surveillance DVR 4.""" from kittysploit import from lib.protocols.http.httpclien...

Kafka Manager Panel Detection

Detects Kafka Manager Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Kafka Manager Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kafka Manager Panel Detection', 'description': 'Detects Kafka...

Cyber Power Systems - Unauthenticated Detection

Detects unauthenticated access to Cyber Power Systems, which could lead to unauthorized control or information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects unauthenticated access to Cyber Power Systems, which could lead to unauthorized control or information.""" from kittysplo...

AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion Detection

AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Woodwing Studio Server Panel - Detect

Detects Woodwing Studio Server Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Woodwing Studio Server Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Woodwing Studio Server Panel ...

Netgear-WN604 downloadFile.php - Information Disclosure Detection

There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be...

Orangescrum Exposed Installation Detection

Orangescrum is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Orangescrum is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

BackupBuddy - Local File Inclusion Detection

BackupBuddy versions 8.5.8.0 - 8.7.4.1 are vulnerable to a local file inclusion vulnerability via the 'download' and 'local-destination-id' parameters. !/usr/bin/env python3 -- coding: utf-8 -- """BackupBuddy versions 8.""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Odoo <= 15.0 - Cross-Site Scripting Detection

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization Detection

DNN DotNetNuke versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution. !/usr/bin/env python3 -- coding: utf-8 --...

Apache NiFi detect

Detects Apache NiFi detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apache NiFi detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache NiFi detect', 'description': 'Detects Apache NiFi...

Owncloud StatusPage detection

Detects Owncloud StatusPage detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Owncloud StatusPage detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Owncloud StatusPage detection', 'description'...

Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection Detection

Teclib GLPI = 9.3.3 exposes a script /scripts/unlocktasks.php that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature to alter the semantic original SQL query and retrieve database records. !/usr/bin/env python3 -- coding:...

Travelpayouts <= 1.1.16 - Open Redirect Detection

The plugin is vulnerable to Open Redirect due to insufficient validation on the travelpayoutsredirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. !/usr/bin/env python...

L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting Detection

L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter. !/usr/bin/env python3 -- coding: utf-8 -- """L-Soft LISTSERV before 16.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Traefik - Open Redirect Detection

Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding...

LogRocket RUM - Detect

Detects LogRocket Session Replay & Frontend Monitoring artifacts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects LogRocket Session Replay & Frontend Monitoring artifacts.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

St. Joe ERP system - SQL Injection Detection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

Joomla JCE CVE-2026-48907 (unauthenticated RCE) detection

Detects Joomla sites running JCE Editor 2.9.99.5 vulnerable to CVE-2026-48907 unauthenticated arbitrary file upload leading to RCE. Combines JCE version fingerprinting with an optional active probe that uploads a harmless PHP math verifier no shell. !/usr/bin/env python3 -- coding: utf-8 -- impor...

WordPress Highlight and Share CVE-2025-67586

Detects vulnerable Highlight and Share plugin versions = 5.2.0 exposed to unauthenticated email share abuse via admin-ajax. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress cla...

PFCP UDP detection

Detects PFCP port 8805 5G N4 - SMF/UPF control plane. !/usr/bin/env python3 -- coding: utf-8 -- """Détection PFCP UDP 8805 - 5G N4 interface SMF-UPF.""" import socket from kittysploit import from core.framework.option import OptPort from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient...

Kibana detection

Detects if Kibana is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Kibana.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Kibana detection", "description": "Detects if Kibana is...

Web POST Listener

Web POST Listener payload in POST body from kittysploit import from lib.protocols.http.httpclient import Httpclient from base64 import b64encode class ModuleListener, Httpclient: info = 'name': 'Web POST Listener', 'description': 'Web POST Listener payload in POST body', 'author': 'KittySploit...

Linux SOCKS Proxy

Create a SOCKS proxy through a compromised Linux session for network pivoting from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import time class ModulePost, System, LinuxSessionMixin: info = "name": "Linux SOCKS Proxy",...

Android Get Info

Get information about an Android device from kittysploit import class ModulePost: info = 'name': 'Android Get Info', 'description': 'Get information about an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects':...

Artica Proxy 4.3.0 - Auth Bypass/OS Command Injection

Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Wordpress Plugin ACF Frontend Display

Wordpress Plugin ACF Frontend Display = 2.0.6 - Arbitrary File UploadThe ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php. from kittysploit import from...

Check robots.txt

Crawl a web site and store information about what was found from kittysploit import from lib.protocols.http.httpclient import Httpclient from colorama import Fore, Style class ModuleAuxiliary, Httpclient: info = 'name': 'Check robots.txt', 'description': 'Crawl a web site and store information...

Web site crawler

Crawl a web site and store information about what was found from kittysploit import from lib.protocols.http.httpcrawler import Httpcrawler from core.scanner.http.discovery import summarizecrawlurls class ModuleAuxiliary, Httpcrawler: info = 'name': 'Web site crawler', 'description': 'Crawl a web...

Wordpress Plugin Ad Inserter rce

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress class ModuleExploit, Httpclient, Wordpress: info = "name": "Wordpress Plugin Ad Inserter...

Web Download File

Download a file from a web server from kittysploit import class ModulePost: info = "name": "Web Download File", "description": "Download a file from a web server", "author": "KittySploit Team", "sessiontype": SessionType.PHP, "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects':...

Cisco Secure Email Gateway SQLi Chain (CVE-2026-76461)

Targets CVE-2026-76461 pre-authentication SQL injection in Cisco Secure Email Gateway AsyncOS email parsing. Confirms vulnerable AsyncOS builds via the management portal and documents SMTP-side exploitation TCP/25. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Secure Email Gateway AsyncOS SQ...

Spring4Shell RCE (CVE-2022-22965)

Exploits CVE-2022-22965 Spring Framework classLoader parameter binding to write a JSP webshell via Tomcat access log manipulation, then executes the configured reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """Spring4Shell parameter binding RCE CVE-2022-22965.""" import random...

Kyocera Printer LFI (CVE-2020-23575)

Exploits CVE-2020-23575 in Kyocera d-COPIA253MF: null-byte directory traversal via /wlmeng/ reads /etc/passwd and other local files. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera printer wlmeng traversal LFI CVE-2020-23575.""" import re from kittysploit import from...

Ivanti CSA Auth Bypass (CVE-2024-8963)

Exploits CVE-2024-8963 in Ivanti Cloud Services Appliance 4.6 Patch 519: path traversal via index.php%3F.php/gsb/users.php exposes admin user management. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti CSA path traversal auth bypass CVE-2024-8963.""" from kittysploit import from...

Pulse Secure SSL VPN File Read (CVE-2019-11510)

Exploits CVE-2019-11510 path traversal in Pulse Connect Secure to read arbitrary files such as /etc/passwd and VPN session data. !/usr/bin/env python3 -- coding: utf-8 -- """Pulse Secure SSL VPN arbitrary file read CVE-2019-11510.""" import re from kittysploit import from...

FUEL CMS PHP Code Evaluation RCE (CVE-2018-16763)

Exploits CVE-2018-16763 in FUEL CMS 1.4.1 via PHP code evaluation in the /fuel/pages/select/ filter parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS filter parameter PHP RCE CVE-2018-16763.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

NVIDIA Triton Inference Server Auth Bypass (CVE-2026-24207)

Exploits CVE-2026-24207 in NVIDIA Triton Inference Server = 26.02: unauthenticated access to restricted HTTP APIs including /models and model management endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """NVIDIA Triton Inference Server auth bypass CVE-2026-24207.""" import json from kittysplo...

Netis Router Info Disclosure (CVE-2024-48455)

Exploits CVE-2024-48455 in Netis WiFi routers: unauthenticated POST to skkget.cgi with modename/wllink leaks device stats and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Netis router skkget.cgi info disclosure CVE-2024-48455.""" from kittysploit import from...

vBulletin widget_php RCE (CVE-2019-16759)

Exploits CVE-2019-16759 in vBulletin 5.0.0–5.5.4 via unauthenticated ajax/render/widgettabbedcontainertabpanel widgetphp template injection. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin widgetphp RCE CVE-2019-16759.""" import hashlib import re import urllib.parse from kittysploit import...

WSO2 CVE-2026-5430 JWT Auth Bypass Detect

Detects CVE-2026-5430 in WSO2 API Manager / Control Plane / Traffic Manager / Universal Gateway: JWTUtil accepts tokens whose alg header is outside the supported RS256/384/512 set. Probes admin APIs with an alg:none X-JWT-Assertion. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WSO2...

WSO2 JWT Auth Bypass Admin Enum (CVE-2026-5430)

Uses CVE-2026-5430 to reach WSO2 admin APIs with a forged alg:none JWT in X-JWT-Assertion. Lists applications and subscription keys when the gateway fails open on unsupported JWT algorithms. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 CVE-2026-5430 JWT alg:none admin API access via...

Check Point CVE-2026-85102 VPN Detect

Detects Check Point Security Gateway / Spark firewall exposure to CVE-2026-85102: improper certificate validation during Site-to-Site or Remote Access VPN negotiation sk1000117. Fingerprints SSL VPN / Mobile Access login surfaces and flags builds before fixed JHF takes. !/usr/bin/env python3 --...

SonicWall SMA1000 CVE-2026-83548 SSRF Detect

Detects CVE-2026-83548 in SonicWall SMA1000 WorkPlace before hotfixes 12.4.3-03526 / 12.5.0-02952. Sends an unauthenticated absolute-form OPTIONS request that WorkPlace forwards to loopback CouchDB; a 405 methodnotallowed JSON body confirms the SSRF primitive. !/usr/bin/env python3 -- coding: utf...

Netcore NAP930 CVE-2026-102240 Detect

Detects CVE-2026-102240 in Netcore NAP930 access points: pre-auth command injection in /cgi-bin/networktools via eval on raw QUERYSTRING before the sid session check. Confirms endpoint presence and optionally writes a marker file to /www/ when activeprobe is enabled. !/usr/bin/env python3 --...

ILIAS <= 9.21 / 10.9 / 11.2 - PHP Object Injection RCE (CVE-2026-80428)

Unauthenticated PHP object injection in ILIAS via ltiauth.php session seeding and shiblogout.php SOAP LogoutNotification mass-unserialize. Chains GuzzleHttp\Cookie\FileCookieJar to write a webshell under the ILIAS docroot. Fixed in ILIAS 9.22 / 10.10 / 11.3. Packaged ILIAS 11.x shiblogout.php is...

D-Link DIR-895L CVE-2026-100740 L2TP OOB Write Detection

Detects D-Link DIR-895L firmware A1102b07 and an exposed L2TP UDP/1701 service associated with CVE-2026-100740 Host Name AVP out-of-bounds write. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-100740 — D-Link DIR-895L L2TP Host Name AVP OOB write detection.""" from future import annotation...

Zabbix locales.php RCE

Exploits unauthenticated PHP code injection in Zabbix = 1.6.2 via the extlang parameter on locales.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Zabbix locales.php RCE = 1.6.2 — execute session.""" from future import annotations import re from urllib.pars...

Dahua ICC - GetClassValue.jsp RCE

Exploits unauthenticated remote code execution in Dahua Intelligent IoT Integrated Management Platform via RuntimeUtil.syncexecReturnInputStream on GetClassValue.jsp. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua ICC GetClassValue.jsp RCE — execute...